On September 15, 2021, the FTC issued a policy statement saying health apps and connected devices that collect consumers' health information were covered by its Health Breach Notification Rule, and that a breach was not limited to cybersecurity intrusions but could include sharing data without authorization. The statement followed the FTC's 2021 action against the Flo Health fertility app. In 2024 the FTC updated the rule itself to cover health apps, and on September 9, 2026 it rescinded the 2021 statement as unnecessary.
Behavioral health is built on confidence. A person who reaches out about anxiety, depression, trauma or substance use is trusting that their first click, first form and first phone call will stay private. In 2021, a federal regulator made clear that it was paying attention to whether digital health tools kept that promise.
On September 15, 2021, the Federal Trade Commission issued a policy statement about health apps and connected devices. The statement was aimed at consumer apps rather than traditional clinics, but its central idea, that sharing sensitive health data without permission can be treated as a breach, reached well beyond the app store.
This retrospective covers what the FTC said in 2021, why behavioral health practices took notice, how the story changed in 2024 and 2026 and what it means for a practice today. For later chapters, see our pieces on the 2022 HHS bulletin on tracking technologies and the FTC’s 2023 BetterHelp order.
What actually happened in 2021
January: the Flo Health case. The FTC announced that the developer of a popular fertility-tracking app had settled allegations that it misled consumers about how their health data would be used. The FTC alleged that Flo Health shared sensitive information with marketing and analytics companies, including Facebook and Google, despite promising to keep it private. The FTC finalized the order in June 2021.
September 15: the policy statement. The Commission issued its Statement on Breaches by Health Apps and Other Connected Devices. It said health apps and connected devices that collect or use consumers’ health information were covered by the Health Breach Notification Rule, a rule dating from 2009 that had rarely been discussed.
A broad view of a breach. The statement said a breach was not limited to cybersecurity intrusions or nefarious behavior. Incidents of unauthorized access, including sharing covered information without a person’s authorization, could trigger notification obligations.
The chair’s remarks. In remarks on the statement, then-Chair Lina Khan framed it as a response to the growth of apps collecting sensitive health data and to the limits of existing protections for that data.
Why it mattered for behavioral health practices
The Health Breach Notification Rule generally applies to organizations that are not covered by HIPAA, such as consumer health app makers. Most licensed behavioral health practices are HIPAA covered entities, so the rule was not aimed squarely at them. Even so, the statement mattered for three reasons.
First, many behavioral health practices rely on vendors that are not covered entities: scheduling tools, mental health apps, online assessments, chat widgets and marketing platforms. Some of those vendors were exactly the kind of company the FTC was describing.
Second, the idea that quietly sharing data with advertising companies can be a breach applies to practice websites too. A behavioral health site that sends page views from a substance use treatment page to an ad platform is sharing something very sensitive, whatever rule ultimately governs it.
Third, the statement signaled that regulators were willing to treat health data sharing as a serious matter. Within two years, the FTC brought its first Health Breach Notification Rule enforcement action, against GoodRx, and announced the BetterHelp order involving a mental health service.
What typical agencies did
Most agencies serving behavioral health practices did very little. The statement was about apps, the reasoning went, and practices were covered by HIPAA anyway. Tracking pixels stayed on intake pages, chat tools kept sending data to vendors and nobody mapped where information actually went.
Some agencies offered reassurance that the practice was compliant without having reviewed the site. That was not a responsible answer, because compliance depends on what each tool actually collects and shares.
The better response was to treat the statement as a prompt: review every tool that touches patient or prospective patient information, understand its data flows and remove anything that was not needed.
What it means for a behavioral health practice today
The 2021 statement is gone, but the expectation it described is now stronger than ever. These habits hold up.
1. Map your data flows
List each tool that collects patient or prospective patient information, from forms and chat to scheduling and analytics, and record where that data goes.
2. Clean up sensitive pages
Service pages for substance use, trauma or crisis care, plus intake forms and booking flows, should carry only scripts that are strictly necessary and reviewed for privacy.
3. Check every vendor
Confirm which vendors will sign a business associate agreement and which will not. A tool that will not sign one should not touch protected health information.
4. Say what you do, and do what you say
The Flo Health case was about promises. Make sure the privacy policy accurately describes the practice’s real data practices.
5. Measure without exposing patients
Count inquiries and intakes in the practice’s own systems rather than relying on third-party tracking on sensitive pages.
6. Get qualified advice
HIPAA, the FTC Act, state privacy laws and the updated Health Breach Notification Rule interact in complex ways. A practice should rely on qualified legal counsel, not marketing assumptions.
What changed in 2024 and 2026
The 2021 statement was always an interpretation of an existing rule. In 2024, the FTC updated the Health Breach Notification Rule itself, clarifying that it covers health apps and similar technologies. On September 9, 2026, the FTC announced that it had rescinded the 2021 policy statement, saying the 2024 rule update had already brought health apps and connected devices like fitness trackers within the rule and that the statement was therefore unnecessary.
For practices, the rescission does not signal a relaxation. The underlying obligations now sit in the rule itself rather than in a policy statement, and the broader regulatory attention on health data has continued at the federal and state level.
