法规简介
2026年9月9日，美国联邦贸易委员会（FTC）发布《撤销政策声明》（Rescission of Policy Statement），正式废止其2021年9月15日发布的《关于健康应用及其他联网设备数据泄露的委员会声明》（Statement of the Commission On Breaches by Health Apps and Other Connected Devices）。这是美国健康数据合规领域一次重要的监管口径回调，直接影响出海美国的健康类App、可穿戴设备与远程医疗平台。
一、撤销的四项理由。FTC在声明中逐一列明，且强调"每一项理由本身均足以独立支持"撤销决定：①该政策声明"自发布时即具争议性"（contentious at the time of issuance）——发布当日即有Phillips、Wilson两位委员分别发表反对声明，质疑其将《健康泄露通知规则》（Health Breach Notification Rule, HBNR）扩张适用于健康App与联网设备缺乏法律依据；②该声明"收效甚微且已被规则制定所取代"（superseded by rulemaking）——FTC已于2024年通过正式规则制定程序更新HBNR，（89 Fed. Reg. 47028, 2024年5月30日）将健康App、健身追踪器等联网设备明确纳入规则适用范围，原政策声明的解释功能因此被正式规则吸收；③撤销符合总统特朗普的放松管制议程，包括第14192号"通过放松管制释放繁荣"行政令（90 Fed. Reg. 9065）等；④符合FTC"避免不必要使用次级监管指引"（avoiding unnecessary use of subregulatory guidance）的内部政策。
二、FTC对执法立场的表态。声明开篇即强调，"保护美国人敏感健康信息的隐私仍是委员会的首要任务"（a top priority of the Commission），并援引2026年7月29日FTC联合各州起诉远程医疗平台Hims & Hers的新闻稿，表明撤销指引并不等于放松健康隐私执法。
三、关于信赖利益的处理。FTC明确表示，"当事人理解指引通常既不创设实体权利，也不产生约束性义务"（guidance generally creates neither substantive rights nor binding obligations），因此上述理由单独及合并考量，均超过当事人可能存在的任何信赖利益。
四、实务意义。需要特别提示的是，本次撤销**并不豁免**健康App与联网设备的泄露通知义务——该义务自2024年HBNR修订后已上升为正式规则（CFR层面的立法），约束力反而强于政策声明。对中国出海美国的健康类应用与设备企业而言，合规基准应从FTC政策声明转向HBNR规则文本本身；同时应关注FTC在Hims & Hers案中所主张的"向广告平台共享敏感健康信息"这一执法重点并未因撤销而弱化。该撤销亦是美国行政机关清理"次级监管指引"整体行动的一部分，后续或有更多FTC指引被清理。
【说明】以下为美国联邦贸易委员会《撤销政策声明》（2026年9月9日）正文（原文，PDF 文字层完整提取）。
官方页面：https://www.ftc.gov/news-events/news/press-releases/2026/09/ftc-withdraws-obsolete-policy-statement
提取范围：全 1 页。如需引用，请以官方原文为准。
UNITED STATES OF AMERICA
Federal Trade Commission
WASHINGTON, D.C. 20580
Rescission of Policy Statement
The Federal Trade Commission today rescinds the Statement of the Commission On
Breaches by Health Apps and Other Connected Devices (Sep. 15, 2021). Protecting the privacy of
Americans’ sensitive health information remains a top priority of the Commission.1 However, the
Commission has determined that the statement—contentious at the time of issuance 2—provided
minimal benefit and has been superseded by rulemaking.3 Withdrawing the statement will
also advance President Trump’s deregulatory agenda4 and the Commission’s policy of
avoiding unnecessary use of subregulatory guidance. Each of these reasons is independently
sufficient to support the Commission’s decision to rescind this policy statement. Parties
understand that guidance generally creates neither substantive rights nor binding
obligations. Thus, the aforementioned reasons, alone and together, outweigh any reliance
interests parties may have.
1 See, e.g., Press Release, FTC and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices
(Jul. 29, 2026), https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-
deceptive-unlawful-privacy-practices.
2 See, e.g., Dissenting Statement of Comm’r Noah Joshua Phillips Regarding the Policy Statement on Breaches by
Health Apps and Other Connected Devices (Sep. 15, 2021),
https://www.ftc.gov/system/files/documents/public_statements/1596328/hbnr_dissent_final_formatted.pdf;
Dissenting Statement of Comm’r Christine S. Wilson, Policy Statement on Breaches by Health Apps and Other
Connected Devices (Sep. 15, 2021),
https://www.ftc.gov/system/files/documents/public_statements/1596356/wilson_health_apps_policy_statement_diss
ent_combined_final.pdf.
3 See Health Breach Notification Rule, 89 Fed. Reg. 47028 (May 30, 2024).
4 See, e.g., Exec. Order No. 14192, Unleashing Prosperity Through Deregulation §§ 1, 5, 90 Fed. Reg. 9065 (Jan. 31,
2025); see generally Exec. Order No. 14267, Reducing Anti-Competitive Regulatory Barriers § 1, 90 Fed. Reg.
15629 (Apr. 15, 2025); Exec. Order No. 14219, Ensuring Lawful Governance and Implementing the President’s
“Department of Government Efficiency” Deregulatory Initiative §§ 1-2, 90 Fed. Reg. 10583 (Feb. 25, 2025).
