The U.S. Federal Trade Commission (FTC) finalized its overhaul of the health breach notification rule (HBNR), significantly expanding the types of software products subject to the agency’s oversight. However, the final rule was approved by the commission by a narrow 3-2 vote and was the subject of a scathing critique by the two dissenting commissioners, who argued that the FTC has once again exceeded its statutory authority in rewriting the HBNR.