Short answer: A wellness assessment screen does not automatically fall under the US Federal Trade Commission’s Health Breach Notification Rule. But a connected service that holds identifiable health information, can draw it from multiple sources, and is managed for an individual may be in scope. Buyers should establish what the exact system collects, where it sends data, and which company is responsible before connecting it to an app, cloud account or analytics service.
The FTC announced changes to the rule in April 2024, with the amendments taking effect in July 2024. Its announcement made clear that health apps and similar technologies outside HIPAA can be covered. The Commission’s current business guidance explains the applicable entities and gives examples involving apps and connected fitness devices. This is a data-flow issue, not a label that can be resolved by calling a product a wellness tool.
Start with the actual configuration
Ask whether the quoted assessment equipment only displays information during a consultation or also creates a named record. Does it store answers or measurements locally? Can it sync with a mobile app, wearable, customer relationship system or remote dashboard? Can a user access or control a personal record? Technical capacity to draw information from multiple sources matters in the FTC’s description of a personal health record. A brochure photograph cannot answer these questions.
Separate three things on a diagram: the hardware, any software supplied with it, and third-party services. Record the legal entity operating each service, the types of data transferred, the destination and the retention period. Request a demonstration of the exact version to be delivered. If a feature is optional, show both the offline and connected workflows instead of assuming they have identical privacy obligations.
Why a breach is not limited to a hack
The FTC’s 2024 announcement clarifies that unauthorized acquisition can result from an unauthorized disclosure as well as a security intrusion. Its business guidance gives the example of sending identifiable health information to an advertising network without authorization. For a wellness operator, this makes marketing pixels, session replay, cloud backups and support access worth reviewing before launch. The point is not that every such tool violates the rule; it is that a team must know whether protected information is disclosed and to whom.
Questions to put in the purchase file
- What fields are collected, and can any record reasonably identify a person?
- Can the system combine user-entered information with a wearable, app or other source?
- Which parties can access, transmit, store or delete the information?
- What are the security controls, update process and incident-contact route?
- Who will investigate an incident and decide which notification rules apply?
Plan the response before an incident
Under the FTC’s explanation, covered vendors of personal health records and related entities may need to notify affected US individuals, the FTC and sometimes the media after a breach of unsecured, identifiable health information. The guidance describes different reporting timetables depending on the number of people affected. A third-party service provider has its own obligation to notify its covered client. These are conditional duties, not an assertion that every wellness assessment installation is covered. State laws and HIPAA relationships can require a separate analysis.
TUOKE perspective: A B2B buyer should ask for a written data-flow description alongside the model specification and operating manual. Our product category describes an equipment format, not a promise that any particular software workflow is HIPAA compliant, exempt from the FTC rule or approved for diagnosis. This article is procurement guidance, not legal advice; have qualified US privacy counsel assess the actual deployment.
Primary sources
- US FTC, announcement of Health Breach Notification Rule changes, 26 April 2024; reviewed 1 October 2026.
- US FTC, Complying with FTC’s Health Breach Notification Rule, July 2024 business guidance; reviewed 1 October 2026.
Related TUOKE equipment: wellness assessment.