The FTC's expanded Health Breach Notification Rule: What digital health companies had to know in 2025

For years, the conventional wisdom was simple: if you handle health data, HIPAA covers you, and if you are a consumer health app, you are mostly outside the federal health privacy rules. In 2025, the Federal Trade Commission dismantled that assumption. Its expanded Health Breach Notification Rule brought a wide swath of health apps, wearables, and digital health services under breach-notification duties for the first time, and it did so in a way that forced many companies to confront what reasonable security, and a trained workforce, actually require.

What the rule actually covers

The Health Breach Notification Rule, originally issued in 2009, was long assumed to apply narrowly to personal health records. The FTC's updated interpretation, formalized in its 2024 amendments and fully operative by mid-2025, made clear that the rule reaches health apps, fitness trackers, and other direct-to-consumer health technologies that hold identifiable health information. If a covered entity experiences a breach of unsecured health data, it must notify affected individuals, the FTC, and in some cases the media. The key term is breach, and the key lesson is that many digital health companies had no process in place for one.

Why it caught digital health companies off guard

The expansion mattered because most consumer health apps had never treated themselves as regulated entities. They collected sensitive data, shared it with advertisers and analytics providers, and assumed the absence of HIPAA meant the absence of obligation. The FTC's rule changed that. Unauthorized disclosure of health data, including sharing it with third parties in ways users had not meaningfully consented to, could now constitute a reportable breach. Companies that had no incident response plan, no data inventory, and no awareness training suddenly had a compliance obligation they were not built to meet.

The reasonable security expectation

Running through the FTC's enforcement approach was a consistent demand for reasonable security. The rule itself centers on breaches of unsecured data, which makes the FTC's definition of reasonable safeguards the practical standard. The agency has repeatedly signaled that reasonable security includes employee training, access controls, and a workforce that understands how to handle sensitive data. A company that cannot demonstrate it trained its people on data handling faces a harder time arguing it took reasonable precautions.

Where training fits the compliance picture

Security awareness training was not the headline of the Health Breach Notification Rule, but it was the quiet foundation. Most health-data breaches, like most breaches generally, begin with human error: an employee misconfigures a bucket, shares data with the wrong party, or falls for a phishing scheme. Training that teaches employees what health data is, how it must be handled, and how to report a potential breach directly reduces the incidents that trigger the rule's notification obligations. It is also the evidence an organization points to when regulators ask what it did to prevent harm.

What digital health companies should do

The practical response for any organization that handles consumer health data is to treat the Health Breach Notification Rule as a reason to build basic hygiene. That means: inventory where health data lives and how it is shared; establish a breach-response process that can identify, contain, and notify on a timeline; document reasonable security controls including training; and make sure employees understand their role in protecting health data. For many digital health companies, these were not new ideas, they were overdue ones that the rule finally forced.

A signal of what is coming

The FTC's expansion of the Health Breach Notification Rule was part of a broader trend: regulators extending health-privacy expectations to entities that never thought they were covered. As health data becomes more digital and more diffuse, the boundary between regulated and unregulated will keep blurring. Organizations that build documented security and training programs now, treating health data as sensitive by default, will be positioned for the next expansion wherever it lands.