HIPAA Boundaries and the FTC Health Breach Notification Rule

Overview

This series explains why HIPAA not applying is not the end of a health-data analysis. It tests non-HIPAA personal health records under the FTC Health Breach Notification Rule, covering product design, identifiable data, unauthorized disclosure, role-specific duties, timing, and notice content. It then separates those questions from the June 20, 2024 American Hospital Association v. Becerra holding on public-web metadata and HHS authority. The sources support defined, conditional obligations, not omnibus privacy protection or a universal answer for every digital-health fact pattern.

Learning outcomes

A product outside HIPAA can still trigger FTC breach-notification duties if it fits the PHR and breach definitions.
A breach may arise from an unauthorized disclosure or use, not only from hacking.
An actor’s role and purpose help determine whether it notifies consumers or reports to a customer.
The June 20, 2024 AHA district-court opinion rejected a categorical public-page metadata interpretation, not all tracking or HIPAA duties.

Keywords

HIPAAFTCHealth Breach Notification RulePHRIIHIAuthorizationDisclosureNotificationTrackingGuidance

Chapters

HIPAA Gaps: FTC Breach Duties and the AHA Tracking Case

How actor, record, conduct, and remedy set the legal path

17 min · How actor, record, conduct, and remedy set the legal path

17 min

FTC Personal Health Record Test for Non-HIPAA Apps

Implemented integrations and individual control set the boundary

10 min · Implemented integrations and individual control set the boundary

10 min

FTC Health Breach Notification Rule: Breaches Without Hacking

How authorization, purpose, and access determine notice

13 min · How authorization, purpose, and access determine notice

13 min

FTC Health Breach Notification Rule: Who Must Act

How function and purpose assign notice duties

10 min · How function and purpose assign notice duties

10 min

FTC Health Breach Notification Rule: Notice Deadlines and Content

How discovery, thresholds, and plain language shape compliance

10 min · How discovery, thresholds, and plain language shape compliance

10 min

American Hospital Association v. Becerra: HIPAA Tracking Limits

How the IIHI test separates identity from health evidence

11 min · How the IIHI test separates identity from health evidence

11 min

Does HIPAA Apply? A Layered FTC Health-Data Answer

How actor, definition, conduct, and remedy fit together

13 min · How actor, definition, conduct, and remedy fit together

13 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-7 Premium

FAQ

Does HIPAA not applying mean health data is unregulated?

No. A qualifying non-HIPAA personal health record may still trigger FTC breach-notification duties, but that remedy is not omnibus privacy protection.

When can a health app fall under the FTC rule?

A health app may fall under the FTC rule when it maintains an individual electronic record with PHR identifiable health information, implemented multiple-source capacity, and individual-oriented control.

Can sharing health data be a breach without hacking?

Yes. An unauthorized disclosure or use of unsecured PHR identifiable health information can be a breach when the rule’s other conditions are met.

What did American Hospital Association v. Becerra decide about tracking?

The June 20, 2024 opinion rejected HHS’s categorical treatment of an IP address plus a health-page visit as IIHI, while leaving other tracking and guidance questions open.