Your medical records may feel like some of the most private information you own, but HIPAA does not protect every piece of health-related data about you. The federal law generally applies when protected health information is handled by covered health plans, qualifying health care providers, clearinghouses, and their business associates—not every app, website, wearable, search engine, or data broker that learns something about your health.
That distinction has become increasingly important as Americans use digital tools for everything from checking lab results to tracking sleep, fertility, medications, and mental health. A 2025 KFF poll found roughly three in four U.S. adults had used a health care app or website during the previous year, while 75% were concerned about privacy when such a tool was managed by a private technology company. The so-called HIPAA loophole is therefore less a loophole in one statute than a gap between what consumers assume HIPAA covers and what it actually covers.
What HIPAA Protects — And What It Does Not
HIPAA protects identifiable medical records and other protected health information when they are held or transmitted by covered entities and their business associates, but that protection does not automatically follow every health-related fact everywhere it goes. A hospital generally cannot simply sell an identifiable patient list to an advertiser for the advertiser’s own marketing without the authorization HIPAA requires, so claims that HIPAA lets hospitals freely sell medical records are misleading. However, information that has been properly de-identified under HIPAA is no longer considered protected health information under the Privacy Rule, meaning HIPAA’s restrictions no longer apply to that data.
Meanwhile, information you enter directly into an independent wellness app, chatbot, symptom checker, period tracker, or other consumer service may never become HIPAA-protected information in the first place. EPIC’s January 2026 health-privacy report highlights this broader problem, noting that consumer technologies and data brokers can collect health-related information outside traditional medical settings.
Your Health Data Can Exist Outside Your Medical Records
The hidden issue is that a company does not need a copy of your doctor’s medical records to build a revealing health profile about you. Searches for treatments, purchases, location visits, app activity, wearable readings, and online forms can potentially reveal or help infer conditions without coming directly from a hospital chart, and EPIC reports that data-broker profiles can include health-related segments such as likelihood of anxiety, diabetes, frequent headaches, or high blood pressure. Research published in The BMJ examined 20,991 mobile health apps and found 88% contained code capable of potentially collecting user data, while 28.1% lacked a valid privacy-policy text. That research predates today’s app marketplace, so it should not be treated as a measurement of current apps, but it demonstrates how health information can move through commercial technology ecosystems. For a consumer, a “$0” wellness app can therefore still involve a meaningful tradeoff if behavioral or health-related information is collected for analytics, advertising, or other commercial purposes.
AI And Health Apps Create Another Privacy Question
Uploading your medical records to a consumer AI service can also change the privacy equation because the service receiving the information may not be acting as your doctor’s HIPAA-regulated business associate.
In a KFF poll conducted in early 2026, 77% of U.S. adults said they were at least somewhat concerned about the privacy of personal medical information provided to AI tools. Even among people who had already entered personal medical information into an AI tool, 65% expressed privacy concerns, showing that actual users are not necessarily comfortable with how that information could be handled. Before uploading a lab report, prescription list, medical history, or insurance document, read the service’s privacy terms and look specifically for language about retention, advertising, model training, third-party sharing, deletion, and account closure. Do not assume that a health-focused interface, medical disclaimer, or ability to analyze medical records automatically makes the company subject to HIPAA.
State Privacy Laws Can Give You More Control
Where you live can make a major difference because states increasingly regulate consumer health information that falls outside traditional HIPAA coverage. Washington’s My Health My Data Act, for example, broadly regulates consumer health data and generally requires consent or necessity for covered collection and sharing, with separate authorization requirements applying to sales. More broadly, EPIC reported in May 2026 that 21 states had privacy legislation providing a right to opt out of the sale or sharing of personal information, although the details, exemptions, and covered businesses differ substantially. California residents gained an especially useful option when the state’s Delete Request and Opt-Out Platform, or DROP, launched in January 2026, allowing one request to reach registered data brokers rather than forcing consumers to hunt down each company individually. Privacy Rights Clearinghouse reported that deletion obligations began in 2026 for more than 500 registered brokers and must be repeated every 45 days, making this more than a one-time cleanup tool.
The Biggest Privacy Risk May Be Outside The Doctor’s Office
The practical takeaway is not that your doctor’s office can secretly put identifiable medical records up for sale, because HIPAA imposes meaningful restrictions on covered medical information. The bigger blind spot is the expanding trail of health-related data created outside conventional care, where HIPAA may not apply and state privacy protections remain uneven. Consumers can reduce exposure by limiting unnecessary app permissions, checking data-sharing terms before entering sensitive details, exercising state opt-out and deletion rights, and thinking carefully before uploading medical records to consumer technology platforms. Those steps cannot eliminate commercial data collection, but they can reduce how much sensitive information is available to companies that never treated you as a patient.
Were you surprised that health information collected by an app or website may receive different protections than the same information in your doctor’s medical record, and have you ever tried to delete your data from one of these services? Share your experience in the comments.
What to Read Next
Understanding Late-Summer Skin Changes Women May Want to Photograph and Ask a Doctor About
When Should Women Ask a Doctor About Late-Summer Skin Changes?
10 Tongue Changes Doctors Say You Shouldn’t Ignore
