HIPAA, the federal health privacy law you have probably heard of, protects health information held by health plans, most health care providers and health care clearinghouses, and by the people and companies that do certain work for them. Its rules apply only when one of those organizations creates, receives, keeps or sends the information, so a weight typed into a phone app is not protected just because it is health information. What your phone and its apps collect about you may be seen or collected by other companies, used by the makers of the phone or the app to show you particular ads, or sold to a data broker, someone who obtains and shares information about people without their knowledge, often selling it for marketing or other purposes. An ad that echoes something you logged is not, on its own, proof that any law was broken.
Is a year of weights and meals in an app protected like your medical record?
Start from how the app reached you:
- If you found it in an app store and signed up on your own, in most cases HIPAA's rules do not protect what you put into it.
- If your health plan or your doctor's practice pointed you to it, ask them whether they provide the app, had it built, or have a company run it for them. If they do, it may be the exception. Health plans here include health, dental, vision and prescription drug insurers, health maintenance organizations, Medicare and Medicaid.
In most cases, unless a health plan, a health care provider covered by the rules, or a company working for one of them gave you the app, HIPAA's rules do not protect the weights and meals you entered into it for your own use. Your medical record is protected when your doctor's practice is covered by the rules, and a practice that sends insurance claims electronically is covered. More broadly, the rules generally do not protect health information you reach through or keep on a personal phone or tablet, and they do not protect your internet search history, what you choose to share online or your location.
These answers are for phones and tablets you use for your own purposes. Smart watches and fitness trackers, which may also collect your location, and email are a separate question.
Does the protection travel with results your clinic sent to the app?
Once your clinic sends results, at your request, to an app that is neither one of those health organizations nor a company working for one, that information is no longer protected by HIPAA's rules. The same goes for anything else you downloaded or entered into an app for your own use: in most cases the rules do not protect it, regardless of where it came from.
Your clinic sent the results because you asked it to. If you chose the app yourself and the clinic did not provide it, the clinic is not liable under HIPAA for what the app does with them afterwards, including a later breach at the app.
The answer is different when the app came from the clinic. If the app was built for the clinic, or provided by it or on its behalf, the clinic could be liable under HIPAA if the app later discloses your information in a way the rules do not allow, because the app's maker then works for the clinic as a business associate. That includes an app the clinic itself uses with its patients, even when you were the one who chose it to receive your records. If you cannot tell which kind of app yours is, ask the clinic's front desk whether the practice provides the app, had it built, or uses it to provide services to its patients.
If you believe an app your clinic provided has disclosed your information in a way the rules do not allow, complain to the Office for Civil Rights at the Department of Health and Human Services (HHS), which enforces HIPAA's rules and takes complaints about them. You can file the complaint online, through the office's complaint portal, or in writing.
If the results your clinic sent include an A1C, a blood sugar test, that nobody explained to you, ask the doctor who ordered the test what the number means for you (see An A1C result nobody explained, and when to test again).
Which rule covers a health app that HIPAA does not?
Under the Federal Trade Commission's Health Breach Notification Rule, in place since 2009, companies outside HIPAA that keep health records for you, and companies related to them, must notify you, the FTC and, in certain cases, the media if there has been a breach of health data that identifies you and was not secured. Health apps and similar technologies not covered by HIPAA are covered by the rule, as its 2024 update made clear.
A breach under the rule includes an unauthorized disclosure as well as a data breach. The FTC has settled with companies that failed to report sharing users' health data with advertising platforms against their own privacy promises.
The breach notification must describe the types of health information involved, such as a diagnosis or condition, lab results, medications, other treatment information, or your use of a health-related app, and in most cases it must also tell you the identity of any third parties that acquired your health information because of the breach. Look for it in your email and in the app itself: under the updated rule, email together with a text or an in-app message is the main way to send the notice, though a letter by first-class mail is still allowed in certain cases.
Under the rule, notices are due by these deadlines:
| Who is told | By when |
|---|---|
| You | Without unreasonable delay, and no later than 60 calendar days after the breach is discovered |
| The FTC, when 500 or more people are affected | At the same time as you |
| The FTC, when fewer than 500 people are affected | Once a year, no later than 60 calendar days after the end of the year |
Your notice is due by the same deadline however many people are affected, and violations of the rule are subject to civil penalties. If you think a health app is not keeping its privacy promises, report it to the FTC at ReportFraud.ftc.gov. The FTC regularly brings enforcement actions against companies that misrepresent how they use or disclose people's sensitive health information.
Settings and habits to change on your phone tonight
Open the app's own settings first, because an app's default settings often encourage sharing: look for controls over what health information it collects and shares, and pick the more protective options. Then work through the rest of your phone:
- Read the app's privacy notice for what health information it collects, how it uses it and which other companies it shares it with. If it shares, check whether it says why and whether it limits what those companies can do with it.
- Keep the app and your phone's operating system up to date, because updates sometimes fix privacy or security glitches.
- Turn off location access for every app whose job does not need it. Navigation and traffic apps need it. Many apps that resell data to data brokers do not really need it.
- On an iPhone, go to Settings, then Privacy, then Tracking, and turn off Allow Apps to Request to Track, which automatically denies new requests from app developers to track your activity across apps and websites for advertising.
- On Android, go to Settings, then Privacy, then Ads, and tap Delete advertising ID. On earlier versions without that option, go to Settings, then Google, then Ads, tap Reset advertising ID, and turn on Opt out of Ads Personalization. These steps should work on most phones, though older versions and hardware may be slightly different.
- Do not download apps you do not need or picked at random, especially free ones.
- Before an old phone leaves your hands, securely delete everything stored on it, remove and destroy the SIM card if you will not use it in another device, and recycle the phone at an electronic recycling location.
These steps can shrink your digital footprint but cannot erase it. Your cellular provider's network records your subscriber and device information whenever the phone is connected, which leaves a trail of where the phone has been. Even with careful settings, some companies do not keep their privacy promises. The best way to keep your phone from collecting and sharing your information without your knowledge is to limit what personal information you send and store on or through it, and to log only what you would be comfortable having shared.
If you get weight care through NicoCares, your messages to the care team are hosted by Spruce Health, which emails you the invitation to open that messaging account. NicoCares does not sell your personal information or use your health information for marketing (see the NicoCares privacy policy). For a copy of what NicoCares holds about you, or a correction or deletion, write to [email protected], sending it from your account's email address or naming that address in the message.
