HIPAA applies to covered entities, which are health plans, clearinghouses and providers that transmit certain health information electronically, and to their business associates. A health app that serves consumers directly and is neither may sit outside HIPAA but inside the FTC Health Breach Notification Rule. Confirm your case with counsel.
Step one: are you a covered entity or business associate?
A covered entity is a health plan, a health care clearinghouse, or a health care provider that electronically transmits health information in connection with a standard transaction. A business associate performs functions for a covered entity involving PHI. If an app is built for a hospital or plan and handles PHI on its behalf, business associate status is likely.
Step two: if not, check the FTC rule
The FTC rule covers vendors of personal health records, PHR related entities and third party service providers. It states that it does not apply to HIPAA covered entities, and an entity is also excluded when it acts as a business associate. A personal health record is an electronic record of identifiable health information on an individual that has the technical capacity to draw information from multiple sources.
Decision table
| App situation | Likely framework | Why |
|---|---|---|
| App sold to clinics, handles their patient data | HIPAA business associate | Acts on behalf of a covered entity |
| App run by a provider that bills insurers electronically | HIPAA covered entity | Provider with standard transactions |
| Consumer wellness app that pulls data from several sources into a personal record | FTC Health Breach Notification Rule may apply | Looks like a personal health record |
| Consumer app that stores no identifiable health information | Neither may apply, but privacy laws still do | Check state laws |
What the FTC rule asks after a breach
Notices go to individuals, and the FTC in specified cases, without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting 500 or more people, the FTC notice goes at the same time as the individual notices. Smaller breaches may be reported to the FTC annually. Third party service providers and vendors also have duties under the rule.
Engineering takeaways
- Decide your status early and write it down.
- Build breach detection and logs either way.
- Map third party SDKs and analytics tools that touch health data, because they are part of your chain.
- Plan notices before launch.
- Revisit status when you sign a hospital customer or start offering features that change roles.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Can an app be both?
Yes, parts of an organisation can fall under different rules. Ask counsel how your products are classified.
Is state law relevant?
Yes. Many states have their own health privacy and breach laws, so check those too.
Sources
- 45 CFR 160.103, Cornell LII
- 16 CFR 318.1, Cornell LII
- 16 CFR 318.2, Cornell LII
- 16 CFR 318.4, Cornell LII
Last reviewed: 19 October 2026.
