Data Breach Rule for Health Apps Leaves Developers in the Dark

Makers of health apps are scrambling to understand the extent of their legal liability after a divided Federal Trade Commission announced they’re now required to inform users about data and privacy breaches—and if they have used their customers’ health data without authorization.

The commission approved 3-2 a policy statement that the makers of health apps, including apps on smartphones and fitness devices, must comply with the FTC Health Breach Notification Rule. The rule had previously applied to a much narrower set of health-information software, primarily apps used to collect and store health records from doctors and other health-care providers.

Supporters ...