Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
FTC HBNR
Regla de Notificación de Violaciones de Datos de Salud de la FTC
Aviso de violaciones para aplicaciones de salud y servicios similares fuera de HIPAA, en el que el intercambio no autorizado cuenta como violación.
The law in brief
The FTC's Health Breach Notification Rule requires vendors of personal health records and related entities that are not covered by HIPAA to notify people, the FTC and sometimes the media after a breach of health information. It fills the gap left by HIPAA for health apps, fitness trackers, connected devices and similar services.
Amendments effective 29 July 2024 made clear that health apps are covered and that a breach includes an unauthorized disclosure the company itself makes, such as sharing health data with advertising platforms without authorization, not only a cyberattack.
A quién se aplica
- Vendors of personal health records: services that offer an electronic record of health information that can be drawn from multiple sources and is managed by or for the individual, including many health and wellness apps.
- PHR related entities that offer products or services through a vendor's website or app, or that access or send information to a personal health record.
- Third-party service providers to these entities, which must notify the entity they serve.
- HIPAA-covered entities and business associates are excluded, because HIPAA's own breach rules apply to them.
Unauthorized disclosure is a breach
A breach of security includes an unauthorized acquisition of identifiable health information, including one resulting from a disclosure the entity itself makes without the individual's authorization.
What it requires
Notify individuals within 60 days
Notify each affected individual without unreasonable delay and no later than 60 calendar days after discovering the breach.
Notify the FTC
For breaches involving 500 or more individuals, notify the FTC at the same time as individuals. For fewer, keep a log and report to the FTC within 60 days after the end of the calendar year.
Notify the media for large breaches
Notify prominent media outlets serving a state or jurisdiction when a breach involves more than 500 residents of it.
Service providers notify their clients
Third-party service providers notify the entity they serve after discovering a breach, so it can notify individuals.
Derechos de las personas
Affected individuals must receive a notice describing the breach, the information involved, steps they can take, and what the company is doing, by email or first-class mail and in some cases through substitute notice.
Enforcement and penalties
Sanciones civiles por infracción, ajustadas cada año a la inflación, que la FTC puede solicitar ante un tribunal federal. La FTC ha emprendido acciones contra aplicaciones de salud que compartieron datos de salud con anunciantes, y las infracciones también pueden imputarse como prácticas desleales o engañosas.
What to do first
- Decide whether you are a personal health record vendor or related entity, and confirm HIPAA does not apply.
- Map every flow of health information, including pixels, SDKs and analytics.
- Treat unauthorized sharing as a breach: get authorization before any disclosure outside your stated purposes.
- Prepare notices that meet the rule's content requirements.
- Set up the FTC and media notice process for breaches of 500 or more people.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novedades recientes
Aún no hay nada que informar. Regulatory Watch enumera las nuevas normas, medidas de cumplimiento y decisiones judiciales a medida que llegan.
Fuentes
- 16 CFR Parte 318, Regla de Notificación de Violaciones de Datos de Salud eCFR · Texto oficial o regulador
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales