Does the Health Breach Notification Rule apply to a HIPAA-covered entity or business associate?

The Health Breach Notification Rule does not reach a HIPAA-covered entity, or any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity. The line blurs for a company that is a business associate but also offers personal health record services to the public, because FTC guidance says it may be subject to both the HHS and FTC breach notification rules.

Is a breach limited to hacking, or does our own sharing of data with an ad platform count?

Sharing health data without the individual’s authorization can be a breach. The regulation says a breach of security includes an unauthorized acquisition of unsecured PHR identifiable health information that occurs as a result of a data breach or an unauthorized disclosure. The GoodRx complaint alleged exactly that kind of breach, through disclosures to Facebook and Google. Chair Khan, in her remarks on the Commission’s 2021 policy statement, put it this way: the Rule does not just apply to cybersecurity intrusions or other nefarious behavior.

Is an app that only collects what users type in covered?

That turns on whether the app has the technical capacity to draw information from multiple sources. Under the current regulation, a personal health record is an electronic record of PHR identifiable health information on an individual that has that technical capacity and is managed, shared, and controlled by or primarily for the individual. That wording is broader than the earlier version, which said “can be drawn from multiple sources.” In 2023, under that earlier wording, Commissioner Wilson explained that BetterHelp’s platform did not hold a personal health record because it did not include records that “can be drawn from multiple sources.” Commissioner Holyoak’s dissent reads the 2024 wording to mean that a single source of health information makes an app a PHR as long as it has the technical capacity to draw other information elsewhere. The majority responded that some products and services do not satisfy the requirement.

Do we have to notify anyone if an employee loses a laptop?

Not if the health records on it were encrypted. FTC guidance gives that example: if an employee loses a laptop containing only encrypted personal health records, notification is not required. The reason is that notice is triggered only by unsecured information, meaning information not protected through a technology or methodology specified by the Secretary of Health and Human Services.

How quickly must we send breach notices?

Notices must go out without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security, subject to a law enforcement exception. The burden is on the business to demonstrate that all notifications were made as required, including evidence demonstrating the necessity of any delay.

What if someone accessed our data but we cannot tell whether anything was downloaded?

Acquisition is presumed unless the business has reliable evidence otherwise. The regulation presumes that unauthorized acquisition includes unauthorized access unless the entity that experienced the breach has reliable evidence showing there has not been, or could not reasonably have been, unauthorized acquisition. FTC guidance describes the practical effect: where there has been unauthorized access, unauthorized acquisition is presumed unless you can show that it has not, or could not reasonably have, taken place.

What happens if a business misses a notice?

The failure is a rule violation that can carry civil penalties. A violation is treated as a violation of a rule promulgated under section 18 of the FTC Act and is thus subject to civil penalties. In GoodRx, the complaint charged that the company violated the HBNR by failing to notify individuals and the Commission of a breach, and the case ended in a stipulated order.

HealthAct or rule

Health Breach Notification Rule

Berkeley Robinson, Managing Attorney at Robinson Law Firm PLLC

Author

Berkeley Robinson, Esq.

Managing Attorney, Robinson Law Firm PLLC

Berkeley has served as the go-to counsel for many scaling businesses in a transactional and litigation management capacity. Before becoming an attorney, Berkeley grew sales teams, ran online marketing campaigns, and did everything else an entrepreneur does—and still does today as the founder of two online businesses.

Definition

Health Breach Notification Rule requires each vendor of personal health records, and each PHR related entity, that discovers a breach of security of unsecured PHR identifiable health information to notify affected individuals, the Federal Trade Commission, and, when 500 or more residents of a State or jurisdiction are affected, prominent media outlets. Source: 16 C.F.R. § 318.3 It implements section 13407 of the American Recovery and Reinvestment Act of 2009 and applies to foreign and domestic vendors of personal health records, PHR related entities, and third party service providers, but not to HIPAA-covered entities or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity. Source: 16 C.F.R. § 318.1

Key legal rules

These are the main duties the Health Breach Notification Rule places on a business:

