United StatesFTC Health Breach Notification Rule
Also known as Health Breach Notification Rule.
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice
- Audit expectation
- none
As of .
What it requires
- If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
- A breach of security is treated as discovered on the first day on which it is known, or reasonably should have been known, to you; the knowledge of any employee, officer or other agent, other than the person committing the breach, counts as yours.
- Send the individual notice in writing to the individual's last known address: by electronic mail (email combined with a text message, within-application message or electronic banner, written clearly and conspicuously) if the individual has specified electronic mail as the primary method of communication, and otherwise by first-class mail; if the individual is deceased, send it to the next of kin if the individual gave contact information and authorization to contact them.
- If, after reasonable efforts, contact information for ten or more individuals is insufficient or out of date, give substitute notice reasonably calculated to reach them, by a conspicuous posting for 90 days on the home page of your website or in major print or broadcast media (including media where the affected individuals likely reside), with a toll-free number that stays active for at least 90 days where an individual can learn whether their information may have been included; where you judge a case urgent because of possible imminent misuse, you may also notify by telephone or other means.
- Notify the Federal Trade Commission as its website instructs: at the same time as the individual notices for a breach affecting 500 or more individuals; for a breach affecting fewer than 500 individuals you may keep a log and submit it no later than 60 calendar days after the end of the calendar year.
- Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
- Say in each notice, in plain language, what happened (the dates of the breach and of its discovery, and the third parties that acquired the information if known), the types of information involved, the steps individuals should take, what you are doing to investigate and mitigate, and how to reach you through two or more of a toll-free telephone number, email address, website, within-application contact or postal address.
- If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
- If you are a vendor of personal health records or a PHR related entity, tell each third party service provider that you are a vendor or PHR related entity subject to this rule; a third party service provider that accesses unsecured PHR identifiable health information in providing services does not thereby become a PHR related entity.
- Delay a notice, notification or posting when a law enforcement official determines that it would impede a criminal investigation or cause damage to national security, because the rule says it shall be delayed, and keep the evidence that every notice was made as required, because the burden of demonstrating it rests on you.
- Health Insurance Portability and Accountability Act (HIPAA)-covered entities, and any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity, are outside this rule.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
16 CFR 1.98(d) states $53,088 as the maximum civil penalty under section 5(m)(1)(A) of the Federal Trade Commission Act for penalties assessed after . Section 5(m)(1)(A) sets the penalty for each violation and reaches a violation committed with actual knowledge or knowledge fairly implied on the basis of objective circumstances that the act is unfair or deceptive and prohibited by the rule. Each day of continuance of a violation through continuing failure to comply with a rule is treated as a separate violation (section 5(m)(1)(C)).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 53,088
Who enforces it
Enforcement body
Federal Trade Commission, which enforces Part 318 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as are available to it under the Federal Trade Commission Act (16 CFR 318.7).
What this law does
The Health Breach Notification Rule applies to foreign and domestic vendors of personal health records, PHR related entities and third party service providers that maintain information of United States citizens or residents, and it does not apply to Health Insurance Portability and Accountability Act (HIPAA)-covered entities or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity.
A vendor of personal health records and a PHR related entity must notify each affected individual and the Federal Trade Commission after discovering a breach of security of unsecured PHR identifiable health information, and must also notify prominent media outlets serving a State or jurisdiction when the information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
A third party service provider that discovers a breach of security must notify an official designated in a written contract by the vendor of personal health records or PHR related entity it serves, or a senior official of that vendor or entity if none is designated, and must obtain acknowledgment that the official received the notice.
Except where a law enforcement official's determination delays a notice, notices to individuals and the media, and the notice a third party service provider gives the vendor or entity it serves, must be sent without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security. The amendments to the rule are effective .
The rule defines health care services or supplies to include any online service such as a website, mobile application or internet-connected device that provides mechanisms to track diseases, health conditions, fitness, sleep, diet or other listed health matters, or that provides other health-related services or tools.
A person that violates a rule under the Federal Trade Commission Act respecting unfair or deceptive acts or practices with actual knowledge, or knowledge fairly implied on the basis of objective circumstances, that the act is unfair or deceptive and prohibited by the rule is liable for a civil penalty, written in the statute as not more than $10,000 for each violation.
The Commission's maximum civil penalty under section 5(m)(1)(A) of the Federal Trade Commission Act is $53,088 for penalties assessed after . The Commission's civil penalty amounts remain unchanged during 2026.
Written notice to an individual may be sent by electronic mail if the individual has specified electronic mail as the primary method of communication, and otherwise a vendor of personal health records or PHR related entity may provide notice by first-class mail at the last known address of the individual. Each day of continuance of a violation through continuing failure to comply with a rule is treated as a separate violation.
A breach of security is treated as discovered on the first day on which it is known or reasonably should have been known to the vendor, PHR related entity or third party service provider, and the knowledge of an employee, officer or other agent counts.
When LexLint raises it
When your app profile says your app handles health records.