Health Data Privacy in Emerging Technologies

Who HIPAA covers

In the HIPAA regulations, a "covered entity" is a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in certain transactions. [1] A company that is none of these, such as a consumer wellness app you download yourself, is not a covered entity under that definition. The FTC rule itself separates HIPAA-covered entities and their business associates from other vendors of health records. [2] We could not read the HHS app guidance this session (the site refused automated access), so this page does not describe HHS's worked examples.

The FTC Health Breach Notification Rule

The FTC's rule (16 CFR Part 318, current text read 2026-10-22) covers "vendors of personal health records" that are not HIPAA-covered entities or their business associates. [2] Its definition of health care services or supplies includes any online service such as a website, mobile application or internet-connected device that provides mechanisms to track diseases and many other health topics. [2] A breach of security is the acquisition of covered information without the individual's authorization. [2] Notices to individuals must go out without unreasonable delay and no later than 60 calendar days after the breach is discovered. [2]

What the FTC has done

• GoodRx (February 1, 2023): the FTC said it took enforcement action for the first time under this rule. [3] It alleged the company shared sensitive personal health information with advertising companies, and announced an agreement to a $1.5 million civil penalty. [3] These are the FTC's allegations and settlement terms announced with the action, not independent findings.
• 1Health.io, a genetic testing company (June 16, 2023): the FTC announced its first case focused on both the privacy and security of genetic information. [4] Its allegations mention nearly 2,400 consumer health reports and the raw genetic data of at least 227 consumers, and say the company retroactively expanded the types of third parties it could share consumers' data with. [4]

The FTC also states that its health products guidance applies the same advertising principles to health equipment, diagnostic tests and health-related apps. [5] That concerns what companies may claim, not how they handle your data.

Outside the United States: the European Union

The European Data Protection Board's guide for small businesses says that data concerning health and genetic data are special categories of "sensitive data." [6] Processing sensitive data is generally prohibited, except in specific cases such as explicit consent. [6] We did not read the full regulation text this session, and national laws add detail. Other countries were not verified.

Why genetic and "omics" data are different

The National Human Genome Research Institute points out that each person's DNA sequence is unique, so a DNA sample can never be truly anonymized. [7] It cites a 2013 study in which research participants were re-identified using genomic data paired with genealogical databases and public records. [7] It also says direct-to-consumer genetic tests have limited regulation. [7] For the legal detail see genetic privacy law overview.

Questions worth asking about any app, tracker or test

• Is this organization a health care provider or plan, or a consumer company? That changes which rules apply. [1]
• Who else receives the data, and for what purposes, for example advertising? The FTC's GoodRx action concerned sharing health data for advertising. [3]
• Can I delete my data, and how? Compare the company's promises with its privacy policy, and note whether the policy has changed. The FTC's 1Health.io case included an allegation about a retroactive policy change. [4]

Related guides

Device-by-device privacy is covered in digital health data privacy, and consumer trackers in wearables and health trackers. Test-specific questions are in direct-to-consumer genetic tests. See also regulatory status of digital health products.