You log a night of bad sleep in a wearable app. You enter a late period in a cycle tracker. You tell a supplement app that you’ve been taking magnesium for leg cramps. Three ordinary acts, three pieces of health information, and almost none of it is protected by the law most Americans assume protects it.
HIPAA is the most misunderstood acronym in US health care. People invoke it at airports and in office arguments. What it does is regulate a defined set of organizations: health plans, health care clearinghouses, and most health care providers, plus the companies that handle data on their behalf. If a business isn’t on that list, HIPAA has nothing to say about what it does with your health data.
The scale of what sits outside HIPAA is not theoretical. In February 2023, the Federal Trade Commission announced a $1.5 million civil penalty against GoodRx, a prescription discount and telehealth company that the FTC said had served more than 55 million consumers since January 2017. The FTC alleged the company shared users’ prescription medications and health conditions with Facebook, Google and other firms, and that in August 2019 it uploaded lists of people who had bought drugs for conditions including heart disease and high blood pressure, along with their email addresses and phone numbers, to Facebook for targeted advertising.
That case was brought under a rule most people have never heard of. Understanding which law applies to which company is the whole game, and it’s more learnable than it sounds.
What HIPAA covers
The Department of Health and Human Services defines three categories of “covered entities.”
Health plans include insurers, HMOs, employer health plans, and government programs that pay for care such as Medicare and Medicaid. Health care providers are covered when they conduct certain business electronically, which covers most of them: doctors, hospitals, clinics, dentists, pharmacies, psychologists, chiropractors and nursing homes. Health care clearinghouses are the behind-the-scenes companies that convert health data between formats.
Then there are business associates. These are outside companies doing work that involves your protected health information for a covered entity, and HHS gives examples: billing and claims processing firms, outside lawyers and accountants, IT contractors, and companies that store or destroy medical records. Covered entities must have contracts with them, and those business associates must have similar contracts with their own subcontractors.
Inside that perimeter, you get real rights. HHS says you can see and get a copy of your records, ask for corrections, receive a notice explaining how your information may be used, require permission before your data is used for certain purposes such as marketing, request restrictions on how it’s shared, get an accounting of certain disclosures, and file a complaint. Getting and organizing those records is its own skill, and it’s worth doing well.
The perimeter is the point. Rights that strong, applied that narrowly, create a sharp edge.
The places HIPAA never reaches
HHS is direct about this. Its consumer guidance lists organizations that hold health information and are not required to follow HIPAA: life insurers, employers, workers’ compensation carriers, most schools and school districts, many state agencies such as child protective services, most law enforcement agencies and many municipal offices.
Employers are the example people get wrong most often. According to HHS, “The Privacy Rule does not protect your employment records, even if the information in those records is health-related.” Your doctor still can’t hand your chart to your boss without your authorization, unless another law requires it. But the sick note sitting in your personnel file is not HIPAA-protected information.
Now notice what HHS’s list doesn’t mention: apps. The consumer guidance doesn’t address them at all, in either direction. That silence is the gap, and it’s where most of a modern health-conscious person’s data lives.
The general rule is simple to state. If your doctor’s office or health plan offers the app, or hired the company that built it, HIPAA likely follows the data. If you downloaded it yourself from a store and the company has no relationship with your provider, it generally doesn’t.
The FTC publishes a Mobile Health Apps Interactive Tool, developed with HHS, the FDA and the federal health IT office, that walks developers through the same logic. It turns on two questions: who holds the information, and whether that holder is a covered entity or a business associate working for one. Apps offered by neither generally fall outside HIPAA.
The FTC rule that picks up where HIPAA stops
The law that reaches those apps is the Federal Trade Commission’s Health Breach Notification Rule, codified at 16 CFR Part 318.
It applies to vendors of personal health records, to related entities, and to their service providers. The FTC’s business guidance defines a personal health record as an electronic record of identifiable health information that has the technical capacity to draw information from multiple sources and is managed or controlled by or primarily for the individual. Businesses already covered by HIPAA are excluded, because they answer to the HHS breach rule instead.
That “multiple sources” test is broader than it sounds, and the FTC’s own examples show why. A fitness app that can sync with a tracker likely counts, even if a given user never connects one. A diet app that lets you log weights and pulls calorie data from restaurant menus likely counts. A company that makes a fitness tracker and sends identifiable health information to health apps is likely a related entity. Connected blood pressure cuffs come up as an example too.
The rule’s core requirement is notification. A covered company must tell affected individuals without unreasonable delay and within 60 calendar days of discovering a breach of unsecured information. It must notify the FTC, at the same time as individuals when 500 or more people are affected, and within 60 days after the end of the calendar year for smaller breaches. When 500 or more residents of a single state or territory are involved, it must also notify prominent local media. The notice has to describe what happened, what kinds of information were involved, and what people can do about it.
