Why Health Apps Aren't Treated Like Medical Records
When your doctor's office stores your blood pressure readings or lab results, that information is protected under the Health Insurance Portability and Accountability Act (HIPAA) — a federal law that restricts how covered healthcare providers and their business associates handle patient data. Most consumer health and fitness apps, however, fall outside HIPAA's scope entirely.
An app that tracks your sleep, logs your menstrual cycle, or monitors your mood is typically classified as a consumer technology product — not a covered healthcare entity. That distinction matters enormously. Without HIPAA coverage, the app's privacy practices are governed primarily by its own terms of service and applicable state consumer protection laws, which vary widely and carry fewer teeth.
For a broader look at how free apps monetize personal information, see the privacy trade-offs built into free apps. The same underlying dynamics apply here, but with higher-stakes data.
HIPAA Applies to Covered Entities — Not Most Apps
HIPAA covers healthcare providers, health plans, and their business associates — not general consumer app developers. This means the legal protections that apply to your hospital records do not automatically extend to a wellness app, even if that app collects similarly sensitive information. Some apps voluntarily adopt HIPAA-aligned practices; look for explicit statements in the privacy policy rather than assuming coverage.
What Health Apps Actually Collect — and Share
Beyond the data you actively enter — weight, symptoms, sleep hours — many apps also collect device identifiers, location data, usage patterns, and information pulled from other apps or connected wearables. If you've linked a smartwatch, the data pipeline can be surprisingly wide. Our companion piece on what your smartwatch is collecting breaks down that hardware side in detail.
Privacy policies for health apps frequently permit sharing anonymized or aggregated data with third-party analytics companies, advertisers, or research partners. "Anonymized" is not the same as "unidentifiable" — researchers have repeatedly demonstrated that health datasets can be re-identified when combined with other data sources. Understanding this gap is a foundational step in protecting yourself.
52%
Health apps sharing data with third parties
A 2020 analysis published in the British Medical Journal found that a majority of health-related apps shared user data with third parties, including advertising and analytics companies.
88%
Apps transmitting data to external services
Research published in JAMA Network Open found that the vast majority of top-ranked free health apps transmitted data to at least one external domain beyond the app developer.
Best Practices for Protecting Your Health Data
You don't need to avoid health apps entirely to manage your risk. The following practices, applied consistently, substantially reduce your exposure without sacrificing the utility these tools can offer.
Read the privacy policy before entering any health data into an app.
Privacy policies disclose what data is collected, how it is used, and who it is shared with. Many users skip this step and discover later that their data was sold to data brokers or used for targeted advertising. Even a five-minute scan of the key sections — data sharing, third parties, and retention — gives you the information to make an informed choice.
Audit and restrict app permissions through your phone's settings.
Permissions granted at install — such as location, contacts, or microphone access — often extend well beyond what the app's core function requires. Overly broad permissions increase the volume and sensitivity of data collected. Reviewing these regularly helps you maintain control over your device's data access.
Enter only the minimum data necessary to get useful results from the app.
Health apps often request more information than they strictly need to function. The more granular the data you provide, the more detailed a profile can be built. Limiting inputs to what directly serves your goal reduces the value of that data to third parties.
Look for apps that offer a clear data deletion process.
Some apps retain data indefinitely even after you stop using them or delete the app from your device. An app that allows you to request full deletion of your account and associated data gives you meaningful control over your information footprint.
Avoid connecting health apps to social media accounts or other unrelated platforms.
Signing in with a social account links your health data to a much larger behavioral profile. It also gives the social platform visibility into your app usage and potentially your health inputs. Using a dedicated email address for health apps creates a meaningful data separation.
Check whether an app's data practices change after acquisitions or policy updates.
Companies that develop health apps are bought, merged, or pivot their business models over time. A privacy policy that was acceptable when you signed up may change — often with a brief notification buried in an email or in-app notice. Staying aware of these changes protects you from unexpected data use.
Quick Steps You Can Take Right Now
You don't need to overhaul your entire digital life to improve your health data privacy. A few targeted actions can make a meaningful difference immediately.
For a broader inventory of what you may already be sharing across your devices, see personal data you're sharing without realizing it. And if you track fitness metrics like resting heart rate, understanding what those numbers mean can help you have more informed conversations with your doctor rather than relying on app interpretations.
This article is for general informational purposes only and does not constitute medical, legal, or financial advice. For questions about your personal health data or medical decisions, consult a qualified healthcare professional.
The content on this site is for informational purposes only and is not a substitute for professional advice. Always consult a qualified professional for guidance specific to your situation.