A breach of security includes an unauthorized acquisition of unsecured PHR identifiable health information in a personal health record that occurs as a result of a data breach or an unauthorized disclosure, so a company’s own sharing without the individual’s authorization can trigger notice. Source: 16 C.F.R. § 318.2 Unauthorized acquisition is presumed to include unauthorized access unless the vendor, PHR related entity, or third party service provider that experienced the breach has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of the information. Source: 16 C.F.R. § 318.2
Notice is triggered only by unsecured information, meaning PHR identifiable information that is not protected through a technology or methodology specified by the Secretary of Health and Human Services in guidance issued under section 13402(h)(2) of the American Recovery and Reinvestment Act of 2009. Source: 16 C.F.R. § 318.2
A breach of security is treated as discovered on the first day it is known or reasonably should have been known to the vendor, PHR related entity, or third party service provider, and that knowledge is deemed to exist if any employee, officer, or other agent other than the person committing the breach knew or reasonably should have known of it. Source: 16 C.F.R. § 318.3
Except under the law enforcement exception, notices to individuals, to the media, and by third party service providers must be sent without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security. Source: 16 C.F.R. § 318.4 Notice to the FTC of a breach involving 500 or more individuals must be provided contemporaneously with the individual notice, while logged breaches involving fewer than 500 individuals may be sent annually, no later than 60 calendar days after the end of the calendar year. Source: 16 C.F.R. § 318.4 If a law enforcement official determines that a notification, notice, or posting would impede a criminal investigation or cause damage to national security, that notification, notice, or posting shall be delayed. Source: 16 C.F.R. § 318.4 The vendor, PHR related entity, and third party service provider involved bear the burden of demonstrating that all notifications were made as required, including evidence demonstrating the necessity of any delay. Source: 16 C.F.R. § 318.4
Every notice of a breach of security must be in plain language and include, to the extent possible, a brief description of what happened, including the dates of the breach and its discovery, and the identity of any third parties that acquired the information, followed by the types of information involved, steps individuals should take, and what the entity is doing in response. Source: 16 C.F.R. § 318.6 Each notice must give individuals contact procedures that include two or more of the following: toll-free telephone number, email address, website, within-application, or postal address. Source: 16 C.F.R. § 318.6 Written notice to an individual may be sent by electronic mail only if the individual has specified electronic mail as the primary method of communication, and any such email notice must be Clear and Conspicuous. Source: 16 C.F.R. § 318.5
A third party service provider that discovers a breach of security must notify an official designated in a written contract by the vendor of personal health records or PHR related entity, or a senior official if none is designated, and obtain acknowledgment that the notice was received. Source: 16 C.F.R. § 318.3 Vendors of personal health records and PHR related entities must notify third party service providers of their status as vendors of personal health records or PHR related entities subject to the regulation. Source: 16 C.F.R. § 318.3
A personal health record is an electronic record of PHR identifiable health information on an individual that has the technical capacity to draw information from multiple sources and that is managed, shared, and controlled by or primarily for the individual. Source: 16 C.F.R. § 318.2

For the sake of space, this page lists only the primary rules related to this term that most businesses should follow. More may apply to your situation, and your unique facts affect how they apply.

Send us a message through our online form to talk through yours.

Send a message

Response within 24 hours

Why these rules exist

The Rule exists because HIPAA left a gap. The HITECH Act sought to fill the gaps HIPAA left, and it directed the Commission to issue a rule requiring entities not covered by HIPAA to provide notification of any breach of unsecured health records. Source: Joint Statement of Chair Lina M. Khan, Commissioner Rebecca Kelly Slaughter, and Commissioner Alvaro M. Bedoya, Health Breach Notification Final Rule, Commission File No. P205405 (Apr. 26, 2024) The FTC has pointed out that many web-based businesses that collect people’s health information are not covered by HIPAA. Source: Fed. Trade Comm’n, Complying with the FTC’s Health Breach Notification Rule The practical harm of silence is that users cannot protect themselves. As the Premom complaint alleged, a failure to notify deprives users of notice and an opportunity to mitigate the unauthorized disclosures. Source: Complaint for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Easy Healthcare Corporation, Case No. 1:23-cv-03107

The Commission updated the Rule in April 2024. Its three-member majority said the update ensures the Rule’s protections keep pace with the rapid proliferation of digital health records. Source: Joint Statement of Chair Lina M. Khan, Commissioner Rebecca Kelly Slaughter, and Commissioner Alvaro M. Bedoya, Health Breach Notification Final Rule, Commission File No. P205405 (Apr. 26, 2024) Commissioner Holyoak, joined by Commissioner Ferguson, dissented, arguing that the final rule exceeds the Commission’s statutory authority and puts companies at risk of perpetual non-compliance. Source: Statement of Commissioner Melissa Holyoak, Joined by Commissioner Andrew Ferguson, Health Breach Notification Rule, File No. P205405 (Apr. 26, 2024)

Enforcement examples

United States v. GoodRx Holdings, Inc. (prescription discount coupons and telehealth)

United States v. GoodRx Holdings, Inc., Complaint for Permanent Injunction, Civil Penalties, and Other Relief, Case No. 23-cv-460 (Feb. 1, 2023); GoodRx Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief

The complaint alleged that GoodRx integrated third-party tracking tools from Facebook, Google, Criteo, and others into its websites and mobile app. Source: United States v. GoodRx Holdings, Inc., Complaint for Permanent Injunction, Civil Penalties, and Other Relief, Case No. 23-cv-460 Rather than giving its Custom Events anonymous names, GoodRx allegedly chose descriptive titles such as “Drug Name” and “Drug Category” that tracked and shared the prescription medication name and health condition associated with each coupon a user accessed. Source: United States v. GoodRx Holdings, Inc., Complaint for Permanent Injunction, Civil Penalties, and Other Relief, Case No. 23-cv-460 To show that GoodRx was a vendor of personal health records, the complaint pleaded that its website and apps were capable of drawing information from multiple sources, including user inputs, pharmacy benefit managers, pharmacies, and healthcare professionals. Source: United States v. GoodRx Holdings, Inc., Complaint for Permanent Injunction, Civil Penalties, and Other Relief, Case No. 23-cv-460, Count VIII The complaint then alleged that, from at least 2017 through at least February 2020, the disclosures to Facebook and Google were breaches of security of more than 500 consumers’ unsecured PHR identifiable health information, and that GoodRx gave none of the required notices to individuals, the FTC, or the media. Source: United States v. GoodRx Holdings, Inc., Complaint for Permanent Injunction, Civil Penalties, and Other Relief, Case No. 23-cv-460, Count VIII

Outcome. GoodRx was the first time the FTC took enforcement action under the Health Breach Notification Rule. Source: Fed. Trade Comm’n, GoodRx Holdings, Inc., Case Summary The matter settled by stipulated order, and GoodRx neither admitted nor denied the allegations except as the order specifically stated. Source: GoodRx Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Findings The order permanently enjoined GoodRx from disclosing Health Information to Third Parties for Advertising Purposes, and it imposed breach notification duties, including notice to the FTC no later than ten business days after discovery of a breach affecting 500 or more individuals. Source: GoodRx Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Order §§ I, IV Commissioner Wilson’s concurrence referred to a $1.5 million civil penalty in the settlement. Source: Concurring Statement of Commissioner Christine S. Wilson, GoodRx, Matter No. 2023090 (Feb. 1, 2023)

United States v. Easy Healthcare Corporation (Premom ovulation tracking app)

Easy Healthcare Corporation, Complaint for Permanent Injunction, Civil Penalty Judgment, and Other Relief; Statement of Reasons for Settlement, Case No. 1:23-cv-03107 (filed May 17, 2023)

