← Global Privacy Laws Research Library
16 CFR Part 318
FTC Health Breach Notification Rule
Prepared by Shubhank Suman · Last reviewed
Status not verified beyond supplied text
- Legal character
- Federal regulation
- Region
- North America
What it covers
Breach notifications for unsecured identifiable personal health record information. Covers qualifying foreign and domestic PHR vendors, PHR-related entities and third-party service providers maintaining US citizens’ or residents’ information. Unauthorised disclosures can be breaches, not just hacking.
Why it matters
Provides a distinct notification regime outside HIPAA for services satisfying the PHR and related-entity definitions. Not every health app automatically meets those tests.
Refer to it when
Research an unauthorised acquisition or disclosure involving a qualifying health app, personal health record or connected service.
AI, privacy and cybersecurity relevance
- AI: Moderate
- Privacy: Very High
- Cyber: High
AI
MODERATE RELEVANCE
Health tools using AI can fall within the definitions; unauthorised data disclosures remain relevant.
Privacy
VERY HIGH RELEVANCE
Notice following acquisition or disclosure of identifiable health information.
Cybersecurity
HIGH RELEVANCE
Breach discovery, incident reporting and response.
Applicability
Entities meeting the PHR/vendor/related-entity/service-provider definitions and holding unsecured identifiable PHR health information, with the express HIPAA activity exclusions.
Read first
§§ 318.1-.2 → .3-.4 → .5-.6 → .7-.9.
Provisions / sections covered
§§ 318.1-.2 - Coverage and breach definitions
Excludes HIPAA-covered entities and activities performed as their business associates. A PHR must have technical capacity to draw information from multiple sources. Unauthorised access presumptively involves acquisition unless reliable evidence rebuts it.
§§ 318.3-.4 - Notification and timing
Individual, media and provider notices are without unreasonable delay and within 60 calendar days, subject to law-enforcement delay. FTC notice for 500 or more individuals is contemporaneous with individual notice; smaller breaches can be reported within 60 days of calendar-year end.
§§ 318.5-.6 - Methods and contents
Media threshold is 500 or more residents of a State/jurisdiction, distinct from the FTC threshold. Notice covers incident facts, information, protection/mitigation and contact methods; substitute notice rules apply to inadequate contact information.
§§ 318.7-.9 - Enforcement, applicability and sunset
FTC enforcement and inflation-adjusted civil penalties. Original breach applicability date is 24 September 2009; the conditional sunset clause does not itself establish expiration.
Subject-matter tags
- Data breach
- Controller and processor
- Health data
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.