By: Christopher Parrella, Esq., CPC, CHC, CPCO

Parrella Health Law, Boston, MA

A Health Care Provider Defense and Compliance Firm

The Federal Trade Commission recently rescinded its 2021 policy statement addressing breaches involving health apps and connected devices. At first glance, that may sound like a retreat from privacy enforcement. It is not. The FTC expressly stated that protecting sensitive health information remains a priority. The agency’s reason for withdrawing the 2021 policy statement is that it believes the guidance has been overtaken by formal rulemaking, specifically the FTC’s 2024 amendments to the Health Breach Notification Rule. The Commission also said the rescission reflects a broader effort to reduce reliance on nonbinding sub-regulatory guidance.

For digital health companies, telehealth platforms, wellness applications, and health technology vendors, the distinction matters. The old policy statement is gone. The underlying Health Breach Notification Rule is not.  The FTC’s own rescission points directly to the 2024 Health Breach Notification Rule as the reason the 2021 policy statement is no longer necessary.

Providers should also pay attention because the boundary between traditional health care delivery and consumer health technology continues to disappear. Physician practices, behavioral health providers, and telehealth companies increasingly use patient portals, mobile applications, wearable devices, remote monitoring platforms, and third-party analytics tools. Data may move between systems that are subject to HIPAA and systems regulated by the FTC.  That creates a compliance problem if nobody has mapped where the data goes.

The FTC also referenced its July 2026 enforcement action involving Hims & Hers as an example of its continuing focus on deceptive or unlawful health privacy practices. That citation is significant because it reinforces the point that rescinding guidance should not be interpreted as abandoning enforcement.

The practical lesson is that providers and digital health companies should stop thinking about privacy exclusively through a HIPAA lens. HIPAA may be only one part of the analysis. Depending on the organization and technology involved, FTC rules, state consumer privacy laws, breach notification statutes, and contractual obligations may also apply.

The call to action is straightforward. Organizations should map every system that collects, receives or transmits health information. Identify which entities are HIPAA-covered entities or business associates and which are not. Review mobile applications, tracking technologies, website analytics, patient portals, and connected devices for data-sharing practices. Confirm that breach response plans address both HIPAA and FTC notification requirements where applicable.  The FTC may have eliminated an old policy statement, but it did not eliminate the compliance obligation. If anything, the agency is telling the industry to look to the rule itself.

If you have questions about health data privacy, digital health compliance or breach notification obligations, please contact Parrella Health Law at 857.328.0382 or Chris directly at cparrella@parrellahealthlaw.com.