The FTC rescinded its health app privacy statement. Your obligations did not shrink.

On September 9 the FTC rescinded its 2021 policy statement that had applied the Health Breach Notification Rule to fitness trackers, sleep apps, and other consumer health tech outside HIPAA. The agency called the statement obsolete, and if that is all you read, it sounds like the FTC just narrowed the rule. It did not.

The 2021 statement was the FTC’s own reading of an old rule, stretched to cover technology the rule never mentioned by name. It did three things: treated app developers as health care providers even with no HIPAA connection, said combining health data from one source with other data from another source could trigger the rule, and said an unauthorized disclosure counted as a breach even with no hack involved. That was aggressive lawyering applied to a 2009 rule, and companies who wanted a fight had a real argument that the FTC had exceeded what the text supported.

Then in 2024 the FTC amended the rule itself. The amended text does what the 2021 statement had only argued for: it defines covered health apps and connected devices directly, it treats an unauthorized disclosure as a breach, and it reaches companies with no HIPAA relationship at all. Once that happened, the 2021 policy statement was doing no legal work. It was interpreting a rule that no longer needed the interpretation. Rescinding it, under the current administration’s general push to clear out old guidance documents, removed a redundant memo. It did not touch the amended rule, and the amended rule is what actually binds you.

So if your compliance lead reads “FTC rescinds health app privacy policy” and tells the team the pressure is off, that is the wrong read, and it is the kind of wrong read that ages badly. Two things did not change on September 9. First, you are still a covered entity if your app or device draws health inferences from user data, whether that is a step count, a sleep stage, a cycle log, or a symptom checker, regardless of whether you think of yourselves as a health company. Second, an unauthorized disclosure to an ad platform or a data partner is still a reportable breach event under the rule’s current text, separate from whether you got hacked. The FTC’s recent Section 5 case against a telehealth brand over ad-pixel data flows shows the agency does not need the Breach Notification Rule at all to go after the same underlying conduct; it will use whichever theory fits the facts, and having two theories available is not a reason for either one to go easier on you.

The practical read for a wellness brand this quarter is narrower than “watch for new FTC guidance.” Pull whoever wrote your breach notification procedure and ask them which authority they cited: the rule’s current text, or the 2021 statement. If it was the statement, the procedure needs a citation update, not a substantive rewrite, because the obligations it was describing are now in the rule proper. Then separately confirm your incident response plan treats an unauthorized third-party disclosure, not just a security incident, as a breach trigger requiring notice within 60 days. That distinction is where most plans built before 2024 still have a gap, rescission or no rescission, and it is the gap an examiner or a plaintiff’s lawyer will look for first.