Two timeline points matter. In September 2021, the FTC issued a policy statement warning health app and connected device makers that the rule applied to them, and it specifically named apps tracking glucose, heart health, fertility and sleep, along with wearable fitness trackers. Then in April 2024 the FTC announced amendments that took effect on July 29, 2024. The agency’s business guidance says those amendments underscore the rule’s application to most health apps and similar technologies.
This is the part that reframes the whole subject. A “breach” under this rule is not only a hacker stealing a database. It covers disclosure or acquisition of health data without the consumer’s authorization. A company that shares your data with an advertising network can be in breach of the rule without anyone ever breaking in. The FTC’s business guidance currently puts penalties at up to $51,744 per violation.
What the enforcement cases show
The GoodRx action in February 2023 was the FTC’s first enforcement case under the rule. Beyond the penalty, the proposed order permanently barred the company from sharing user health data with certain third parties for advertising, required affirmative express consent for other sharing, banned manipulative interface designs used to extract that consent, required the company to direct third parties to delete data already shared, and required a publicly posted data retention schedule. The FTC also alleged the company had displayed a seal that falsely suggested HIPAA compliance.
Three months later, in May 2023, the FTC filed a complaint against Easy Healthcare Corporation, maker of the Premom fertility app. The agency alleged the company shared users’ sensitive health information with third parties, including two firms based in China, and disclosed data to the analytics company AppsFlyer and to Google without telling users. The parties filed a stipulated order for a permanent injunction and civil penalty judgment, and the FTC said the proposed order would bar the company from sharing health data for advertising.
Genetic data has drawn attention too. In a case against 1Health.io, which did business as Vitagene, the FTC filed a complaint in June 2023 and issued a final order that September. The agency alleged the genetic testing company left sensitive genetic and health data unsecured, misled consumers about their ability to have data deleted, and changed its privacy policy retroactively without adequately notifying people whose data it had already collected. In September 2024 the FTC announced refunds to consumers.
A pattern runs through all three: the harm wasn’t a break-in. It was ordinary business practice that users had no reason to expect.
Where your natural health data goes
If you use complementary approaches, track your cycle, sleep with a ring on your finger or log supplements, you’re generating an unusually detailed stream of information. Research on what happens to it is not reassuring.
A 2022 scoping review in JMIR mHealth and uHealth examined 23 of the most popular women’s mobile health apps on the international Apple and Google stores. All 23 collected personal health-related data, and all allowed behavioral tracking. Fourteen allowed location tracking. Only 16 displayed a privacy policy at all, only 12 requested consent from users, and three collected data before obtaining consent. Twenty of the 23 shared user data with third parties, and only 13 told users anything about data security.
Even when a policy exists, reading it is a project. A 2020 analysis in Health Promotion Practice by researchers at the University of Houston Law Center and Baylor College of Medicine reviewed the terms of service and privacy policies of 15 popular menstruation-tracking apps. The authors found that information about data-sharing practices and accuracy was often neither easy to find nor easy to understand, and noted that no regulatory body oversees or approves the vast majority of menstruation trackers.
The ambiguity is not unique to the US market. A 2024 analysis in Asian Bioethics Review identified 46 apps in European and Canadian markets that either openly collect health data for research or algorithm training or retain the legal and technical ability to do so. The authors reported that the overwhelming majority of the privacy policies they examined contained ambiguous or contradictory language about sharing user data with third parties.
Pharmacy loyalty programs and retailer wellness clubs deserve a mention here as well. The purchase history attached to your membership number is not a medical record, which is precisely the problem: it’s commercial data about health behavior, held by a company whose core business is selling you things.
Genetic tests, GINA, and the insurance gap
Direct-to-consumer genetic tests sit at the sharpest point of this whole subject, because the data is permanent and partly describes your relatives.
The Genetic Information Nondiscrimination Act is real protection, and it’s narrower than its name suggests. According to the FDA, GINA stops health insurers from using genetic information in coverage and rating decisions, and bars employers with 15 or more employees from using it in hiring, firing and promotion decisions. The FDA also states that GINA does not cover certain other types of insurance, and warns that a result may affect your purchase of life, disability and long-term care insurance. The FDA page carrying that guidance is dated December 20, 2019, so confirm the current details before you make a decision that turns on them.
