FTC Enforcement in Digital Health: Past Trends and Future Implications

FTC Enforcement in Digital Health: Past Trends and Future Implications

In recent years, digital health companies have faced increasing regulatory scrutiny from the Federal Trade Commission (FTC), particularly concerning privacy, security, and advertising. While the Biden Administration expanded the FTC’s oversight of digital health apps, an article from the Wiley firm says the transition to the Trump Administration could bring some changes, especially given the new Chairman’s dissenting views on recent rule amendments. However, FTC enforcement actions related to health data remain a bipartisan priority, making compliance essential for digital health providers.

A central focal point of FTC enforcement has been the Health Breach Notification Rule (HBNR), which mandates reporting breaches of personal health records. Originally enacted in 2009, the rule was largely dormant until the FTC issued a 2021 policy statement asserting that unauthorized disclosures of health data by apps constituted breaches requiring notification. 

This interpretation led to the FTC’s first HBNR enforcement actions in 2023, targeting companies allegedly sharing health data with advertisers without proper consent. The FTC also applied the broader FTC Act, arguing that such data-sharing constituted deceptive and unfair practices. The HBNR was subsequently amended in 2024 to incorporate the FTC’s expanded enforcement approach formally, but the amendments faced partisan opposition.

Despite these divisions, the FTC under Chairman Ferguson is expected to continue scrutinizing deceptive health-related claims and unauthorized data sharing. While the scope of HBNR enforcement may narrow slightly, companies should assume heightened regulatory risk remains, particularly regarding data practices that would have triggered enforcement under the pre-2024 rule. Ensuring transparent privacy policies and obtaining express user consent before sharing health data will be crucial for mitigating legal exposure.