The FTC Rescinded a Health-App Breach Memo — Not Your Breach Duties

Foundations & Philosophy · September 22, 2026

On September 9, 2026, the Commission withdrew a 2021 policy statement as obsolete. The Health Breach Notification Rule — updated in 2024 — still covers health apps and connected devices like fitness trackers.

James Venuto · Security Medic Consulting, LLC - AI Cyber Security and Privacy · 8 min read

When a regulator “withdraws guidance,” the LinkedIn hot take writes itself: breach notice is dead; health apps are free. That is not what the Federal Trade Commission did on September 9, 2026.

The FTC rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. In the Commission’s own words, that statement had purported to apply the Health Breach Notification Rule (HBNR) to health apps and connected devices that collect consumer health information. In 2024, the Commission updated the Health Breach Notification Rule to cover health apps and connected devices like fitness trackers — rendering the policy statement unnecessary.

Withdrawal of obsolete subregulatory guidance is housekeeping. It is not a hall pass. If you sell, white-label, or heavily rely on a wellness app, symptom checker, connected device, or non-HIPAA health experience for customers, you still need a clear answer to: are we an HBNR vendor, a HIPAA entity, both, or neither — and who owns the notification playbook?

What Changed (and What Did Not)

Changed: The 2021 policy statement is gone as a standalone guidance document.

Not changed: The Commission’s stated reason is that the rule itself was updated in 2024 to cover the same class of products. Duties live in the rule, not in the memo that previewed them.

The press release also ties the cleanup to a broader deregulatory direction to eliminate obsolete guidance that adds complexity without benefit. That is policy context. It does not rewrite the 2024 HBNR text for you.

Why SMBs Should Care This Month

• Many “health-ish” products sit outside classic HIPAA. Employer wellness portals, dental patient apps that are not covered-entity systems, fitness/recovery wearables sold at the front desk, and marketing partners that ingest symptom data.
• Customers still expect honesty after a breach. Even when HIPAA does not apply, unfair or deceptive silence is an FTC theory you do not want to test.
• Cyber insurance and vendor questionnaires ask about health data. “We saw a headline that the FTC withdrew something” is a weak underwriting answer.

A Practical Sorting Exercise

1. Inventory health-adjacent data flows — apps, portals, wearables, chatbots, and marketing pixels that see symptoms, diagnoses, meds, or biometric proxies.
2. Classify each flow: HIPAA covered entity / business associate; HBNR vendor; state consumer health law; or ordinary commercial data with heightened sensitivity.
3. Name the notification owner for each class — counsel + ops + the vendor’s breach contact — and put the runbook next to your incident response plan.
4. Update public privacy notices so they match what you actually collect and share. Stale “we don’t sell health data” language is how enforcement stories start.
5. Ask vendors in writing whether they treat themselves as HBNR-covered and how they will notify you if customer health data is breached or improperly disclosed.

This week’s action: Open one spreadsheet. List every product touching health or wellness data. Mark HIPAA / HBNR / other. If any row says “not sure,” that is your homework before the next incident — not after.

Soft Next Step

If you want help mapping health-adjacent products to the right notice duties — without scaring your marketing team into paralysis — Privacy Medic / Security Medic can walk the inventory with you.

References

1. FTC, “FTC Withdraws Obsolete Policy Statement” (Sep 9, 2026): ftc.gov/…/ftc-withdraws-obsolete-policy-statement
2. FTC Health Breach Notification Rule overview (for current rule text and compliance materials): ftc.gov/…/health-breach-notification-rule