More than a decade ago, the Federal Trade Commission (FTC) promulgated a Health Breach Notification Rule (the Rule). The Rule requires certain businesses that access or collect consumers' identifying health information to notify affected consumers, the FTC and, in some cases, the media, in the event that there is a data security breach leading to the unauthorized access or sharing of consumer health information. Although the Rule has long been available to the FTC, the FTC has not actively enforced it.