Agent Wranglers

CMP-77Required US law

Report health data leaks under the FTC rule when HIPAA does not cover you

If your app holds health data on US users and HIPAA does not cover you, treat any disclosure without the person's authorisation as a breach. Notify the people and the FTC within 60 days of finding it.

By Agent Wranglers. Updated .

Region

United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

The FTC's Health Breach Notification Rule, 16 CFR Part 318, covers vendors of personal health records and their service providers. Health and fitness apps and connected devices outside HIPAA count. Its 2024 amendments make clear that a breach includes sharing health data with a third party without authorisation, not only an attack. So an advertising pixel that sends health data can trigger it. Notify each person within 60 calendar days. Above 500 people, tell the FTC at the same time, and the media in a state with 500 or more affected residents. Below 500, report to the FTC within 60 days after the year ends. Add these clocks to Keep the US breach notice laws as data.

How to check

The facts file says whether the app holds health data and whether HIPAA covers you. When the rule applies, a unit test feeds a 600-person breach to the breach tool. It shows notices to people and to the FTC due within 60 days of discovery.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/health-breach-notification">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.