FTC unanimously rescinds 2021 policy statement that required health apps to notify users after breaches

The FTC unanimously rescinded its September 2021 policy statement that applied the Health Breach Notification Rule to health apps, fitness trackers, and connected devices, removing federal breach-notification expectations for consumer health apps.

The FTC formally rescinded its September 2021 policy statement on breaches by health apps and other connected devices, which had purported to apply the agency's Health Breach Notification Rule to health apps, fitness trackers, and connected devices collecting consumer health information, exposing violators to fines of $43,792 per violation per day. The 2021 statement was adopted in a divided 3-2 vote under then-Chair Lina Khan and cited HIPAA coverage gaps for consumer health applications. The commission said the statement provided minimal benefit, was superseded by its 2024 update to the Health Breach Notification Rule, and that the rescission aligns with the White House deregulatory agenda. The 2026 rescission vote was unanimous and followed the replacement of Democratic commissioners. Experts note that similar regulatory gaps persist for healthcare AI models.

• The FTC unanimously rescinded its September 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices (2026 vote).
• The 2021 statement, adopted in a divided 3-2 vote under then-Chair Lina Khan, extended the FTC's Health Breach Notification Rule to health apps, fitness trackers, and connected devices collecting consumer health data, citing HIPAA coverage…
• Violators under the 2021 statement faced fines of $43,792 per violation per day.
• The commission said the statement provided minimal benefit and was superseded by its 2024 update to the Health Breach Notification Rule, and that rescission aligns with the White House deregulatory agenda.
• The unanimous 2026 vote followed the replacement of Democratic commissioners; experts note similar regulatory gaps persist for healthcare AI models.