FTC Rescinds 2021 Health App Breach Policy: How the 2024 Rule Update Made It Obsolete

Privacy advocates argue that the Federal Trade Commission’s decision to rescind its 2021 health app breach policy signals a dangerous retreat on consumer data protection, leaving sensitive medical information vulnerable to exposure. Conversely, the FTC and compliance experts maintain that the withdrawal simply cleans up the regulatory books, arguing that the 2021 guidance was rendered entirely redundant when the agency formally codified those exact protections into federal law in 2024.[1][2][5]

The policy in question, passed in a divided 3-2 vote during the Biden administration, extended the federal Health Breach Notification Rule (HBNR) to cover health and fitness apps. It mandated that developers of fertility trackers, diet apps, and connected devices notify users if their personal health records were exposed in a breach or shared without authorization. At the time, the FTC warned that violators would face daily fines of $43,792 per violation.[2][3]

However, the landscape shifted in April 2024 when the FTC finalized comprehensive amendments to the HBNR itself. The updated rule explicitly broadened the definition of "health information" to include data collected through apps and connected devices, and clarified that unauthorized sharing with third parties constitutes a "breach of security." Because the 2024 rulemaking formally integrated these requirements into the binding federal code, the 2021 subregulatory guidance was left obsolete.[3][4]

In a statement posted on September 1, 2026, the FTC announced the unanimous withdrawal of the 2021 policy. The commission stated it "has determined that the statement – contentious at the time of issuance – provided minimal benefit and has been superseded by rulemaking." The agency further noted that "parties understand that guidance generally creates neither substantive rights nor binding obligations."[1][2]

The rescission also aligns with a broader deregulatory directive from the White House. President Donald J. Trump recently issued an executive order directing federal agencies to eliminate obsolete guidance documents and policy statements, arguing they contribute to an "ever-expanding morass of complicated Federal regulation" without providing tangible benefits to consumers.[1][2]

Despite the withdrawal of the 2021 guidance, legal experts emphasize that health tech startups are not operating in a regulatory vacuum. The assumption that non-HIPAA entities are exempt from federal health data privacy laws "is wrong—and it's getting expensive," according to Promise Legal Insights. The 2024 HBNR remains fully in effect and carries strict compliance mandates for any technology that draws health inferences from user data.[3][4]

Under the updated 2024 framework, the notification timeline is rigid. If a health app experiences a breach involving 500 or more individuals, the company must notify the FTC and the affected users "without unreasonable delay" and no later than 60 calendar days after discovering the exposure. The notice must clearly identify any third parties that acquired the unsecured health information and describe the potential harm that may result.[3][4]

Recent enforcement history underscores the financial stakes for developers who mishandle user data. Prior to the 2024 rule update, the FTC leveraged the HBNR to secure major settlements, including a $7.8 million penalty against BetterHelp and a $1.5 million fine against GoodRx in 2023 for unauthorized data sharing. The underlying legal framework that enabled those penalties remains intact, meaning consumers will continue to receive notifications if their digital health records are compromised.[3][4]

The removal of the 2021 policy statement shifts the enforcement mechanism from a temporary memo to a permanent federal rule, but the compliance burden on developers remains identical. Moving forward, the FTC's focus will center entirely on enforcing the 2024 HBNR parameters, testing whether health app operators can meet the 60-day reporting window when their internal data-sharing practices are exposed.[1][3][4]