Tracker record · Federal · Final rule
FTC Health Breach Notification Rule amendments
The FTC's Health Breach Notification Rule as amended, extending breach notification duties to vendors of personal health records and related entities outside HIPAA's reach, with clarification of covered entities, breach triggers, and notice duties.
Status
- Legal status
- In effect (Amendments adopted April 26, 2024, effective July 29, 2024; 2021 policy statement withdrawn September 9, 2026)
- Allegation or finding
- Operative law
- Applicability
- Vendors of personal health records and related entities
- Enforceability
- Binding on parties within scope
- Law checked through
- October 12, 2026
- Primary-source pinpoint
- 16 C.F.R. part 318
- Citation
- 16 C.F.R. part 318
- Source
- 16 C.F.R. part 318
Related guides
- Health Apps, Wearables, and Consumer Health Data
- Federal and Multistate Breach Duties
- Texas Breach Notification