How wellness groups protect privacy, since a closed group isn’t a confidential one

Key takeaways

• HIPAA, the federal health privacy law, covers health plans, certain health care providers and their contractors, so most peer groups, online communities and coaches fall outside it.
• In 2018, a breast cancer advocate found she could download the names, employers and emails of fellow members of her “closed” Facebook group, which now has more than 10,000 members.
• The FTC has acted against health companies for sharing sensitive data: GoodRx paid a $1.5 million civil penalty, and BetterHelp agreed to pay $7.8 million for refunds, which a news report put at just under $10 per customer.
• Washington’s My Health My Data Act, in force since 2024, requires consent before businesses collect or share consumer health data, but laws like it don’t cover a fellow member repeating your story.
• Written group rules, a member checklist and a leak plan, all included here, protect members better than any privacy setting.

Andrea Downing runs BRCA Sisterhood, a private Facebook group for women who carry gene mutations that raise their risk of breast and ovarian cancer. By 2020, CNN reported, it had more than 10,000 members¹.

In 2018, the Cambridge Analytica scandal made Downing wonder how safe her members really were. She tried a browser add-on and found it could pull the name, workplace, location and email address of every woman in her “closed” group¹. She called Fred Trotter, a cybersecurity researcher she knew. He found a gap that could expose the member lists of closed groups built around thousands of diseases and conditions¹.

Together they sent Facebook a 30-page report on May 29, 2018. Facebook’s answer: it did not see a privacy or security problem¹. That July, the company said it had changed how closed groups worked but that “there was not a privacy loophole”¹.

Six months after the first report, Trotter and attorney David Harlow took the issue to the Federal Trade Commission in a 43-page complaint¹. As of 2020, no FTC action on it had been reported, and the group was planning to leave Facebook¹.

The lesson for every wellness community is simple. A group can feel like a living room while working like a public square. People share things there that they would never tell an employer, and most of it has no legal protection at all.

HIPAA probably doesn’t cover your group

HIPAA, the Health Insurance Portability and Accountability Act, applies to “covered entities”: health plans, health care clearinghouses, and health care providers who send health information electronically in certain standard transactions². It also reaches their business associates, the contractors who handle data for them².

Everyone else is outside it. The Department of Health and Human Services (HHS) says plainly that an organization outside those two groups doesn’t have to follow the HIPAA rules².

That usually leaves out a volunteer-run support group, a Facebook or Discord community, a group chat, and many wellness coaches. For the full story on apps, see our article on the HIPAA gap. The short version: in a group, privacy is mostly a promise between people.

Courts have treated it that way. In 1988, a man named Paul Cox killed a couple in Larchmont, New York, while drunk³. After joining Alcoholics Anonymous, he confessed to at least seven fellow members between 1991 and 1993. One of them went to the police, and he was convicted in 1994³.

Cox argued that what he said at AA was protected, like a confession to clergy. In 2002, a federal appeals court disagreed. New York’s clergy privilege covers disclosures made in confidence to seek spiritual guidance, and the court found his statements didn’t qualify³.

Few wellness groups will face a case like that. But it shows the limit clearly: a group’s promise of confidentiality is a moral commitment, not a legal shield.

Where some protection exists: the apps and businesses around your group

The law does reach some of the businesses wellness groups rely on. The FTC’s Health Breach Notification Rule applies to many health apps and personal health record services outside HIPAA. An app that pulls data from your fitness tracker is a typical example⁵.

The FTC revised the rule in 2024, spelling out that health apps and connected gadgets fall under it⁵. And under the rule, a breach means more than a hacker. If a company hands your health information to an ad network without your okay, that counts⁵.

After a breach, the company has 60 days from discovering it to tell the people affected⁵. If 500 or more residents of one state are involved, the media must be told as well. Each violation can cost up to $53,088⁵.

The FTC has used these powers. In February 2023, it brought its first case under the rule against GoodRx, which paid a $1.5 million civil penalty⁶. The FTC said the company shared users’ prescription medications and health conditions with Facebook, Google, Criteo and other companies after promising not to⁶.

A month later, the FTC acted against BetterHelp, an online counseling service⁷. The agency alleged that BetterHelp shared email addresses, IP addresses and answers to health questionnaires with Facebook, Snapchat, Criteo and Pinterest for advertising. Those questionnaires asked about depression, suicidal thoughts and medications⁷.

