FTC Rescinded 2021 Health App Privacy Guidance
Digital health developers should align compliance efforts with the agency's 2024 rule amendments.
Updated on Oct. 2, 2026 in Healthcare
Live Poll
Do you trust federal agencies to protect your health data through formal rule updates?
On September 9, 2026, the Federal Trade Commission officially rescinded its 2021 policy statement regarding data breaches by health apps. This action removes redundant guidance for developers who must now comply with the agency's formal 2024 amendments to the Health Breach Notification Rule.
Why it matters
The rescission consolidates compliance requirements, ensuring that businesses look to the formal 2024 rule amendments rather than older subregulatory policy statements. This reduction in administrative overlap helps clarify the legal standards for health app data security.
The FTC eliminated one obsolete policy statement following the enactment of its 2024 Health Breach Notification Rule amendments. The agency is moving to consolidate oversight requirements for digital health developers under the finalized rule rather than historical guidance.
The players
Federal Trade Commission
A federal agency that enforces consumer protection laws and prevents anti-competitive business practices through rulemaking and investigation.
The details
The 2021 statement served as interim guidance to clarify that health apps not covered by HIPAA were still subject to the Health Breach Notification Rule, specifically defining unauthorized disclosures to third parties as breaches. By incorporating these definitions into the 2024 rule amendments, the commission rendered the 2021 document redundant. Operators must now ensure their data handling procedures meet the standards established in the 2024 update rather than the rescinded guidance.
Timeline
The FTC issued the original health app policy statement in 2021.
The FTC finalized amendments to the Health Breach Notification Rule in 2024.
The FTC rescinded the 2021 policy statement on September 9, 2026.
Market Landscape
This move marks the end of a transition period that began with the 2024 Health Breach Notification Rule amendments. It aligns with a broader agency effort to prioritize formal rulemaking over subregulatory guidance to improve regulatory certainty for the digital health sector.
Business operators in the digital health space should review their data security protocols against the 2024 Health Breach Notification Rule rather than relying on previous guidance. Consult with qualified legal counsel to ensure that current disclosure policies meet the updated federal requirements.
The takeaway
The rescission highlights the importance of anchoring compliance practices to formal rules rather than temporary policy statements. Ensure your technical team and legal counsel have reviewed the 2024 Health Breach Notification Rule to confirm your app's breach disclosure definitions remain accurate.
Further reading
For more information on the evolving regulatory requirements for digital tools, see our section on Healthcare.
Source note: This article includes information reported by The National Law Review - A Free To Use Nationwide Database of Legal Publications.
Live Poll
Do you trust federal agencies to protect your health data through formal rule updates?
