FTC Rescinds 2021 Health-App Breach Notification Policy Statement
United States
Sep 9, 20261 sources
Key Takeaways
- 01The FTC rescinded its 2021 policy statement on health-app and connected-device breach notifications on September 9, 2026.
- 02The agency said its 2024 update to the Health Breach Notification Rule made the earlier policy statement unnecessary.
- 03Health-app and connected-device providers should rely on the updated rule when evaluating breach-notification requirements.
The Federal Trade Commission rescinded its 2021 policy statement on breach notifications by health apps and connected devices on September 9, 2026.
The FTC said the statement is now unnecessary because it updated the Health Breach Notification Rule in 2024. That rule governs notification duties following certain breaches involving identifiable health information held by entities not covered by the Health Insurance Portability and Accountability Act (HIPAA).
Companies offering health apps, wearables, and connected devices should look to the 2024 Health Breach Notification Rule rather than the withdrawn 2021 policy statement when assessing breach-notification obligations.
Sources (1)
ftc.gov — Sep 9, 2026