On April 26, 2024, the Federal Trade Commission (FTC) posted its finalized changes to the Health Breach Notification Rule (HBNR), imposing HIPAA-like breach requirements for non-HIPAA-covered entities. These updates, effective within 60 days of publication, are designed to keep pace with the evolving health tech landscape, ensuring that health apps and similar technologies receive additional scrutiny. These technologies are not currently covered by the Health Insurance Portability and Accountability Act (HIPAA) to give notice of a breach of unsecured personally identifiable health data. Key points of the updated rule include:  

• clarifying and revising certain definitions (e.g., “PHR identifiable health information,” “breach of security,” and “PHR related entity”);
• adding new definitions (“covered health care provider” and “health care services or supplies”);
• requiring specific notification content for impacted individuals; and 
• expanding use of email and other electronic notification methods.  

The FTC’s final rule requires companies to have a strong incident response plan to act timely after the discovery of a breach of security. For guidance on navigating these changes or strengthening your incident response plan, contact Ice Miller’s Data Security and Privacy Group.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.