Why HIPAA often doesn’t apply
HIPAA applies to covered entities (health plans, clearinghouses and most providers) and their business associates. A consumer health app that a person downloads on their own, with no covered entity behind it, usually sits outside HIPAA. That does not leave the data unregulated: the FTC and a growing number of states cover it.
This is not legal or regulatory advice; consult qualified counsel.
The FTC Health Breach Notification Rule
The rule (16 CFR Part 318) “applies to foreign and domestic vendors of personal health records, PHR related entities, and third party service providers” and “does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity” (§318.1, 16 CFR Part 318 (eCFR)).
Notices to individuals “shall be sent without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security” (§318.4(a)). For breaches involving 500 or more people, notice to the FTC goes out at the same time (§318.4(b)).
The FTC amended the rule in 2024, effective July 29, 2024 (FTC, Health Breach Notification Rule final amendments, 89 FR 47028 (May 30, 2024)). Read the current definitions, including “breach of security,” in the eCFR text rather than in summaries.
FTC enforcement so far
| Case | Legal basis | Outcome (per FTC) | Source |
|---|---|---|---|
| GoodRx (2023) | Health Breach Notification Rule (first action) | $1.5 million civil penalty; barred from sharing health data with third parties for advertising | FTC press release, GoodRx (Feb 1, 2023) |
| Easy Healthcare / Premom (2023) | Health Breach Notification Rule (second action) | $100,000 civil penalty, plus $100,000 total to CT, DC and OR | FTC press release, Easy Healthcare / Premom (May 17, 2023) |
| BetterHelp (2023) | FTC Act Section 5 (unfair and deceptive practices), not the Health Breach Notification Rule | $7.8 million for partial consumer refunds; ban on disclosing health data for advertising | FTC press release, BetterHelp final order (Jul 14, 2023) |
The lesson from all three: sharing health data with advertising platforms, through pixels or SDKs, is the pattern the FTC has gone after.
State consumer health data laws
Some states now regulate consumer health data directly. Washington’s My Health My Data Act (Washington My Health My Data Act, RCW 19.373) is the broadest; the state Attorney General summarizes it at Washington Attorney General, My Health My Data Act page. Nevada passed a similar law in 2023 (Nevada SB 370 (2023), NELIS bill overview). Other states have amended their privacy laws to cover health data. Check each state’s official code before relying on it; scope and exemptions differ by state.
A checklist for non-HIPAA health apps
- Map every data flow, including analytics, ad and crash-reporting SDKs and pixels.
- Assume health data shared for advertising is high risk under FTC precedent.
- Have a breach plan that meets the 60-day outer limit in §318.4.
- Check which state laws apply to your users, starting with Washington.
- Re-check HIPAA status whenever you sign a deal with a provider or plan; you may become a business associate.
Go deeper
Sources (accessed October 27, 2026)
- 16 CFR Part 318 (eCFR)
- FTC, Health Breach Notification Rule final amendments, 89 FR 47028 (May 30, 2024)
- FTC press release, GoodRx (Feb 1, 2023)
- FTC press release, Easy Healthcare / Premom (May 17, 2023)
- FTC press release, BetterHelp final order (Jul 14, 2023)
- Washington My Health My Data Act, RCW 19.373
- Washington Attorney General, My Health My Data Act page
- Nevada SB 370 (2023), NELIS bill overview
Related resources
Frequently asked questions
Does HIPAA apply to health apps?
Only when the app is run by, or for, a HIPAA covered entity or business associate. Many direct-to-consumer apps fall outside HIPAA.
What is the FTC Health Breach Notification Rule?
An FTC rule (16 CFR Part 318) that requires vendors of personal health records and related entities not covered by HIPAA to notify individuals, the FTC and sometimes the media after a breach of security.
Was BetterHelp a Health Breach Notification Rule case?
No. The FTC brought the BetterHelp case under Section 5 of the FTC Act. GoodRx and Premom were the Health Breach Notification Rule cases.
Scope it in 30 minutes
Book a scoping call and we'll name the smallest engagement that moves you forward. Most teams start with the fixed-scope Initial Audit.
Book a 30-min scoping callPrefer to write? Send a short note.