It can. The FTC says a breach under its Health Breach Notification Rule is not limited to cybersecurity intrusions, and that disclosing health information to a third party such as an advertising network without the person's consent may count. If your app uses analytics or ad SDKs, review what each one receives. This is not legal advice.
Who the FTC rule covers
According to the FTC's business guidance, the rule covers vendors of personal health records, related entities and their third party service providers. Health apps that can draw data from multiple sources, such as fitness trackers, are likely personal health record vendors. Businesses already covered by HIPAA are not covered by this rule. Whether your product is covered by HIPAA, the FTC rule or neither is a question for counsel.
What counts as a breach
The FTC describes a breach as unauthorized acquisition of unsecured, identifiable health information. Unauthorized access is presumed to be acquisition unless shown otherwise. Its example is sharing users' medical information with an ad network for targeted marketing without consent. That applies even without names, if the data could reasonably identify someone.
For engineers, the point is simple: a data flow to a third party can be the incident, even with no attacker.
Notification timing in the FTC guidance
The guidance says individuals are notified without unreasonable delay and no later than 60 calendar days after discovery. For 500 or more people, the FTC is notified at the same time. For fewer than 500, notification to the FTC is due within 60 calendar days after the end of the calendar year. Service providers notify their client within 60 days of discovery. Check the current rule text for details.
What engineers should do now
- List every SDK, pixel and script in the app and on the web properties.
- For each one, capture a real session with a proxy and write down what is sent: event names, parameters, identifiers.
- Remove or block anything that sends health related events, such as condition searches or medication names, to a party without a clear, consented purpose.
- Move to a fixed event schema that you define and control.
- Gate new SDKs behind a review that includes a data flow check.
- Make consent state a hard condition: no consent, no event.
- Keep a dated record of the review.
A data flow table to keep
| SDK or script | What it receives | Health related? | Consent required? | Decision |
|---|---|---|---|---|
| Analytics library | Event names, device ID | Review | Review | Keep, remove or limit |
Fill one row per SDK. The act of filling it in finds most problems.
Where Safeguard fits
Safeguard scans your dependencies, which includes the SDKs you embed, and its policy gates can require review before a new package merges. The consent and data flow judgment remains with your privacy and engineering owners. A free scan is available at gold.safeguard.sh/scan.
Quick check
Does removing names make an event stream safe?
Not automatically. The FTC guidance says data that could reasonably identify someone can still count.
Does this rule apply to every health app?
No. Coverage depends on facts, and HIPAA covered businesses are outside it. Ask counsel.
Sources
Last reviewed: 19 October 2026.
