FTC HBNR Rule (AI health apps)
FTC Health Breach Notification Rule — Amended (covers AI health-app inferences)
United States · 16 C.F.R. Part 318; 89 Fed. Reg. 47028
- Status
- In effect
- Took effect
- July 29, 2024
- Applies to
- Vendors of personal health records, PHR-related entities, and third-party service providers handling identifiable health information
- Enforced by
- Federal Trade Commission
Health apps and connected devices — including AI-powered mental health and fitness tools — must notify users, the FTC, and (in some cases) the media within 60 days of a breach of identifiable health information. The 2024 amendments confirm that AI-generated inferences about health are covered.
Who is protected: U.S. consumers of non-HIPAA-covered health apps, including AI symptom checkers, mental health chatbots, and fitness wearables
Legal detail
16 C.F.R. Part 318 (as amended, 89 Fed. Reg. 47028). Clarifies that 'PHR identifiable health information' includes data emerging from algorithmic and AI inferences; covers vendors of personal health records and PHR-related entities; expands what constitutes a 'breach' to include unauthorized disclosures.
Key facts
| Jurisdiction | United States |
|---|---|
| Level | Federal |
| Strength | Moderate |
| Enacted | April 26, 2024 |
| Citation | 16 C.F.R. Part 318; 89 Fed. Reg. 47028 |
| Private right of action | No, agency enforcement only |
| Penalties | Civil penalties of $53,088 per violation per day; consumer redress |
| Topics | consumer data privacy · healthcare AI · consumer protection · data retention |
| Agency page | Health Breach Notification Rule — Final Amendments (89 FR 47028) |
More AI rules in United States
- Trump AI Innovation & Security EO (June 2026) · In effect
- FERC order directing PJM and other grid operators to reform tariffs on… · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for location… · Blocked / in litigation
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- NAIC AI Evaluation Tool Pilot (12 states, 2026) · Proposed / pending
- FTC Proposed Policy Statement — AI Accuracy (July 2026) · Proposed / pending
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- House Bill 2512 — Banning surveillance pricing by rideshare companies · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
- NYDFS CL 7 (2024) — Insurance AI Anti-Discrimination · In effect
- Virginia § 15.2-1723.2 (facial recognition by local law enforcement, eff. July 1, 2026) · In effect
See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.