Easy Healthcare’s Premom app let users log information about their periods and fertility and upload pictures of ovulation test strips, and it was designed to let users import health data from other devices or apps. Source: Complaint for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Easy Healthcare Corporation, Case No. 1:23-cv-03107 The complaint alleged Premom was a personal health record because it also collected health information from Bluetooth thermometers and third-party apps, such as temperature data a user imported from Apple Health. Source: Complaint for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Easy Healthcare Corporation, Case No. 1:23-cv-03107, Defendant Violated the Health Breach Notification Rule The complaint further alleged that since 2018 Easy Healthcare shared users’ identifiable health information with Google and AppsFlyer contrary to its promises to users, which it characterized as a breach of unsecured health information requiring notice under the Rule. Source: Complaint for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Easy Healthcare Corporation, Case No. 1:23-cv-03107 The data was allegedly unsecured because it was sent as Custom App Event titles in plain text, without encryption or other means to make it unreadable to unauthorized individuals. Source: Complaint for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Easy Healthcare Corporation, Case No. 1:23-cv-03107, Defendant Violated the Health Breach Notification Rule According to the complaint, Easy Healthcare gave no notice to individuals, to the FTC, or to media outlets. Source: Complaint for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Easy Healthcare Corporation, Case No. 1:23-cv-03107, Count VIII

Outcome. The settlement imposed a $100,000 civil penalty judgment and injunctive relief. Source: Statement of Reasons for Settlement, Easy Healthcare Corporation, Case No. 1:23-cv-03107 (filed May 17, 2023) That relief enjoined further violations of the FTC Act and the HBNR, banned the sharing of certain types of information, and required a comprehensive privacy and information security compliance program with assessments. Source: Statement of Reasons for Settlement, Easy Healthcare Corporation, Case No. 1:23-cv-03107 (filed May 17, 2023) The stipulated order also required Easy Healthcare to identify every third party that received covered users’ information, give each a copy of the complaint and order, and instruct certain recipients to delete what they received. Source: Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Easy Healthcare Corporation, § VI

Exposure

A violation of the Health Breach Notification Rule is treated as a violation of a rule promulgated under section 18 of the FTC Act regarding unfair or deceptive acts or practices, and is thus subject to civil penalties as adjusted for inflation. The Commission enforces it with the same powers it has under the FTC Act. Source: 16 C.F.R. § 318.7 The ceiling moves with inflation. FTC business guidance edited in January 2021 said a business may face a civil penalty of up to $43,792 per violation, and the 2023 Premom complaint pleaded a maximum of $46,517 for each knowing violation. Source: Fed. Trade Comm’n, Complying with the FTC’s Health Breach Notification Rule, Answers to Questions About the Health Breach Notification Rule (edited Jan. 2021)

The settled matters show what the relief looks like in practice. Easy Healthcare’s settlement carried a $100,000 civil penalty judgment plus injunctive relief and a compliance program requirement. Source: Statement of Reasons for Settlement, Easy Healthcare Corporation, Case No. 1:23-cv-03107 (filed May 17, 2023) GoodRx’s order permanently barred it from disclosing Health Information to Third Parties for Advertising Purposes, a restriction that reaches the company’s business model and not just its notice practices. Source: GoodRx Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Order §§ I, IV One commissioner said she would have supported a larger civil penalty in GoodRx, observing that consumers place significant value on their personal health information. Source: Concurring Statement of Commissioner Christine S. Wilson, GoodRx, Matter No. 2023090 (Feb. 1, 2023)

Uncertainty about coverage is its own risk. In dissent from the 2024 amendments, Commissioner Holyoak argued that because vendors must notify service providers of their status, a company that misjudges whether it is covered runs the risk of being in perpetual violation of the Final Rule and perpetually at the mercy of the Commission’s enforcement discretion. Source: Statement of Commissioner Melissa Holyoak, Joined by Commissioner Andrew Ferguson, Health Breach Notification Rule, File No. P205405 (Apr. 26, 2024)

FAQs

1.16 CFR 318.3. 16 C.F.R. § 318.3
2.16 CFR 318.1. 16 C.F.R. § 318.1
3.16 CFR 318.2. 16 C.F.R. § 318.2