Health Data vs Consumer-App Data: Who Is Covered by Privacy Law?

HIPAA covers specific organizations, not all health data

HIPAA (the US Health Insurance Portability and Accountability Act) is tied to the type of organization. The federal regulation defines a "covered entity" as a health plan, a health care clearinghouse, or a health care provider that sends health information electronically in certain standard transactions. [1] A "business associate" is a company that creates, receives, maintains or transmits protected health information on behalf of a covered entity for a regulated function. [1]

So the same app can be treated differently depending on the arrangement. An app that a hospital or health plan hires to manage its patients' data may fall under HIPAA as a business associate. A wellness app or wearable you download and use on your own is not itself on the covered-entity list. The FTC puts it plainly for consumers: unlike your doctor, health apps "may not be covered by health privacy laws like HIPAA." [2] Whether a particular product is covered depends on its relationships, so its privacy notice is the place to look.

The FTC fills part of the gap

For companies outside HIPAA, the FTC says the FTC Act's ban on unfair or deceptive practices applies to companies that collect, use or share health information that are not required to comply with HIPAA. [3] The FTC's Health Breach Notification Rule applies to certain businesses that are not covered by HIPAA and requires them to notify affected consumers, the FTC and, in some cases, the media. [3] In 2024 the FTC finalized changes to that rule, which covers vendors of personal health records and related entities not covered by HIPAA, and treats an unauthorized disclosure as a breach, not only a hack. [4]

This is a consumer-protection approach, not a health-data statute. It works mainly through enforcement actions after the fact. See third-party data sharing and data brokers for examples.

State and EU laws that reach wellness apps

Washington's law is enforced by the Attorney General and also through private lawsuits. [5] The California Attorney General lists rights to know, delete, opt out of sale or sharing, and limit use of sensitive information. [6]

What this means in practice

• Do not assume "health data" in an app means "HIPAA-protected." Look for who runs the app and whether a doctor, insurer or employer arranged it.
• Where you live matters, and so does where the company does business. Many apps are used across borders.
• Read the privacy notice itself. The FTC advises looking for one that explains in simple terms what health information the app collects. [2]
• Sharing a summary with a clinician is a separate step from the app's own storage; see discussing wearable data with a clinician.
• Employer or insurer programs have their own rules; see employer and insurer wellness programs.

Not verified here

We did not read the laws of the United Kingdom, Canada, Australia, Brazil or other countries, or the consumer health privacy laws of US states other than Washington and California. Do not assume they match. A national privacy regulator's own site is the place to check.