BetterHelp agreed to pay $7.8 million for partial refunds to customers who signed up between 2017 and 2020. The FTC called it its first action to return money to people whose health data was compromised⁷. In May 2024, FOX6 News in Milwaukee reported that about 800,000 customers had begun getting refund notices, and that each would receive just under $10⁸. BetterHelp has said the settlement wasn’t an admission of wrongdoing⁸.

Ten dollars can’t pull information back once it has spread. And the market for that information is real. A 2023 study from Duke University contacted 37 data brokers; 11 said they were willing and able to sell data about people’s mental health conditions¹². One quoted $275 per 1,000 people’s aggregated records, with a 5,000-record minimum, and some offered names and postal addresses¹².

Most people can’t see any of this. In a 2023 Pew Research Center survey, 67% of U.S. adults said they understood little or nothing about what companies do with their data, and 73% said they had little or no control over it¹³. More than half, 56%, said they often click “agree” without reading privacy policies¹³.

States are filling some gaps, unevenly

Washington’s My Health My Data Act, signed in April 2023, was the first privacy law aimed at health data that falls outside HIPAA, according to the state attorney general⁹. Most of its rules took effect on March 31, 2024, and on June 30, 2024, for small businesses⁹.

Under the act, covered businesses need consent to collect or share consumer health data. People can ask for that data to be deleted, even from backups, and a sale requires the person’s valid authorization⁹. Health data can include inferences a company draws from shopping patterns⁹. Both the attorney general and private individuals can enforce it⁹.

Connecticut’s privacy law now has rules for consumer health data, too. They apply to businesses of any size, and the law’s usual nonprofit exemption doesn’t apply¹⁰. Businesses can’t sell that data without consent or set up a geofence, a virtual boundary used to target phones, around mental, reproductive or sexual health facilities¹⁰.

New York came close. Its legislature passed a Health Information Privacy Act in January 2025, but the governor vetoed it on December 19, 2025¹¹.

These laws matter for apps, sellers and some organizations. They don’t stop a fellow member from repeating your story at a dinner party. For that, a group needs its own rules.

Recording and screenshot rules, in general terms

Many groups now meet on video calls, and members sometimes want to record. Federal law allows recording a conversation if one person in it agrees, according to the Reporters Committee for Freedom of the Press¹⁴. Many states follow that one-party rule.

About 11 states require consent from everyone in the conversation in most situations, including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington¹⁴. A few states mix the rules, treating phone calls and in-person talks differently¹⁴.

When people in different states are on the same call, the safest assumption is that the stricter law applies¹⁴. The Reporters Committee also recommends getting spoken consent rather than relying on a visible device or a warning¹⁴. This is general information, not legal advice, so check your own state’s law.

Recording laws were written for conversations. For screenshots of written posts, the group’s own rules and members’ good faith carry most of the weight.

Privacy claims, checked against the record

People often believe their group is safer than it is. Here is how some common beliefs hold up, using our four-level evidence scale.

What people assume	What the record shows	Evidence level
“A closed group keeps the member list private.”	In 2018, names, employers and emails of a closed health group’s members could be downloaded1	Evidence says no
“HIPAA protects what I share in my support group.”	HIPAA covers plans, clearinghouses, certain providers and their contractors2	Evidence says no
“What I confess in a group can’t be used in court.”	A federal appeals court ruled in 2002 that a man’s confessions to AA members weren’t privileged3	Evidence says no
“Health apps keep my data to themselves.”	The FTC alleged GoodRx and BetterHelp shared health data with ad platforms67	Evidence says no for some apps
“Nobody would pay for my mental health data.”	Researchers found 11 brokers willing to sell it, some with names and addresses12	Strong evidence that the market exists

Anonymity is an old tradition for good reason

Recovery groups figured this out long ago. Alcoholics Anonymous first published its Twelve Traditions in 1946⁴. The last tradition calls anonymity the spiritual foundation of all the others, a reminder to put principles ahead of personalities⁴.

Another tradition asks members to keep personal anonymity in the press, on the radio and in films⁴. In practice, that means first names, no outing other members, and no turning recovery into a stage.

