Free tools Windows power users keep installed
One-click scans. No signup required.
Not being covered by HIPAA does not automatically put a U.S. health app outside federal breach-notification rules. The Federal Trade Commission’s Health Breach Notification Rule (HBNR), 16 CFR Part 318, can apply to certain personal health record (PHR) vendors, PHR-related entities, and their service providers. Amendments that took effect July 29, 2024, clarified how the rule applies to many health apps and similar technologies.
For developers and operators, the practical questions are whether the product meets the rule’s definitions, whether an incident involved unsecured PHR identifiable health information, and who must be notified—and when.
As an Amazon Associate I earn from qualifying purchases.
Start with the product’s role and data flows
The HBNR is a U.S. federal rule for defined businesses and information, not a general rule covering every app that touches health data. The FTC identifies three relevant roles: vendors of personal health records, PHR-related entities, and third-party service providers to a vendor or related entity. The FTC’s business guidance explains that the rule does not apply to businesses or organizations covered by HIPAA; HIPAA-covered entities instead follow HHS’s Breach Notification Rule. The frameworks are distinct, and an app’s status cannot be settled simply by calling it a consumer app or by asking whether the app operator itself is a health-care provider.
For a PHR, the definition turns in part on technical capacity: the electronic record must be able to draw identifiable health information from multiple sources, and it must be managed, shared, and controlled by or primarily for the individual. The FTC gives the example of information entered by a user combined with data from a connected fitness tracker. The app’s architecture, integrations, data flows, and the role each company plays matter; examine how the product works, not just its marketing description.
#1 Best Overall
- Chronic Illness Essential Gift: This A4 200-page medical records organizer is a perfect chronic illness gift. It serves as a comprehensive medical journal, ensuring you never miss vital information. Ideal for organizing health details with ease and efficiency.
- Blood Pressure Chart for Seniors: Our medical journal features detailed blood pressure charts for seniors, facilitating easy tracking of vital signs. This health journal for women and men is a crucial tool for managing blood pressure and maintaining health records.
- Comprehensive Medical Planner: The medical planner offers a structured approach to managing chronic illness. This blood pressure log book for daily tracking includes a blood pressure guide chart, making it a reliable chronic illness journal and vital signs log book.
- Medical Notebook for Patients: Designed as a medical notebook for patients, this organizer is perfect for maintaining detailed medical records. It serves as a blood pressure log, chronic illness journal, and health planner, ensuring all essential health data is recorded.
- Versatile Medical Log Book: This medical log book for daily tracking is ideal for organizing health information. As a medical records organizer, it includes a blood pressure log book, vital signs log book, and a planner for chronic illness management.
The FTC says most health apps not covered by HIPAA may be subject to the HBNR when the rule’s conditions apply. That is not a claim that every non-HIPAA app is covered, nor that every vendor or service provider has the same duties. The FTC’s Mobile Health App Interactive Tool offers preliminary screening questions: Does the organization operate a technology that holds consumers’ health information? Does it provide products or services to, or exchange data with, such a product? Does it handle health information while serving a company that offers one? The FTC says using the tool is not required and it cannot guarantee compliance.
Assess whether an incident is a breach
A breach analysis should not stop at asking whether an outsider hacked a server. The 2024 amendment clarifies that unauthorized acquisition of unsecured PHR identifiable health information can result from either a data-security breach or an unauthorized disclosure. As the FTC’s April 30, 2024 explainer quotes the final rule: “A breach of security includes an unauthorized acquisition of unsecured PHR identifiable health information in a personal health record that occurs as a result of a data breach or an unauthorized disclosure.” See the FTC’s explanation of the amended rule.
This means a disclosure to an outside advertising or analytics platform may raise HBNR questions, even without an intrusion. It does not mean every transfer or disclosure is automatically a reportable breach. Apply the rule’s definitions to the information involved, whether it was unsecured, what occurred, and the relevant entities’ roles. Preserve a factual timeline and involve privacy and legal teams promptly rather than assuming the incident is outside the rule because it was not a conventional cyberattack.
