A vendor of personal health records, an entity offering products or services through a PHR vendor's or a covered entity's website, or an entity that accesses information in a PHR, must, on discovering a breach of security of unsecured PHR identifiable health information, notify each affected U.S. citizen or resident and the Federal Trade Commission; a third-party service provider to such a vendor or entity notifies the vendor or entity and identifies the affected individuals. The timeliness, method and content rules of 13402(c) to (f) apply as the FTC specifies, the FTC notifies the Secretary, and a violation is an unfair or deceptive act under the FTC Act. The FTC's Health Breach Notification Rule (16 CFR Part 318, 2009, amended 2024) implements it; the section sunsets if Congress enacts a general breach notification law for non-covered entities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.