🎧 Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.
To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).
Table of Contents
The campaign worked. That was the problem.
Coverage follows the product and its data flows
The enforcement cases are a warning about economics
The disclosure hides in the plumbing
Consent has to reach the code
A notification deadline is a data engineering problem
The product worth building has to stop the next disclosure
The investment case starts with customer acquisition math
Abstract
Consumer health companies can create reportable breaches through ordinary advertising workflows, including intentional disclosures that their customers never authorized. The Federal Trade Commission’s Health Breach Notification Rule makes that possibility commercially relevant for certain fertility, medication, fitness, mental health, and other consumer health products outside HIPAA. The resulting opportunity extends across software discovery, consent enforcement, vendor oversight, and incident response. But regulatory exposure alone does not establish a software market. The strongest businesses will connect legal requirements to actual data movement, preserve useful measurement, and demonstrate that their controls survive product changes without requiring an army of consultants.
The campaign worked. That was the problem.
Take a hypothetical fertility app whose growth team has finally figured out paid acquisition. Registrations are improving. The advertising platform is finding people who look like existing subscribers. A new integration sends conversion events back to the platform so its algorithm can distinguish somebody who opened a landing page from somebody who completed an assessment and bought a subscription. The engineering team approved the integration. Procurement approved the vendor. Nobody stole a password, exploited a vulnerability, or demanded payment in cryptocurrency. Unfortunately, the events also reveal sensitive health information linked to identifiable users, and those users never authorized that disclosure. The company may now have a breach notification problem because its marketing software did exactly what it was configured to do.
That possibility is explicit in the FTC’s Health Breach Notification Rule. For covered businesses and information, unauthorized disclosure can constitute a breach even when the disclosure is intentional and no outside attacker is involved. The amendments took effect July 29, 2024, and clarified the rule’s application to health apps and similar technologies. There is also a recent detail worth getting right: in September 2026, the FTC withdrew its 2021 policy statement addressing health apps and connected devices. The commission said that statement had been superseded by rulemaking. Withdrawing the statement did not repeal the amended rule. A compliance strategy built around that headline would be an unfortunate reading comprehension exercise.
For operators, the uncomfortable implication is that cybersecurity and privacy reviews can reach different conclusions about the same transaction. A security review might establish that data traveled through an authenticated, encrypted connection to an approved vendor. A privacy review still has to establish whether that vendor should have received those fields for that purpose. Both reviews can be competently performed, and the transaction can still fail the second one. That creates a plausible business opportunity for software that connects the two. It also explains why another annual questionnaire is unlikely to solve much. The important decisions happen when an engineer changes an event, a marketer activates a destination, or an agency uploads an audience. Those decisions need controls where the work actually happens.
