Proposed changes unveiled this week by the Federal Trade Commission to its health breach rule have many advocates agreeing that personal health data needs stronger protections even as some question whether the agency has the legal authority to enact its proposal.

Commissioners voted unanimously Thursday for a rule-making codifying an earlier policy change made in 2021 that expanded the scope of a previously obscure and unused rule governing data breach notification requirements for personal health data (see: FTC Makes Moves to Enhance Data Privacy Oversight).