Does HIPAA Apply to Health Apps? 6 Myths, Debunked

Does HIPAA apply to health apps? Usually not to the ones you find and download yourself. HIPAA covers health plans, health care clearinghouses, health care providers that do standard transactions electronically, and the "business associates" that work for them. A tracking app you choose on your own is typically none of those, so different rules, mainly the FTC Act and the FTC's Health Breach Notification Rule, do the protecting.

That surprises a lot of people, because "health data" and "HIPAA" feel like they should go together. Here are the six myths we see most, with what the regulators actually say.

Myth 1: "If an app holds health data, HIPAA protects it"

Reality: HIPAA is about who holds the data, not what the data is.

HHS describes the HIPAA Rules as applying to covered entities (health plans, providers that conduct standard health care transactions electronically, and health care clearinghouses) and, in part, to their business associates. Your weight, dose dates and nausea notes are health information, but when you type them into an app you picked yourself, the company running that app is usually not a covered entity or working for one.

Business associates are the companies that help a covered entity carry out its health care work, such as a billing service or a records vendor working for a clinic. An app that serves you directly, and not a doctor or health plan, does not fit either box.

Myth 2: "Once my doctor's records are HIPAA-protected, they stay protected wherever they go"

Reality: when you send your records to an app you chose, HIPAA's protection ends at the handoff.

This one matters more and more as patient portals let you connect apps. HHS's FAQ is direct: once health information is received from a covered entity, at your direction, by an app that is neither a covered entity nor a business associate, "the information is no longer subject to the protections of the HIPAA Rules." HHS adds that the doctor's office would have no HIPAA liability if that app later had a breach.

That does not mean you should not do it. It means the app's own privacy policy, not HIPAA, now describes what happens to those records. Read it before you connect.

Myth 3: "An app my clinic gives me is the same as any other app"

Reality: an app provided by or for your clinic can be inside HIPAA.

The same HHS FAQ draws the line. If the app was developed for, or provided by or on behalf of, the covered entity, so that it handles health information on the clinic's behalf, there is a business associate relationship, and the clinic could be liable if the app improperly discloses that information.

So if your weight-management clinic hands you an app as part of your care, it is reasonable to ask: "Is this app operating on your behalf, and is there a business associate agreement?" If you are sharing your own logs with your clinician from a separate app, our post on sharing a tracking report with your clinician covers how to make that useful.

Myth 4: "No HIPAA means no rules at all"

Reality: the FTC polices health apps, and it has used that power.

The FTC Act bans deceptive or unfair practices. HHS notes that this obligation applies both to HIPAA-covered organizations and to companies that collect, use or share health information but are not covered by HIPAA. In practice, an app that breaks its own privacy promises can face enforcement.

On top of that, the FTC's Health Breach Notification Rule covers vendors of personal health records that are outside HIPAA. Changes finalized in 2024 made it clearer that health apps and similar technologies are included. The FTC even gives examples: a diet app that lets users log their weight and pulls calorie counts from restaurant menus likely counts.

Two real cases show this is not theoretical:

• GoodRx (2023): in the FTC's first enforcement action under the rule, the agency said GoodRx shared users' prescription and health information with advertising platforms. The proposed order included a $1.5 million civil penalty and a ban on sharing health data for advertising.
• Premom (2023): the FTC's second action under the rule targeted the developer of an ovulation-tracking app, with a $100,000 civil penalty.

States are adding rules too. Washington's My Health My Data Act, for example, requires consent to collect and share consumer health data outside HIPAA and bans selling it without the person's authorization.

Myth 5: "A breach only counts if someone hacks the app"

Reality: under the FTC rule, unauthorized sharing counts as a breach.

The FTC says a breach under the Health Breach Notification Rule is not limited to cyberattacks. If an app discloses identifiable health information without the person's authorization, for example by sending it to a social media platform without consent, that is a breach too. Covered apps must notify affected people no later than 60 calendar days after discovery.

Myth 6: "'HIPAA compliant' on an app's website means my data is safe"

Reality: it is a marketing phrase, not a certificate.

"HIPAA compliant" is a claim a company makes about itself. A consumer app saying it may mean it follows HIPAA-style security practices, or that part of its business serves clinics. Neither tells you whether it shares your logs with advertisers or AI providers. The questions that actually help:

1. Who holds my data, and on whose behalf?
2. Who else receives it, by name?
3. Is it used for advertising or sold?
4. How do I export and delete it?

Our GLP-1 app privacy policy checklist turns those into a ten-point read-through, and the 5-minute privacy scorecard helps you compare two apps quickly.

So where does a GLP-1 tracker like GLPily fit?

To be straight about our own app: GLPily is a consumer app you download yourself. It is not run for a clinic or health plan, so as we read HHS's guidance, HIPAA is not the law that governs it. What governs it is our privacy policy, the FTC Act, and state privacy laws where they apply. That is exactly why we try to keep the policy specific: what we collect, which companies process it, and how to delete it.

Myth vs reality at a glance

Myth	Reality
Health data = HIPAA	HIPAA depends on who holds the data
Records stay HIPAA-protected forever	Protection ends when you send them to a non-covered app
Every app is the same	Apps run for your clinic can be business associates
No HIPAA = no rules	FTC Act, Health Breach Notification Rule, state laws
Breach = hack	Unauthorized sharing counts too
"HIPAA compliant" = safe	Marketing phrase; read the policy

Common questions

Is my GLP-1 tracking app covered by HIPAA?

If you downloaded it yourself and it is not provided by or for your doctor, clinic or health plan, probably not. Check the privacy policy for the rules the company says it follows.

Is my telehealth provider covered by HIPAA?

Health care providers that conduct standard transactions electronically are covered entities, and many telehealth practices are. If you are unsure, ask them directly and ask for their notice of privacy practices.

Where do I report a health app that misused my data?

For a consumer app, you can report it to the FTC at ReportFraud.ftc.gov. If the problem involves a HIPAA-covered provider, plan or their business associate, you can file a complaint with HHS's Office for Civil Rights through its online complaint portal.

Does deleting my app account delete the data everywhere?

Not always. Check whether the app says it also deletes photos, backups and data held by its processors, and whether it keeps some records for legal reasons.