Is Your Health App Covered by HIPAA? Probably Not

You log your sleep, your heart rate, your cycle and your mood. Maybe you’ve chatted with a therapy app or uploaded a lab result. Somewhere in the back of your mind, you assume HIPAA protects all of it.

For most consumer health apps, that assumption is wrong. HIPAA is a narrow law that follows who holds your data, not what kind of data it is. The same blood pressure reading can be protected in your doctor’s patient portal and unprotected in a fitness app you downloaded yourself.

This guide explains which apps HIPAA actually covers, what other rules fill the gap, and the practical steps to protect your health data. This is general information, not legal advice.

What HIPAA actually covers

HIPAA’s privacy and security rules apply to 3 kinds of “covered entities”:

• Health plans, such as insurers, HMOs, employer group health plans, Medicare and Medicaid
• Healthcare providers who conduct certain standard electronic transactions, such as billing insurance (this includes most doctors, hospitals, clinics, pharmacies and therapists who take insurance)
• Healthcare clearinghouses, which process billing data between providers and plans

HIPAA also applies to business associates: companies that handle protected health information on behalf of a covered entity, like a billing company, a cloud host or an app developer building a patient tool for a hospital.

Anyone else, including most app makers, isn’t covered by HIPAA just because they handle health information. That’s the core point HHS’s Office for Civil Rights makes in its guidance for app developers: the question is whether the app creates, receives, maintains or transmits protected health information for a covered entity.

Which health apps are and aren’t covered

Here’s how common app types usually fall. The details of a specific app’s contracts matter, so use this as a guide, not a ruling.

That last row surprises many people. Under HIPAA’s right of access, you can tell your provider to send your records to an app you choose. HHS’s guidance says that once the app receives the data, and the app isn’t a covered entity or business associate, HIPAA no longer protects it. The provider isn’t responsible for what the app does next.

Key takeaway: HIPAA follows the organization, not the data. If the app belongs to your doctor, hospital or insurer, it’s probably covered. If you downloaded it from an app store on your own, assume it isn’t, and read its privacy policy.

What protects you when HIPAA doesn’t

HIPAA isn’t the only rule. 3 other layers apply to many consumer health apps.

The FTC Health Breach Notification Rule

The Federal Trade Commission’s Health Breach Notification Rule covers vendors of personal health records and related companies that aren’t covered by HIPAA. The FTC voted to update the rule on April 26, 2024, and the changes took effect on July 29, 2024. The update made clear the rule covers many health apps and similar technologies.

Two points matter for consumers:

• A “breach” includes unauthorized disclosure, not just hacking. Sharing your health data with advertisers without your authorization can count.
• Companies must notify affected people without unreasonable delay and within 60 calendar days of discovering a breach. If 500 or more people are affected, they must also notify the FTC, and media outlets if 500 or more residents of a state are involved.

The FTC Act

The FTC also uses its general power against unfair or deceptive practices. In 2023 it took action against GoodRx, its first enforcement under the Health Breach Notification Rule, over sharing health information with advertising platforms. The same year it finalized an order against online counseling company BetterHelp, which required $7.8 million for consumer refunds and banned sharing health data for advertising. Both companies did not admit wrongdoing.

State consumer health data laws

Several states now regulate health data that HIPAA doesn’t reach:

• Washington’s My Health My Data Act took effect March 31, 2024 for most businesses (June 30, 2024 for small businesses). It requires consent to collect and share consumer health data, bans selling it without the consumer’s valid authorization, and can be enforced by the state attorney general and through private lawsuits.
• Nevada’s SB 370 also took effect March 31, 2024. It’s modeled on Washington’s law but has no private right of action.
• Connecticut added consumer health data protections to its privacy law in 2023.
• Many state comprehensive privacy laws treat health data as sensitive data that needs opt-in consent. Our US state data privacy laws guide explains how those laws work.

New York lawmakers have also been working on a broader health information privacy bill, so check its current status if you live there.

Why it matters: what apps can do with your data

If an app isn’t covered by HIPAA, its own privacy policy and terms of service largely set the rules, within the limits of FTC and state law. Depending on the app, that can include:

• Sharing data with analytics and advertising partners
• Using “de-identified” or aggregated data for research or product development
• Selling or transferring data if the company is acquired or goes bankrupt
• Keeping data after you delete the app, unless you request deletion

None of this is automatically illegal. But it’s very different from the HIPAA rules your doctor follows. Advertising pixels and software development kits (SDKs) inside apps have been at the center of several FTC cases, because they can send event data, like “booked a therapy session,” to ad platforms.

How to check any health app in 10 minutes

Use this checklist before you trust an app with sensitive data:

1. Find out who offers it. Did your provider or insurer give you the app, or did you find it yourself? Provider- and plan-issued apps are more likely to be covered.
2. Search the privacy policy for “HIPAA.” If the company says it’s a covered entity or business associate, look for a Notice of Privacy Practices. If it says HIPAA doesn’t apply, believe it.
3. Search for “sell,” “share,” “advertising” and “third parties.” Note whether health data is shared for targeted ads.
4. Check for a consumer health data policy. Companies subject to Washington’s law must publish one.
5. Look for deletion and export options. Can you delete your account and data from inside the app?
6. Review app permissions on your phone. Turn off location, contacts and microphone access the app doesn’t need.
7. Check security basics. Look for two-factor sign-in and clear statements about encryption. Our explainer on what encryption is covers what to look for.
8. Opt out of tracking using your phone’s privacy settings and any in-app ad choices.

Where to start: 5 steps to protect your health data today

1. List your health apps. Include fitness, sleep, cycle, mental health, nutrition and any apps linked to your patient portal.
2. Delete the ones you don’t use. Then request deletion of your data through the app or the company’s privacy page; uninstalling alone usually doesn’t delete it.
3. Keep the most sensitive information in covered apps. Use your provider’s patient portal for messages about diagnoses, medications and test results.
4. Limit what you link. Before connecting a third-party app to your health records, remember HIPAA stops protecting that copy.
5. Use your state rights. If you live in a state with a privacy law, you may be able to request access, correction or deletion and opt out of targeted advertising.

If you think an app exposed your information, our guide on what to do after a health data breach walks through the next steps.

What this means for health app builders

If you build health apps, the coverage question decides your obligations. Building for a hospital, clinic or health plan usually makes you a business associate with HIPAA duties, a signed business associate agreement, and security rule requirements. Selling directly to consumers usually puts you under the FTC rule and state health data laws instead, which can require consent before sharing data and breach notices that include unauthorized sharing. Our guide to HIPAA compliance for software covers the developer side in more depth.

Conclusion

HIPAA protects your health data when it’s held by your doctor, hospital, insurer and the companies working for them. It usually doesn’t protect the fitness, cycle, mood or wellness apps you choose on your own. The FTC’s Health Breach Notification Rule and a growing set of state laws fill part of that gap, but the app’s privacy policy still matters most. Check who offers each app, read what it shares, and keep your most sensitive health conversations in covered tools such as your patient portal or a provider’s online therapy service.

Sources

• HHS: Access right, health apps and APIs — data sent to an app at a patient’s direction leaves HIPAA protection
• FTC: Collecting, using or sharing consumer health information? Look to HIPAA, the FTC Act and the Health Breach Notification Rule — how HIPAA and FTC rules divide coverage
• FTC: Complying with the Health Breach Notification Rule — 60-day notice and 500-person FTC and media thresholds
• FTC: Updated Health Breach Notification Rule for health apps — 2024 update covering health apps and devices
• Washington State Office of the Attorney General: My Health My Data Act — consumer health data rights and effective dates