A breach with no attacker: the FTC’s warning to health apps

The week

On September 15, 2021, the Federal Trade Commission voted 3-2 to issue a policy statement on its Health Breach Notification Rule. The 2009 rule requires personal health record vendors and related entities outside HIPAA to notify consumers, the FTC and sometimes the media after a breach of security of unsecured identifiable health information. The statement said that health apps and connected devices that draw health information from more than one source, such as a user’s own entries and data pulled through an application programming interface from a fitness tracker, can be personal health record vendors under the rule. It also said a breach is not limited to cybersecurity intrusions and includes unauthorized disclosures, such as a company sharing health information without the user’s authorization. The FTC had never enforced the rule, and earlier in 2021 had settled with the fertility app Flo Health over data sharing without invoking it.

Most organizations think of a breach as something done to them. An attacker gets in, takes data, and the organization responds. The FTC’s statement described a different kind: a company that sends users’ health information to an advertising or analytics partner without the users’ authorization has, under the rule, experienced a breach of security, with the same notification duties as if it had been hacked. No intruder is needed. The organization itself is the cause.

That has an uncomfortable implication for how breach prevention is organized. Security teams own firewalls, endpoint tools and incident response. They usually do not decide which software development kits ship in the mobile app, which data a marketing partner receives, or what the consent screen says. Those decisions sit with product managers, marketing teams, web agencies and business development. Under the FTC’s reading, each of them can create a reportable breach without touching a security control. The statement therefore moved breach prevention into three business decisions: what code ships, what partners receive, and what users agreed to.

The rule reaches entities outside HIPAA, which in 2021 meant most consumer health, fitness and wellness apps. Health systems and payers are mostly governed by HIPAA instead. But they sit close to the issue: they partner with digital health companies, they send records to apps at patients’ direction, and their own websites use the same tracking tools. The three decisions apply to them as well, under different rules.

What code ships: tracking as a disclosure channel

Modern apps and websites are assembled from third-party components. Analytics libraries, advertising pixels, crash reporters, chat widgets and session replay tools each send data to their providers, often including device identifiers, page names, search terms and events such as “appointment booked” or “cycle logged.” On a health app, those events can reveal a condition. Many organizations could not list every third-party component in their products, because marketing teams, agencies and developers added them over years, and some loaded further components of their own.

The control is a release gate. No third-party code ships without a named owner, a record of what data it collects and where it sends it, and a check against the privacy policy and user permissions. That review needs to see actual network traffic, because configuration screens often understate what a library transmits. Periodic scans of production apps and pages catch components added outside the release process, which is how many of them arrive.

A scan that finds an unapproved pixel sending health events to an advertiser is no longer only a cleanup task. Under the FTC’s reading it may be a breach. The rule set deadlines: notice to affected individuals without unreasonable delay and within 60 days of discovery, and, where 500 or more people were affected, notice to the FTC within ten business days. The finding needs to go to whoever owns the breach decision the day it is made.

What partners receive: contracts and data maps

The second decision is deliberate sharing. Health apps commonly send data to advertising platforms to measure campaigns or build audiences, to analytics vendors, to research partners, and to employers or insurers in wellness programs. Each flow needs a basis: a user authorization that covers it, a contract that limits what the recipient may do, and a record that the two match.

The practical gap in 2021 was that data sharing agreements were signed by business teams without a data map, and data maps were drawn by engineers without reading the agreements. Bringing them together means an inventory of every outbound health data flow, with its recipient, purpose, legal basis and contract reference, reviewed whenever a new partner is added. For health systems, the same inventory belongs in vendor due diligence for digital health partners, including the question of whether the partner is a business associate under HIPAA or a consumer company under the FTC’s rule.

What users agreed to: authorization that holds up

The third decision is the consent itself. The FTC’s statement turned on authorization: sharing a user had authorized was not a breach, and sharing they had not authorized could be. Authorization buried in a long privacy policy, or implied by continued use of an app, is weak ground for a company that sends health information to advertisers.

Clear authorization is a design task. It means plain statements at the point of collection, separate choices for separate uses, a record of what each user agreed to and when, and systems that honor a withdrawal across every downstream flow. The test is whether a company can show, for any given user and data flow, what the user saw and chose. If it cannot, the safer reading is that the flow was not authorized.

Together the three decisions define a program that a privacy office can run with product and marketing leaders: a release gate for code, an inventory for partners, and an auditable record of consent. The security team remains essential for intrusions. For the breaches the FTC described, the controls belong to the people who build and market the product.

With hindsight

From 2026, the statement marked the start of active enforcement. In 2023 the FTC brought its first cases under the rule: against GoodRx, which agreed to a $1.5 million civil penalty over sharing health information with advertising platforms, and against the maker of the Premom fertility app. It also used its general authority against BetterHelp over sharing for advertising. In April 2024 the FTC finalized amendments that wrote the statement’s main points into the rule, clarifying that it covers health apps and that unauthorized disclosures are breaches. For HIPAA entities, HHS issued guidance on online tracking technologies in December 2022, and a federal court vacated part of it in 2024. Washington’s My Health My Data Act, effective in 2024, added consent rules for consumer health data. Across these, the controls that mattered were the three business decisions above, not perimeter security.