FTC Health Breach Notification Rule — 2024 amendments
Enacted in force
Fields requiring verification
- enforcement date: Unverified — No distinct enforcement-start date was established. Primary source
- penalty amount: Unverified — Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description. Primary source
In plain English
- Foreign and domestic vendors of personal health records, PHR-related entities and third-party service providers maintaining information of U.S. citizens or residents. Primary source
- Excludes HIPAA-covered entities and other entities to the extent they act as a HIPAA business associate; coverage is not limited by FTC Act jurisdictional tests. Primary source
- Assess unauthorized acquisition or disclosure of unsecured PHR-identifiable health information as a potential breach, including unauthorized access unless rebutted with reliable evidence. Primary source
- Notify affected individuals, the FTC and qualifying media under the rule; third-party service providers notify the PHR vendor or related entity. Primary source
- Follow the amended timing, content and delivery requirements and retain evidence supporting compliance and any delay. Primary source
Dates and phased obligations
Legal effective date: 2024-07-29; principal compliance date: 2024-07-29. Primary source
This row is the distinct 2024 final amendment to the existing HBNR, not a claim that the underlying HBNR began in 2024. The amended text, including scope, was directly read. FTC notice for breaches involving at least 500 individuals is contemporaneous with required individual notice; the obsolete ten-business-day rule is not represented. Source and qualifications
Questions from this record
Who does 16 CFR 318; 89 FR 47028 cover?
Foreign and domestic vendors of personal health records, PHR-related entities and third-party service providers maintaining information of U.S. citizens or residents. Excludes HIPAA-covered entities and other entities to the extent they act as a HIPAA business associate; coverage is not limited by FTC Act jurisdictional tests. Primary source
What is the law’s status?
Enacted / in force Primary source
What date does this record track?
Legal effective date: 2024-07-29; principal compliance date: 2024-07-29. Primary source
Has this record been verified?
This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source
- FTC final rule, 89 FR 47028DATES; 16 CFR 318.1–318.7
Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.