The Federal Trade Commission has rescinded a Biden-era policy statement that had expanded expectations around breach notifications for certain health apps and connected-device providers. The move is part of a broader agency push toward regulatory streamlining, but it also sends a clear signal to the digital-health market: the FTC may be narrowing how aggressively it interprets and enforces health-data breach obligations outside traditional healthcare settings.

At issue is the FTC’s approach to the Health Breach Notification Rule, which applies to certain vendors of personal health records and related entities not covered by HIPAA.