OMB control number
Health Breach Notification Rule
OMB 3084-0150 · FTC.
OMB 3084-0150
The Health Breach Notification Rule ("Rule"), 16 C.F.R. Part 318, requires vendors of personal health records ("PHR") and PHR related entities to provide: (1) notice to consumers whose unsecured personally identifiable health information has been breached; and (2) notice to the Commission. The Rule only applies to electronic health records and does not include recordkeeping requirements. The Rule requires third party service providers (i.e., those companies that provide services such as billing or data storage) to notify vendors of personal health records (PHR) and PHR related entities following the discovery of a breach; those entities in turn must provide notification to consumers and the Commission. To notify the FTC of a breach, the Commission developed a form for entities subject to the Rule to complete and return to the agency. The proposed amendments pertain to, among others: (1) the coverage of the rule—specifically, the rule’s coverage of developers of many health applications (“apps”) and PHR identifiable health information that is drawn from multiple sources; (2) methods of notice; and (3) the content of notice.
The latest form for Health Breach Notification Rule expires 2027-06-30 and is listed under ICR 202403-3084-001.
Latest Forms, Documents, and Supporting Material
| Document | Type |
|---|---|
 Form Not Applicable Notice for Health Applications (Non-Labor Costs for Breaches without Forensic Services) | Form and Instruction |
 Form Not Applicable Notice for Health Applications (Non-Labor Costs for Breaches that include Forensic Services) | Form and Instruction |
| Form Not Applicable Major Breaches | Form and Instruction |
| Form Not Applicable Single-person Breaches | Form and Instruction |
| HBNR_2024_Supporting Statement_Final .pdf | Supporting Statement A |
 Notice for Health Applications (Non-Labor Costs for Breaches without Forensic Services) |
Form and Instruction |
| Notice for Health Applications (Non-Labor Costs for Breaches that include Forensic Services) |
Form and Instruction |
| Major Breaches |
Form and Instruction |
| Single-person Breaches |
Form and Instruction |
All Historical Document Collections
| Reference | Filing | Received | Concluded | Action |
|---|---|---|---|---|
| 202403-3084-001 | Revision of a currently approved collection | 2024-05-30 | Approved without change | |
| 202305-3084-001 | Revision of a currently approved collection | 2023-06-09 | Comment filed on proposed rule and continue | |
| 202205-3084-001 | Extension without change of a currently approved collection | 2022-06-06 | Approved without change | |
| 201905-3084-001 | Extension without change of a currently approved collection | 2019-05-02 | Approved without change | |
| 201601-3084-001 | Extension without change of a currently approved collection | 2016-02-03 | Approved without change | |
| 201208-3084-004 | Extension without change of a currently approved collection | 2012-08-24 | Approved without change | |
| 200909-3084-002 | New collection (Request for a new OMB Control Number) | 2009-09-22 | Approved without change | |
| 200904-3084-002 | New collection (Request for a new OMB Control Number) | 2009-04-20 | Comment filed on proposed rule |
OMB Details
Single-person Breaches
Federal Enterprise Architecture: Economic Development - Business and Industry Development
| Form | Name | Electronic access | Type |
|---|---|---|---|
| Form Not Applicable | Notice of Breach of Health Information | Fillable Fileable | Form and instruction |
Review document collections for all forms, instructions, and supporting documents - including paper/printable forms.