Know who receives notice and the deadlines
For affected individuals, notice must be provided without unreasonable delay and no later than 60 calendar days after discovery. Under FTC guidance, discovery occurs when someone in the company knows or reasonably should know about the breach. The 60-day period is an outside limit, not permission to wait if notice can reasonably be sent sooner.
| Recipient | When notice is required |
|---|---|
| Affected U.S. individuals | Without unreasonable delay, no later than 60 calendar days after discovery. |
| FTC, when 500 or more people are affected | At the same time individual notices are sent, without unreasonable delay and within 60 calendar days after discovery. |
| FTC, when fewer than 500 people are affected | Within 60 calendar days after the end of the calendar year in which the breach occurred. FTC guidance says these smaller breaches may be reported annually. |
| Prominent media serving a state or jurisdiction | If 500 or more residents of that state or jurisdiction are affected, notify prominent media serving it without unreasonable delay and within 60 calendar days after discovery. This is in addition to individual notice. |
| Client of a third-party service provider | The provider must notify the contract-designated official—or a senior official if none is designated—without unreasonable delay and within 60 calendar days after discovery. It must identify affected customers and obtain acknowledgment. |
These thresholds and timing rules are described in the FTC business guidance and the final rule. Track the individual, aggregate, and state-level counts separately: 500 affected people triggers a different FTC reporting schedule, while the media threshold concerns 500 or more residents of a particular state or jurisdiction.
Make notices usable as well as complete
The HBNR requires clear, conspicuous, reasonably understandable notices. FTC guidance recommends short sentences, plain-language headings, bullets, readable type, and adequate spacing; avoid unnecessary legal or technical terms, multiple negatives, and vague descriptions. A notice should explain what happened, the known breach and discovery dates, the types of unsecured health information involved, and the identity of acquiring third parties when known, along with other information prescribed by the rule. Consult the FTC’s complete notice guidance for the required content.
Plan delivery methods before an incident. If email is the default, consumers must have a clear and conspicuous opportunity to choose first-class mail instead. Email notice also requires a supplementary channel, such as text message, an in-app message, or a banner on the website or app. If reasonable efforts cannot reach at least 10 people because contact information is insufficient or outdated, FTC guidance describes substitute notice options, including a prominent 90-day website posting or notice through major local print or broadcast media, with a toll-free number active for at least 90 days.
For third-party service providers, incident-response plans should reflect the contract’s notification contact and escalation path. If no contact is designated, the rule points to a senior official at the client. A vendor that waits to resolve every detail before alerting its client risks undermining the client’s ability to meet its own notification duties.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use the FTC tool as a screen, not a legal conclusion
The interactive tool can help a team identify questions to investigate, but it cannot replace a review of the product’s data sources, individual control, entity relationships, HIPAA status, and incident facts. The FTC’s July 2024 guidance states that noncompliance could result in civil penalties of up to $51,744 per violation; that is the figure stated in that 2024 guidance, not a timeless maximum. Check current FTC materials before relying on a penalty amount.
Quick Recap
Best Value
- Achieve Your Health Goals: Empower your wellness journey with this easy-to-use food diary, perfect for tracking daily meals and managing your nutrition and calorie intake. Find motivation and clarity in your diet plans, and celebrate each step towards your health goals.
- Detailed Nutritional Tracking: More than just a calorie tracker, you can monitor calories, carbs, fat, protein and much more. This comprehensive tracking fosters control over your diet, ensuring you’re on track with your nutritional needs. Thick paper pages, a cover page, and a opaque plastic privacy cover.
- Simplify Your Diet Planning: Our food diary is designed for efficiency and simplicity. Track your meals effortlessly, which helps you maintain a consistent and effective diet routine. This food log is your partner in pursuing a healthy lifestyle.
- Stay Inspired and Accountable: Cora Kate's food journals for tracking meals are more than just trackers, they're a daily source of inspiration. Stay accountable to your dietary choices and feel encouraged as you progress towards your personal dietary goals.
- Compact and Convenient: Sized at 5.5 x 8.5 inches with 50 pages, our food diet journal is perfectly portable. Carry it easily in your bag or backpack, ensuring you can log your meals and track your diet and water intake anytime, anywhere.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
