Privacy and health information

Health and insurance details deserve care

Medical history, medications, care routines, and health-insurance documents can reveal sensitive information about you or someone you love. Information about payment for health care can also be health information. Other kinds of insurance do not automatically fall under the same rules.

Before adding another person’s information, consider their permission and who should be able to see it. Before sharing a binder, downloading a summary, or printing a copy, review what is included and where that copy will be kept.

Avoid putting passwords, security answers, full financial account numbers, or unnecessary identifiers into notes, questions, or documents. For optional AI tools, review the consent information before submitting sensitive details.

The FTC Health Breach Notification Rule

The Federal Trade Commission’s rule requires certain businesses offering personal health records, certain related entities, and their service providers to give notice after a qualifying breach of unsecured, identifiable health information.

A personal health record under the rule is an electronic record of qualifying identifiable health information that has the technical capacity to draw information from multiple sources and is managed, shared, and controlled by or primarily for the individual. Information entered by a person can count, and connected-source capabilities can matter even if a person does not use them.

Coverage depends on the business, its activities, information, and technical capabilities. Being outside HIPAA does not automatically mean the FTC rule applies. Storing health information alone does not settle the question, and this page does not make that determination for Love, Organized.

A breach can include an unauthorized disclosure

The rule is not limited to hacking. Acquisition of unsecured, identifiable health information without the individual’s authorization can include a company’s unauthorized disclosure. Unauthorized access is presumed to involve acquisition unless reliable evidence shows acquisition did not, or could not reasonably have, occurred.

“Unsecured” has a specific legal meaning tied to federal protection standards. A sign-in requirement alone does not answer whether information meets those standards.

When the rule requires notice

For a covered business and a qualifying breach, the rule generally requires the following notices. These are legal requirements explained for context, not promises about an incident-response process for this app.

Affected individuals

Notify affected U.S. citizens or residents without unreasonable delay and no later than 60 calendar days after discovery. This duty is not limited to breaches involving 500 people.

FTC, 500 or more affected individuals

Notify the FTC at the same time as affected individuals, without unreasonable delay and no later than 60 calendar days after discovery.

FTC, fewer than 500 affected individuals

Keep a breach log and report these breaches annually to the FTC within 60 calendar days after the end of the calendar year.

Media notice

If 500 or more residents of one state or jurisdiction are affected, or reasonably believed affected, notify prominent media serving that area without unreasonable delay and no later than 60 calendar days after discovery.

These are maximum time limits, not permission to wait unnecessarily. Discovery includes when a breach was known or would have been known through reasonable diligence. The rule also addresses service-provider notices and qualifying law-enforcement delays. Other laws may impose additional duties.

Read the official FTC compliance guidance and Health Breach Notification Rule for the full requirements.

Privacy questions or concerns

For questions about Love, Organized or suspected unauthorized access, contact info@loveorganized.online.

In your first message, describe the concern without including medical records, insurance cards, passwords, or full account numbers.