Why behavioral health data is different
Information about mental health and substance use carries particular weight. Federal rules governing substance use disorder treatment records have long been stricter than general health privacy rules, and stigma remains real for many people. A prospective patient who discovers that their search for help was shared with an advertising company may lose trust not only in that practice but in seeking care at all.
That is why the marketing standard for this specialty has to be higher than for most. The aim is to make care easy to find and easy to start while sharing as little as possible about the person who is looking.
The intake path is the most sensitive page you own
The intake form, the screening questionnaire and the scheduling flow collect the most sensitive information on a behavioral health website. They are also the pages most likely to have tracking attached, because marketers want to count conversions. A practice should know exactly what runs on those pages and why.
A clean intake path does not have to sacrifice measurement. The practice can record each completed intake and its source in its own systems, then report counts and trends without sending details to third parties.
Marketing that respects the reader
Good behavioral health marketing reads like care. It explains services clearly, describes what the first appointment is like, introduces clinicians and their approaches and offers a simple way to reach out. It avoids fear-based messaging and does not promise outcomes.
That kind of content does not depend on tracking. People find it through search, referrals and word of mouth, and it persuades them because it is honest and specific. It is also more durable than any campaign that depends on a targeting technique regulators may restrict.
Crisis content deserves special care
Many behavioral health websites include pages about crisis support. Those pages should point clearly to emergency resources and to the 988 Suicide and Crisis Lifeline, and they should never carry advertising tracking. The person reading them may be in a fragile moment, and the page’s only job is to help.
A simple checklist for leadership
A practice owner does not need to become a privacy engineer, but they should be able to answer a few questions. Which third-party tools run on our website, and on which pages? Which of those tools receive information about people who visit our substance use, trauma or intake pages? Which vendors have signed business associate agreements, and which have not? Does our privacy policy match what our website and tools actually do? Who reviews this, and how often?
Writing down the answers once a year, and whenever a new tool is added, turns an abstract compliance worry into a routine that leadership can see and manage.
Vendors that promise to be privacy-ready
Behavioral health practices are offered a steady stream of tools that describe themselves as secure or compliant: chat widgets, online screening tools, reminder systems, call tracking and analytics. Those labels are a starting point, not an answer. The practice still needs to know what data the tool collects, where it is stored, who can access it, whether the vendor will sign a business associate agreement and whether any of it is used for the vendor’s own advertising or product development.
A short written review of each new tool before it goes live, kept on file, is one of the simplest protections a practice can have. It also makes the annual leadership review faster, because the answers are already recorded.
Explaining privacy to prospective patients
Privacy can also be part of how a practice welcomes people. A brief, plain-language note near the intake form, explaining what information is collected and how it is protected, reassures someone who is nervous about reaching out. It should be accurate and specific rather than a generic promise, and it should match the full privacy policy.
What 2021 does not tell us
The 2021 statement did not clarify every question about which organizations the rule covered, and it did not itself bring an enforcement action. There is no reliable public data on how many behavioral health practices changed their websites or vendor arrangements in response. What 2021 does show is that federal regulators had started to treat the quiet sharing of health data with advertisers as a breach of trust, and that practices which acted early were better prepared for the guidance and enforcement that followed.
The premium practice advantage
A premium behavioral health practice earns trust through clinical quality, clear communication and real respect for privacy. The work is making care easy to find and start without exposing the people who seek it. See our behavioral health services, our custom websites, our booking engine, our full services and who we help. Our team works from Austin with practices nationwide.
The bottom line
The FTC’s September 2021 policy statement told health apps that sharing sensitive data without permission could be a breach. The statement was rescinded in 2026 because the 2024 rule update had absorbed it, but the lesson for behavioral health practices endures: know where patient data goes, keep tracking off sensitive pages and measure growth without exposing the people you serve.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Frequently asked questions
What did the FTC say in September 2021?
The FTC said health apps and connected devices that collect or use consumers' health information must comply with the Health Breach Notification Rule, and that a breach could include unauthorized disclosure of data, not only a hack.
What is the Health Breach Notification Rule?
It is an FTC rule that requires vendors of personal health records and related entities that are not covered by HIPAA to notify consumers, the FTC and in some cases the media after a breach of unsecured identifiable health information.
Is the 2021 policy statement still in effect?
No. On September 9, 2026 the FTC rescinded the 2021 statement, saying its 2024 update to the Health Breach Notification Rule already covers health apps and connected devices.
How did the Flo Health case relate?
In 2021 the FTC finalized an order with Flo Health over allegations that the fertility-tracking app shared sensitive health data with third parties such as Facebook and Google despite promising privacy.
Why does this matter to behavioral health practices?
Behavioral health information is among the most sensitive data a person has. Practices that use apps, portals, online assessments or tracking tools need to know where that data goes.
What should a behavioral health practice do today?
Map every tool that touches patient or prospective patient data, remove unnecessary tracking from sensitive pages and forms, and get qualified legal advice on HIPAA and FTC obligations.