The Federal Trade Commission has rescinded a Biden-era policy statement that had expanded expectations around breach notifications for certain health apps and connected-device providers. The move is part of a broader agency push toward regulatory streamlining, but it also sends a clear signal to the digital-health market: the FTC may be narrowing how aggressively it interprets and enforces health-data breach obligations outside traditional healthcare settings.

At issue is the FTC’s approach to the Health Breach Notification Rule, which applies to certain vendors of personal health records and related entities not covered by HIPAA.

The Federal Trade Commission has given final approval to its order against Illuminate Education, closing out a closely watched enforcement action arising from a data breach that exposed information tied to roughly 10.1 million students. For education companies and the schools that rely on them, the case is a sharp reminder that student-data security is now firmly in regulators’ crosshairs.

According to the FTC, Illuminate failed to reasonably secure sensitive student information, resulting in a breach with sweeping impact.