FTC Health Breach Rule for Wearable Makers

Concept render

The FTC Health Breach Notification Rule can apply to health apps and similar technologies that HIPAA does not cover. The FTC describes a breach of security as an unauthorized acquisition of identifiable health information, so an unauthorized disclosure to an outside vendor may count. Notices are due without unreasonable delay and within 60 calendar days of discovery.

Many wearable teams assume that if HIPAA does not apply, breach duties do not exist. The FTC has said otherwise about its own rule: the revised definitions apply to health apps and similar technologies not covered by HIPAA. For a wearable with a companion app and a cloud LLM, the practical question is which data leaves the app, where it goes and whether the user authorized that recipient.

Read this first. This is an engineering team’s summary and does not constitute legal advice. We cannot say whether any particular product is a personal health record or a related entity. That needs counsel. This is also an engineering write-up for general wellness products and is not a guide to medical devices. Quotes below come from the sources linked in each row, as of October 31, 2026.

What does the rule text and the FTC say?

The table lists only what we checked in the sources linked in each row. Section 318.2 and 318.4 text on the Cornell Legal Information Institute site is a secondary mirror. Confirm the current text on eCFR before you rely on it.

We did not open the FTC pages for other enforcement actions, so this page does not describe them.

Which data flows should you inventory?

The first step is a list of every field the app sends to a cloud LLM, an analytics SDK or any other vendor. For each row, record two tags. The first tag is whether the field is identifiable health information. The second is whether the user’s consent covers that recipient. Both tags are decisions for counsel, so the sample table leaves them open. The rows are examples you replace with your own.

How do you walk through the decision?

This sequence is our own working outline built from the sources above. It is a way to organize questions for counsel and gives no answer on its own.

1. Is the product a personal health record or a related entity? Start with the 318.2 description: an electronic record that can draw information from multiple sources and is managed by or primarily for the individual (source). A wearable that pulls from sensors and a phone is a reason to ask, and counsel gives the answer.
2. Did a breach of security happen? The FTC describes it as an unauthorized acquisition of identifiable health information and says the amended rule covers unauthorized disclosure (source). Use the inventory: any row where the recipient was outside the user’s authorization goes to counsel.
3. What is the notice clock? Notices to individuals and media are due without unreasonable delay and in no case later than 60 calendar days after discovery (source). If 500 or more people are involved, the FTC is notified at the same time as individuals (source).

Deadline calculator

Formula: outer deadline = discovery date + 60 calendar days. Variables: discovery date is the day your company discovered the breach, and the result is a calendar date. Weekends and holidays count because the rule says calendar days.

• Day 0: discovery. Write down the discovery date and the evidence for it the same day.
• Day 60: the latest date. Section 318.4(a) also says notices must go out without unreasonable delay, so day 60 is the outer limit and earlier is expected.
• People affected: if the count is 500 or more, add an FTC notice at the same time as the individual notices. Check the rule text with counsel for the media notice conditions, because this page does not state them.

Recheck: a discovery on day 0 gives day 60 as the last day. Replace day numbers with real dates in your own incident plan.

What breaks first?

These items are engineering reasoning from the sources above. They are not accounts of any company’s incident, and we have no measured results to report.

• Treating HIPAA as the only test. The FTC says the revised definitions apply to health apps not covered by HIPAA, so a “HIPAA does not apply” note in your wiki does not close the question.
• Counting only hacks. The FTC describes the amended rule as covering unauthorized disclosure. A vendor integration that sends fields the user never agreed to share is the flow to find.
• Forgetting the vendors you added later. The enforcement example involved health data shared with advertisers. A new analytics SDK or a new LLM provider adds a recipient to your inventory.
• No start date for the clock. The deadline counts from discovery. If nobody records when the team discovered an issue, you cannot compute day 60.
• Consent text that does not name the recipient. The second tag in the inventory asks whether consent covers that recipient. A generic line in a policy is a question for counsel.

What should you test on your own system?

The sources set the rules and your product sets the facts. We have not run these checks on your product and this page reports no results. The pass line is yours to set per product requirement, and you should record the basis for it.

What should you ask before you decide?

Take this list to counsel, your backend team or any team building the integration for you, including us.

• Which fields leave the device and the app, and where does each one go?
• Has counsel looked at the inventory and given a view on whether the product is a personal health record or a related entity?
• Does the consent text name each category of recipient, including the LLM provider?
• Who owns the vendor accounts and the keys, and are they in your company’s name?
• Who decides that an unauthorized disclosure happened, and how is the discovery date recorded?
• Who sends the notices, and is the draft template reviewed by counsel in advance?
• What changes in the product when you add a new vendor or a new field?

Planning a wearable with an app and a cloud LLM and want the data-flow inventory built with your real architecture? Tell us about your device. For the product side, see health wearable development.

Primary sources

All pages below were accessed on 2026-10-31. Rules and guidance change, so confirm the text on the live pages and with counsel.

• FTC, Finalizes Changes to the Health Breach Notification Rule (ftc.gov, April 2024 press release), accessed 2026-10-31.
• 16 CFR 318.2, Definitions (law.cornell.edu, secondary mirror), accessed 2026-10-31.
• 16 CFR 318.4, Timeliness of notification (law.cornell.edu, secondary mirror), accessed 2026-10-31.
• FTC, Enforcement action against GoodRx (ftc.gov, February 2023 press release), accessed 2026-10-31.