Privacy & Cybersecurity Law Blog

On September 9, 2026, the Federal Trade Commission (the “FTC”) rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The Statement had clarified the FTC’s interpretation of the Health Breach Notification Rule, including that the Rule could apply to certain health apps and connected devices not covered by HIPAA that collect information from multiple sources, and that a “breach of security” could include not just cybersecurity incidents but also unauthorized disclosures to third parties.

The FTC has now concluded that the Statement is obsolete because its 2024 amendments to the Rule expressly addressed health apps, connected devices, and unauthorized disclosures, and that the rescission is consistent with its policy of avoiding unnecessary subregulatory guidance.