Consumer health apps that are not covered entities or business associates still fall under the FTC's Health Breach Notification Rule, amended in 2024 to name health apps and connected devices explicitly. A "breach" includes sharing data without authorization, such as through analytics and ad SDKs. Who is covered, the 60-day clock, penalties of up to $53,088 per violation, and what to check in your app.
HIPAA applies to health plans, most providers, clearinghouses and their business associates. A direct-to-consumer app for fertility tracking, mental health, fitness or symptom checking often is none of those. Founders sometimes conclude no health privacy law applies. The FTC disagrees.
Vendors of personal health records and related entities that are not covered by HIPAA.
Since the 2024 amendments, published in the Federal Register on May 30, 2024, the rule makes explicit that makers of health apps, connected devices and similar products must comply.
The FTC's own example: a health app that collects information from consumers and can sync with a fitness tracker is typically a covered vendor.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Not just a hack. The FTC's guidance says a breach includes "sharing of covered information without an individual's authorization". An analytics or advertising SDK that sends health-related events to a third party, without the user's authorization, can be a breach under the rule.
Civil penalties reach $53,088 per violation (2025 inflation adjustment), per the FTC.
List every SDK and tag in the app and on the website, and what each sends: event names often carry health information ("completed_anxiety_assessment").
Remove advertising and attribution SDKs from screens that involve health data, or send them only events with no health meaning.
Move product analytics to a first-party collector you control, so events never reach a third party by default.
Get explicit consent for any sharing that remains, separate from the terms of service.
Write the incident plan with the 60-day clock in it.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Tracking Pixels and Analytics on Healthcare Websites in 2026: What Changed and What Did Not
A 2024 court decision vacated part of HHS's guidance on online tracking, the part about public, unauthenticated pages. Tracking on patient portals and in apps that handle PHI is still covered, most ad and analytics vendors will not sign a BAA, and the FTC brings its own cases. What is still risky and the setup we would use instead.
Read
EKS for HIPAA in 2026: What the BAA Covers and What You Still Have to Configure
EKS, ECR, Fargate, EBS, EFS and GuardDuty are on AWS's HIPAA eligible services list, so you can run workloads with PHI on Kubernetes under a BAA. Eligibility is not compliance: encryption, access, isolation, audit logs and what lands in your logs are yours. A control-by-control checklist, with a diagram.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.