FTC Retires Health App Data Breach Policy, but Underlying Rule Remains in Force

On September 9, 2026, the Federal Trade Commission (FTC) announced the rescission of its "2021 Policy Statement on Breaches by Health Apps and Other Connected Devices." The FTC deemed the policy statement obsolete and unnecessary. This action does not change the substantive requirements for entities covered by the Health Breach Notification Rule; it merely removes a redundant guidance document because the policy's contents were formally incorporated into the rule itself in 2024.

This action primarily affects vendors of health apps and connected devices, such as fitness trackers. It is also relevant for employers who offer wellness programs that utilize such technologies, as they or their vendors may have obligations under the FTC's Health Breach Notification Rule if they handle covered health information and experience a data breach.

The Federal Trade Commission announced the rescission on September 9, 2026.

HR professionals managing employee wellness programs should not misinterpret this action as a weakening of data breach notification rules. The FTC's withdrawal of the 2021 policy statement is a procedural cleanup, not a substantive change in obligations. The requirements that the policy sought to clarify are now explicitly codified in the updated Health Breach Notification Rule (HBNR) as of 2024. This means that if a wellness program using a health app or fitness tracker experiences a data breach, notification duties still apply. The source of the obligation is now the rule itself, not a policy statement. This move simplifies the regulatory landscape by removing a redundant document, but the compliance burden for protecting employee health data and notifying individuals of a breach remains firmly in place under the HBNR.

• Employers should review their wellness programs to determine if they use health apps or connected devices that collect consumer health information. • It is crucial to understand that the rescission of the 2021 policy statement does not eliminate data breach notification requirements for these technologies. • The obligations are now directly contained within the FTC's updated Health Breach Notification Rule. • Employers should confirm that their wellness program vendors are compliant with the HBNR. • Given the complexities of data privacy, employers should consider reviewing their wellness program agreements and data handling practices with qualified counsel to ensure compliance with the HBNR and other applicable privacy laws.

The FTC's decision to rescind its 2021 policy statement is a logical step in regulatory housekeeping. By incorporating the policy's principles directly into the Health Breach Notification Rule in 2024, the Commission created a clearer, more direct source of authority. For employers, this action underscores the permanence of data breach notification duties related to employee wellness technology. Relying on the formal rule rather than a policy statement provides greater certainty but also reinforces the FTC's focus on this area. Employers should treat this development as a reminder to audit their wellness programs and vendor agreements for compliance with the now-codified HBNR requirements.