On September 9, 2026, the Federal Trade Commission (“FTC”) rescinded its 2021 policy statement which extended the Health Breach Notification Rule (“HBNR”) to health apps and connected devices outside the reach of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively “HIPAA”).
In its recent press release, the FTC called that prior guidance “obsolete” and “unnecessary,” concluding it provided minimal benefit and had been superseded by rulemaking. This is not a minor course correction at a moment when the Centers for Medicare and Medicaid Services (“CMS”) is actively steering seniors toward health apps that require collection and processing of identifiable consumer health information outside the reach of HIPAA.
On May 20, 2014, the Secretary of the Department of Health and Human Services (HHS) submitted the agency’s Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Years 2011 and 2012 (“Breach Report”). This report provides valuable insight for healthcare entities regarding their data security and enforcement priorities.
Section 13402(i) of the Health Information Technology for Economic and Clinical Health Act (HITECH) requires the Secretary of Health and Human Services to prepare an annual report regarding the number and nature of ...
By Patricia Wagner, Ali Lakhani and Jonathan Hoerner
On May 20, 2014, the Secretary of the Department of Health and Human Services (HHS) submitted the agency's Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Years 2011 and 2012 ("Breach Report"). This report provides valuable insight for healthcare entities regarding their data security and enforcement priorities.
Section 13402(i) of the Health Information Technology for Economic and Clinical Health Act (HITECH) requires the Secretary of Health and Human Services ...
Recent Updates
- Comment Period Closes on California OHCA’s Proposed Emergency Regulations Expanding Private Equity, Hedge Fund, and MSO Reporting in Health Care Transactions
- DOJ Revises Justice Manual on Non-Binding Guidance and Qui Tam Dismissals: Practical Considerations
- Additional SBA Crackdown on Pandemic-Era Fraud Leads to Program and Loan Suspensions, Possible FCA Enforcement
- Federal Regulatory Views on Cybersecurity and AI Amidst a Growing Threat Landscape
- Remote Monitoring Services Under the 2027 PFS Proposed Rule: Epstein Becker Green Submits Comments to CMS