Telehealth health-data breach notices: FTC rule vs. HIPAA

01

Why one telehealth service can cross privacy frameworks

A consumer-facing platform may coordinate marketing, intake, payments, clinician services, laboratory orders, pharmacy fulfillment, messaging, and shipping through several legal entities. HHS explains that HIPAA applies to defined covered entities and business associates, not automatically to every organization collecting health information.

The FTC Health Breach Notification Rule applies to certain vendors of personal health records, PHR-related entities, and service providers that are not covered by HIPAA for the affected information. The FTC's 2024 amendments expressly clarified the rule's application to many health apps and similar technologies and took effect July 29, 2024.

Do not decide coverage from the logo at the top of the notice. Identify the company that experienced the incident, the clinical practice if different, each vendor named, and which dataset was involved. State breach laws, consumer-protection law, contracts, or other rules can add obligations beyond the federal frameworks discussed here.

02

What counts as a breach can be broader than hacking

FTC guidance defines a breach under its rule around unauthorized acquisition of unsecured, identifiable health information in a personal health record. The agency explains that unauthorized disclosure can qualify; an attacker does not have to break into a database. Sharing covered data with an advertising or analytics recipient without authorization can require the same kind of assessment.

The HIPAA framework generally presumes an impermissible use or disclosure is a breach unless a regulated entity demonstrates a low probability that protected health information was compromised after the required risk assessment, or an exception applies. HHS distinguishes protected health information from data outside HIPAA's scope and ties notification to unsecured information.

Encryption can affect whether notification is required when it meets the applicable standard and the key was not compromised. Consumers rarely have enough technical detail to decide this from a first announcement. A statement that data was encrypted should specify which data, at what stage, and whether credentials or keys were also affected.

03

How to read the notice without overreading it

Start with the legal entity and incident dates: when did the event occur, when was it discovered, and when did the organization determine that a person's data was involved? Then list each data type, such as contact information, account credentials, treatment interests, diagnoses, prescription information, laboratory results, insurance information, government identifiers, or payment data.

Look for the unauthorized recipient or a useful description when naming the recipient would create risk, the steps already taken, recommended protective actions, and a staffed contact method. Both FTC and HHS materials describe time-sensitive individual notice duties; a notice sent within an outer deadline is not proof that the organization detected the incident promptly.

Distinguish confirmed facts from an investigation still in progress. 'No evidence of misuse' does not mean misuse is impossible, while a notice does not prove that every exposed data element was viewed or used. Save the original notice, envelope or headers, and the privacy documents that were in effect when the data was collected.

04

Immediate protective steps for a health-data incident

Reach the company through a known website, portal, or phone number instead of clicking a link in an unexpected breach message. Confirm the notice is genuine and ask which account, provider, pharmacy, laboratory, or service is affected. Change reused passwords, enable multifactor authentication, and review active sessions and recovery methods.

The appropriate next step depends on the data. Monitor payment accounts when financial details were involved; review insurance explanations of benefits for unfamiliar care; and follow current IdentityTheft.gov guidance if a government identifier or medical identity risk exists. Consider whether an exposed email or phone number could be used for convincing treatment, refill, or pharmacy phishing.

Do not stop a prescribed medication or ignore urgent medical needs solely because a platform reported a privacy incident. Ask the treating practice how to maintain clinical continuity through a verified channel. A privacy failure and the medical risks of interrupting care are separate questions.

• →Verify the notice independently
• →Change reused credentials
• →Review account sessions and recovery details
• →Monitor relevant bills and benefits
• →Preserve the notice and communications
• →Use a verified clinical channel for ongoing care

05

Where public reports and complaints fit

The FTC maintains its rule page and publishes received health-breach notices. HHS maintains a separate breach-reporting process and public information for large HIPAA breaches. These systems can help confirm that an organization reported an incident, but a list entry is not a complete investigative finding or a consumer quality rating.

A person who believes a HIPAA covered entity or business associate violated privacy, security, or breach-notification rules can review the current HHS Office for Civil Rights complaint process. Concerns about a non-HIPAA health app or unfair privacy practice may be directed through current FTC consumer-reporting channels.

Use the correct entity name and preserve evidence. A platform brand, medical group, pharmacy, and technology vendor may have similar names but different legal responsibilities. Do not post medical records, notice codes, or identity documents publicly while asking for help.

06

Privacy questions to ask before enrolling

Read both the website privacy policy and the clinical entity's Notice of Privacy Practices when available. Map who receives intake answers, tracking data, identity documents, payment information, laboratory results, messages, prescriptions, and shipping details. Ask which entity maintains the medical record and how to request a copy.

Review whether advertising trackers or data brokers are described, whether optional marketing consent is separate from treatment consent, how long information is retained, and how account deletion differs from medical-record retention. A claim that a platform is 'HIPAA compliant' does not answer these questions or prove that HHS certified the service.

Warning signs include no identifiable medical practice, a generic privacy email that cannot identify data recipients, pressure to upload records through an ordinary lead form, and privacy language claiming that all health data everywhere is protected by HIPAA. Verify licensure, pharmacy identity, product status, and clinical evidence separately from privacy.