Wellness groups can borrow the idea without borrowing the program. Anonymity protects the person who shares. It also keeps a group focused on the problem, not on who said what. That fits values many natural-health readers already hold: your body, your story, your decision about who knows.

Group privacy rules you can adopt this week

Here is a starting set of rules for leaders. Post them where every new member sees them, and ask people to agree before joining.

1. Stories stay, lessons travel. You can repeat what you learned, never who said it or details that point to them.
2. No screenshots, recordings or forwarding without the poster’s permission. Recording a call needs everyone’s spoken okay.
3. Share your own story, not someone else’s. Leave out names and details of family members, clients and friends.
4. First names or handles are fine. Nobody has to use a real name or photo.
5. No private sales pitches. Don’t message members to sell products or recruit for a business.
6. Collect only what you need. If join questions ask about diagnoses, ask whether you need the answers, and delete them after review.
7. Guard the keys. Limit admin access, remove former moderators promptly, and never export member lists.
8. Tell members the limits. This group isn’t covered by HIPAA, and what people say here isn’t legally privileged.
9. Honor exits. When someone leaves, ask whether they want their posts removed.
10. Have a leak plan, and use it the same way every time.

A member’s personal privacy checklist

• Check who can see the member list, not just who can see posts.
• Use a name and photo you’re comfortable having linked to the group’s topic.
• Assume anything you type can be screenshotted and shared.
• Leave out details that identify you, such as your employer, town or children’s schools.
• Before using any app the group recommends, see who it shares data with, and turn off ad tracking.
• If you live in Washington, you can ask covered businesses to delete your consumer health data⁹.
• Before you post, ask: would I be okay if my boss or my ex read this?

After the first day, fix the gap. Change settings, update rules, and tell members what changed. Telling members what happened, and what you changed, is how a group earns trust back.

Questions readers ask

The bottom line

What members share in a wellness group is precious and mostly unprotected. HIPAA rarely applies, state laws reach only some businesses, and courts don’t treat group confidences as privileged.

That puts the job on the group itself. Clear rules, careful settings, a culture of anonymity and a plan for leaks are what make a group safe enough for people to tell the truth.

Related reading

• What protects your data when HIPAA doesn’t cover most health apps
• Online health groups offer reach, while in-person groups have stronger evidence
• What a peer who’s been there can do that a clinician can’t
• People come to wellness groups for answers and stay for belonging
• The health record nobody else is keeping for you

Sources

1. CNN (republished by KVIA). “This breast cancer advocate says she discovered a Facebook flaw that put the health data of millions at risk.” KVIA, 2020. kvia.com
2. U.S. Department of Health and Human Services. “Covered Entities and Business Associates.” HHS, 2024. hhs.gov
3. U.S. Court of Appeals for the Second Circuit. Cox v. Miller, 296 F.3d 89. 2002.
4. Alcoholics Anonymous. “The Twelve Traditions.” AA World Services. aa.org
5. Federal Trade Commission. “Complying with FTC’s Health Breach Notification Rule.” FTC. ftc.gov
6. Federal Trade Commission. “FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising.” FTC, 2023. ftc.gov
7. Federal Trade Commission. “FTC to Ban BetterHelp from Revealing Consumers’ Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising.” FTC, 2023. ftc.gov
8. FOX6 News. “BetterHelp refund notices sent after $7.8M data-sharing settlement.” FOX6 Milwaukee, 2024. fox6now.com
9. Washington State Office of the Attorney General. “Protecting Washingtonians’ Personal Health Data and Privacy.” Washington AG. atg.wa.gov
10. Connecticut Office of the Attorney General. “The Connecticut Data Privacy Act.” State of Connecticut. portal.ct.gov
11. New York State Senate. “Senate Bill S929: New York Health Information Privacy Act.” NY Senate, 2025. nysenate.gov
12. Kim J. “Data Brokers and the Sale of Americans’ Mental Health Data.” Duke University Sanford School of Public Policy, 2023. donestech.net
13. Pew Research Center. “How Americans View Data Privacy.” Pew Research Center, 2023. pewresearch.org
14. Reporters Committee for Freedom of the Press. “Introduction to the Reporter’s Recording Guide.” RCFP. rcfp.org
15. U.S. Department of Health and Human Services. “Filing a Complaint.” HHS Office for Civil Rights. hhs.gov