--- title: "Report health data leaks under the FTC ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/health-breach-notification id: CMP-77 level: Required region: US risk: law updated: 2026-10-27 build: a2a6bdfed830 tokens: 816 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Report health data leaks under the FTC rule when HIPAA does not cover you For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-77 - Level: Required - Chapter: [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md) - Rule: If your app holds health data on US users and HIPAA does not cover you, treat any disclosure without the person's authorisation as a breach. Notify the people and the FTC within 60 days of finding it. - Check: The facts file says whether the app holds health data and whether HIPAA covers you. When the rule applies, a unit test feeds a 600-person breach to the breach tool. It shows notices to people and to the FTC due within 60 days of discovery. - Risk: A law broken - Region: United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: The FTC's Health Breach Notification Rule, 16 CFR Part 318, covers vendors of personal health records and their service providers. Health and fitness apps and connected devices outside HIPAA count. Its 2024 amendments make clear that a breach includes sharing health data with a third party without authorisation, not only an attack. So an advertising pixel that sends health data can trigger it. Notify each person within 60 calendar days. Above 500 people, tell the FTC at the same time, and the media in a state with 500 or more affected residents. Below 500, report to the FTC within 60 days after the year ends. Add these clocks to [Keep the US breach notice laws as data](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-breach-notice-laws.md). ## Sources - [FTC, Complying with the Health Breach Notification Rule](https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0) - [16 CFR Part 318](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318) ## Related rules - CMP-61 [Keep the US breach notice laws as data](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-breach-notice-laws.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Give notice and an appeal before automated decisions](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/automated-decision-rights.md) - Next: [Process California deletion requests from DROP every 45 days](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/california-data-broker-drop.md) - [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)