Worth saying plainly: the FDA’s consumer page on these tests discusses accuracy, counseling and clinical limits, and does not address the privacy or security of the genetic data itself. The agency’s advice is to talk results over with a genetic counselor, a board-certified medical geneticist or a comparable provider, and not to treat a result as the sole basis for a medical decision. That’s the right moment to bring in a professional, especially before you change a medication, start an aggressive supplement regimen or skip a recommended screening because a report looked clean.
Before you spit in a tube, ask the company two questions in writing: what happens to the physical sample after testing, and whether deleting your account deletes the raw data and the results derived from it. The Vitagene case exists because those answers can change.
Questions to ask before you hand over health data
This is a five-minute screen, not a research project. Run it before you create an account.
1. Who’s on the other end? Did my doctor’s office, hospital or health plan give me this tool, or did I download it myself? That one answer usually tells you whether HIPAA is in play.
2. What does the policy say about advertising specifically? Skip to the sharing section and search for “advertis,” “partners” and “affiliates.” Vague language about improving your experience is doing work.
3. Does deletion delete? Look for whether closing your account removes data already sent to other companies, not just the copy on their servers.
4. What’s the least I can enter and still get value? A sleep tracker doesn’t need your medication list. A supplement app doesn’t need your location.
5. What would it cost me if this were public? Fertility status, mental health, substance use and HIV status carry real-world consequences. Information you’d never post publicly deserves a higher bar before you type it into a free app.
One more habit, recommended by the federal health IT office: password-protect the devices where health information sits, and read both the privacy policy and the terms of service for any site where you store it.
Where to complain, and what’s worth doing first
Route matters, because the two agencies cover different companies.
If a doctor, hospital, pharmacy or health plan mishandles your information or refuses you access to your records, file with the HHS Office for Civil Rights. If a company outside HIPAA shares your data in a way that contradicts its own privacy policy, that’s the FTC’s territory, and the federal health IT office says to file there. Companies covered by the Health Breach Notification Rule also report breaches to the FTC directly.
There’s one situation that calls for fast action rather than a complaint form. If you get an explanation of benefits for care you never received, a collections notice from a provider you’ve never seen, or a denial because you supposedly hit a benefit limit you never used, treat that as possible medical identity theft. Contact your insurer and the provider named on the paperwork, and request your records from that provider so you can check what was added to your file. Errors in a medical record follow you into future treatment decisions, which makes this a clinical problem and not just a financial one.
And one thing privacy caution should never cost you: keep telling your own clinicians the truth about what you take and what you do. The supplement you leave out of the conversation is the one most likely to interact with a prescription.
If you do one thing after reading this, open the privacy settings of the health app you use most and find the sharing section. Not the app you’re least comfortable with. The one you open daily, where the record is longest and the detail is finest. That’s the file that exists.
Sources
- U.S. Department of Health and Human Services, Office for Civil Rights. “Your Rights Under HIPAA.” hhs.gov
- U.S. Department of Health and Human Services, Office for Civil Rights. “Employers and Health Information in the Workplace.” hhs.gov
- Federal Trade Commission. “Health Breach Notification Rule (16 CFR Part 318).” ftc.gov
- Federal Trade Commission. “Complying with FTC's Health Breach Notification Rule.” ftc.gov
- Federal Trade Commission. “Health Breach Notification Rule: The Basics for Business.” ftc.gov
- Federal Trade Commission. “Mobile Health Apps Interactive Tool.” ftc.gov
- Federal Trade Commission. “FTC Warns Health Apps and Connected Device Companies to Comply With Health Breach Notification Rule.” ftc.gov
- Federal Trade Commission. “FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising.” ftc.gov
- Federal Trade Commission. “Easy Healthcare Corporation, U.S. v..” ftc.gov
- Federal Trade Commission. “1Health.io/Vitagene, In the Matter of.” ftc.gov
- U.S. Food and Drug Administration. “Direct-to-Consumer Tests.” fda.gov
- HealthIT.gov (U.S. Department of Health and Human Services). “Protect Your Health Information.” healthit.gov
- PubMed. “Alfawzan N, et al. "Privacy, Data Sharing, and Data Security Policies of Women's mHealth Apps: Scoping Review and Content Analysis." JMIR mHealth and uHealth, 2022. DOI: 10.2196/33735.” doi.org
- PubMed. “Fowler LR, et al. "Readability and Accessibility of Terms of Service and Privacy Policies for Menstruation-Tracking Smartphone Applications." Health Promotion Practice, 2020. DOI: 10.1177/1524839919899924.” doi.org
- PubMed. “Farag N, et al. "Mapping the Apps: Ethical and Legal Issues with Crowdsourced Smartphone Data using mHealth Applications." Asian Bioethics Review, 2024. DOI: 10.1007/s41649-024-00296-3.” doi.org