Source context: this article examines information published by the source on September 09, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What changed
The Federal Trade Commission (FTC) has rescinded the 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. This policy statement previously served as guidance for applying the Health Breach Notification Rule to entities collecting consumer health information via apps and connected devices.
The rescission occurred because the FTC updated the Health Breach Notification Rule in 2024. These updates explicitly incorporated health apps and connected devices—such as fitness trackers—into the rule’s scope, making the separate 2021 policy statement obsolete. This action follows an executive order directing federal agencies to eliminate unnecessary or obsolete guidance documents.
Status and timing
The rescission is a formal administrative action to remove outdated guidance. The governing authority for breach notifications involving health apps and connected devices has shifted from the 2021 policy statement to the updated 2024 Health Breach Notification Rule.
Who may be affected
This change primarily impacts entities that develop, manage, or provide health-related technology, including:
* Health App Developers: Organizations creating software that collects consumer health data.
* Connected Device Manufacturers: Providers of wearable technology and fitness trackers.
* Business Associates: Healthcare service providers who may utilize these third-party tools to collect patient or consumer information.
Practical readiness steps
From a cybersecurity operations perspective, we analyze the following steps as necessary for maintaining operational alignment with current regulatory expectations:
- Update Compliance Mapping: Security and compliance officers should review their internal regulatory matrices. Any references to the 2021 Policy Statement as the primary authority for health app breach notifications should be replaced with the updated 2024 Health Breach Notification Rule.
- Review Data Inventory: Organizations should identify all connected devices and apps currently in use that collect consumer health information. This ensures that the scope of the 2024 rule is fully applied to all relevant data streams.
- Audit Incident Response Plans (IRP): We recommend reviewing IRPs to ensure notification timelines and procedures align with the current Health Breach Notification Rule rather than obsolete guidance.
Validation Method: A compliance audit or a tabletop exercise focusing on a hypothetical breach of a connected device can verify if the response team is referencing the 2024 rule for notification triggers.
Open questions
While the rescission clarifies which document governs notifications, organizations may still need to evaluate how the 2024 Rule’s specific requirements differ in practice from the previous policy statement’s interpretations. Specifically, entities should determine if their current data handling and notification workflows meet the explicit standards set forth in the updated rule.
Source and editorial note
FTC Withdraws Obsolete Policy Statement · Source date: September 09, 2026 · Retrieved September 09, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request a healthcare security assessment
Turn healthcare security intelligence into action.
Discuss your environment, priorities, and the evidence needed to validate safeguards.
Request a healthcare assessment ↗