FTC Rescinds 2021 Health App Policy Statement in Deregulatory Shift

The Federal Trade Commission has unanimously voted to rescind a 2021 policy statement that extended the Health Breach Notification Rule (HBNR) to health and fitness apps and connected devices. The move signals a pivot toward a deregulatory agenda and a preference for formal rulemaking over agency guidance.

In an official statement, the FTC described the 2021 guidance as "contentious at the time of issuance," asserting that it provided "minimal benefit" and has since been "superseded by rulemaking." The agency maintains that the underlying requirements for health apps are now codified through a binding regulatory update from 2024, rendering the previous policy statement obsolete. This action aligns with broader White House directives to reduce the use of subregulatory guidance across federal agencies.

Closing the Regulatory Gap

The 2021 policy statement was originally designed to address a significant regulatory void in the digital health ecosystem. While traditional healthcare providers are governed by HIPAA, many health and wellness apps handle sensitive medical data but fall outside that law's scope. By asserting that these apps acted as "vendors of personal health records," the FTC sought to bring them under the HBNR, which mandates notifications for both security breaches and the unauthorized sharing of data with third parties.

At the time of its inception, the policy was a point of friction within the agency, passing in a divided 3-2 vote. The guidance served as the primary interpretive framework for how the government would hold wellness app developers accountable for data leaks.

Implications for the Industry

While the FTC insists that the 2024 rulemaking preserves the actual protections for consumers, the rescission of the policy statement removes the specific interpretive clarity that companies previously relied upon to assess their compliance risks. The shift from a policy statement to a formal rule changes the legal mechanism of enforcement, moving away from agency-led interpretation toward a codified regulatory standard.

For the health tech industry, this represents a broader trend toward deregulation. By removing subregulatory guidance, the agency is streamlining its approach to oversight, though it leaves the industry to navigate the transition from the 2021 framework to the 2024 binding updates.

What to Watch

Industry observers will now be monitoring how the 2024 regulatory update is applied in practice compared to the rescinded policy. While the FTC claims the protections remain intact, the removal of the 2021 framework may alter how the agency pursues enforcement actions against health app developers who fail to notify users of data breaches. The primary question remains whether the formal 2024 rules provide the same level of granular clarity as the previous guidance.