---
title: "FTC Health Breach Notification Rule: What It Covers"
description: "The FTC Health Breach Notification Rule makes health apps outside HIPAA report breaches within 60 days. Who it covers, the 2024 changes, and Cuvo's process."
canonical: "https://cuvo.co/glossary/ftc-health-breach-notification-rule"
last-updated: "Oct 26, 2026"
---
**Definition:** The FTC Health Breach Notification Rule (16 CFR Part 318) requires vendors of personal health records and related entities that HIPAA does not cover to notify consumers, the FTC and sometimes the media after a breach of identifiable health information.

# What is the FTC Health Breach Notification Rule?

HIPAA's breach rules stop at covered entities and their business associates. The FTC's rule picks up the health apps, websites and connected services beyond that line, which is where a telehealth brand's consumer-facing surfaces often sit. Cuvo Health maintains a documented process for it alongside HIPAA.

Published Oct 26, 2026. Facts reviewed Oct 26, 2026.

The FTC Health Breach Notification Rule, 16 CFR Part 318, requires vendors of personal health records, PHR related entities and their third party service providers to give notice after a breach of security of unsecured identifiable health information. It implements section 13407 of the American Recovery and Reinvestment Act of 2009 and does not apply to HIPAA covered entities or to any business acting as a business associate (318.1). The 2024 amendments, effective July 29, 2024, define the health care services that bring an app or website into scope and state that an unauthorized disclosure is a breach, not only a hack. Alongside HIPAA, Cuvo Health maintains a documented process for the rule, so a brand's consumer-facing surfaces are covered by a breach plan as well.

**At a glance**
- What it is: The FTC's breach notice rule for health apps and records outside HIPAA
- Rule: 16 CFR Part 318, amended effective July 29, 2024 (89 FR 47028)
- Who it covers: Vendors of personal health records, PHR related entities and their third party service providers
- Who it excludes: HIPAA covered entities, and any business acting as a business associate
- Deadline: Without unreasonable delay and within 60 calendar days of discovering the breach
- On Cuvo: A documented Health Breach Notification Rule process alongside the HIPAA program

**Who gets notified after a breach under 16 CFR Part 318**

| Recipient | When | Section |
| --- | --- | --- |
| **Each affected individual** | Without unreasonable delay, no later than 60 calendar days after discovery | 318.3(a)(1), 318.4(a) |
| **The FTC, 500 or more people** | At the same time as the notice to individuals | 318.4(b) |
| **The FTC, fewer than 500 people** | May be logged and sent within 60 days after the end of the calendar year | 318.4(b) |
| **Prominent media outlets** | When 500 or more residents of one state or jurisdiction are affected, within the same 60 days | 318.3(a)(3), 318.4(a) |
| **The vendor, from its service provider** | A third party service provider notifies the official its contract designates, within the same 60 days | 318.3(b), 318.4(a) |

## 01. Does the rule apply to a telehealth brand?

It can reach the parts of a brand that sit outside HIPAA. As amended in 2024, 318.2 defines health care services or supplies to include any website, mobile app or internet-connected device that tracks diseases, conditions, treatment, medications, symptoms, fitness, sexual health, sleep or diet, among others. A brand's quiz, tracker or patient-facing app can fall inside that definition when the brand is not acting as a business associate. Whether a particular brand offers a personal health record, an electronic record that can draw information from multiple sources and is managed primarily for the individual, is a question for its counsel.

## 02. What counts as a breach under the 2024 amendments?

A breach of security is the acquisition of unsecured identifiable health information without the individual's authorization, and 318.2 now states that it includes an unauthorized acquisition resulting from a data breach or an unauthorized disclosure. Sharing health information with an advertising or analytics platform without the person's authorization can therefore be a breach that triggers notice, even when no system was hacked.

## 03. How is the FTC rule different from HIPAA breach notification?

HIPAA's breach rules, 45 CFR 164.400 to 164.414, bind covered entities and business associates: a covered entity notifies individuals within 60 calendar days of discovery (164.404), and a business associate notifies the covered entity within the same ceiling (164.410). The FTC rule covers businesses outside HIPAA, with its own 60-day ceiling and notice to the FTC. Under 318.7 a violation is treated as a violation of an FTC trade regulation rule, with civil penalties, currently up to $53,088 per violation under 16 CFR 1.98. On Cuvo, the clinical stack runs under the HIPAA program and its business associate agreement, and the documented FTC process covers the rest. This is general information, not legal advice.

**Primary sources**
- [16 CFR Part 318: Health Breach Notification Rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318): eCFR, checked Oct 26, 2026
- [Federal Register: Health Breach Notification Rule, 89 FR 47028](https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule): Published May 30, 2024; effective July 29, 2024
- [16 CFR 1.98: adjusted civil penalty amounts](https://www.ecfr.gov/current/title-16/section-1.98): $53,088 per violation
- [45 CFR 164.404 and 164.410: HIPAA breach notification](https://www.ecfr.gov/current/title-45/section-164.404): The HIPAA 60-day ceilings

## Frequently asked questions

**Q: What is the FTC Health Breach Notification Rule?**

A: It is the FTC rule at 16 CFR Part 318 that requires vendors of personal health records and related entities outside HIPAA to notify affected people, the FTC and in larger breaches the media after a breach of identifiable health information. On Cuvo, a documented process for the rule runs alongside the HIPAA program.

**Q: Does the FTC Health Breach Notification Rule apply to health apps?**

A: It can, when they sit outside HIPAA: the rule reaches vendors of personal health records and related entities, and as amended in 2024 it defines health care services or supplies to include websites, mobile apps and connected devices that track conditions, medications, fitness, sleep or diet. On Cuvo, the brand's consumer-facing surfaces are covered by a documented breach process as well as the clinical stack.

**Q: Health Breach Notification Rule vs HIPAA breach notification**

A: HIPAA's rule binds covered entities and business associates; the FTC rule covers health apps and records outside HIPAA and expressly excludes business associate activity. Both set a 60-day ceiling for notice. On Cuvo, the HIPAA program covers the clinical layer and a documented FTC process covers the rest.

**Q: What changed in the Health Breach Notification Rule in 2024?**

A: The amendments, effective July 29, 2024, define the health apps and websites the rule reaches and state that an unauthorized disclosure counts as a breach; the amended rule also requires the notice to identify any third party that acquired the data, where known. On Cuvo, the documented breach process reflects the rule as amended.

**Q: What are the penalties for violating the Health Breach Notification Rule?**

A: A violation is treated as a violation of an FTC trade regulation rule, so civil penalties apply, currently up to $53,088 per violation under 16 CFR 1.98. Cuvo Health maintains a documented process for the rule alongside HIPAA so the brand has a breach plan for its consumer-facing surfaces.

**Related pages**

- [FTC rules for telehealth subscriptions and health ads](/blog/ftc-rules-for-telehealth-subscriptions-and-health-ads): The FTC's subscription, advertising and health data rules together
- [HIPAA business associate agreements for telehealth brands](/blog/hipaa-business-associate-agreement-telehealth-brand): Where HIPAA's breach rules stop and the FTC's begin
- [Consumer health data (Washington)](/glossary/consumer-health-data): The state-law layer for health data outside HIPAA
- [Protected health information (PHI)](/glossary/protected-health-information): The HIPAA side of the line
- [Cuvo compliance](/compliance): HIPAA and the FTC breach process Cuvo runs
- [Telehealth glossary](/glossary): Every term a telehealth founder meets

Canonical page: https://cuvo.co/glossary/ftc-health-breach-notification-rule