16 CFR 318.7-318.9 enforcement + coordination + status. ENFORCEMENT AUTHORITY (318.7): the FTC enforces the HBNR + may impose civil penalties up to USD 51,744 PER VIOLATION (2025 figure - adjusted annually for inflation per the Federal Civil Penalties Inflation Adjustment Act); each affected individual + each day of continuing violation can be a separate violation. NO PRIVATE RIGHT OF ACTION: HBNR does not create a private right of action + but consumers may file complaints with the FTC + state attorneys general + or state consumer protection authorities. HIPAA COORDINATION (318.8): entities subject to HIPAA Breach Notification Rule (45 CFR Subpart D) are NOT subject to HBNR; entities may be SUBJECT TO BOTH if they operate both HIPAA-covered + non-HIPAA-covered activities (e.g. a healthcare provider also offering consumer-facing health app); HIPAA notification preempts HBNR notification for HIPAA-covered data + activities. STATE LAW COORDINATION: HBNR does NOT PREEMPT state law - state breach notification laws (all 50 states + DC + territories) + state consumer protection acts + state-specific health data laws (My Health My Data Act Washington + Connecticut + Nevada + others) may also apply + impose ADDITIONAL or DIFFERENT obligations; the institution must comply with the most stringent applicable law. EFFECTIVE DATE (318.9): 2024 Final Rule effective 29 July 2024 + with delayed elements 25 April 2025; original rule in force since 2009; revisions consultation periods + implementation deadlines published in the Federal Register.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.