Fundamentals
Your body is a complex, interconnected system, and the data you generate through a wellness app provides a unique window into its inner workings. When you track your sleep, your heart rate, or your diet, you are creating a personal health record.
The question of who has access to this information and how it is protected is a critical one. The Health Insurance Portability and Accountability Act, or HIPAA, is a federal law that establishes a national standard for protecting sensitive patient health information. It is designed to safeguard your medical records and other personal health information, but its reach is more specific than many people realize.
HIPAA’s protections are triggered when your health information is created, received, maintained, or transmitted by a specific set of organizations known as “covered entities.” These are your doctors, hospitals, clinics, and health insurance plans.
When one of these covered entities uses a technology or service that involves your health information, the provider of that technology or service becomes a “business associate” and is also bound by HIPAA’s rules. This is a crucial distinction. HIPAA applies to your health data when it is in the hands of your healthcare provider or their designated partners. It does not, however, apply to all health information, everywhere.
HIPAA defines Protected Health Information as any individually identifiable health data held or transmitted by a healthcare provider or health plan.
Many wellness apps on the market today are direct-to-consumer products. You download them, you enter your data, and you use them to manage your own health and wellness journey. In this scenario, the app developer is not typically a covered entity or a business associate.
The health information you are generating is not being created or managed by your doctor or your health plan. As a result, this data falls outside the scope of HIPAA’s protections. This is a vital point to understand. The same piece of information ∞ your heart rate, for example ∞ can be protected by HIPAA in one context and unprotected in another. The determining factor is who is holding the data.
This does not mean that your data is entirely without protection. Other federal and state laws govern data privacy and security. The Federal Trade Commission (FTC), for instance, has the authority to take action against companies that engage in deceptive or unfair practices, such as failing to protect sensitive user data or sharing it without consent.
The key takeaway is that the regulatory landscape for health data is complex and context-dependent. Understanding the role of covered entities and business associates is the first step in understanding your rights and the protections that apply to your personal health information.
Intermediate
To truly understand when HIPAA applies to a wellness app, we must move beyond the simple definition of Protected Health Information (PHI) and examine the operational relationships between app developers, healthcare providers, and patients. The critical factor is the flow of information and the purpose for which it is being used.
When a healthcare provider or a health plan ∞ a “covered entity” ∞ directs you to use a specific app to track your blood pressure, manage your diabetes, or participate in a wellness program, the dynamic changes. In this situation, the app is no longer just a tool for your personal use; it is an extension of the healthcare services you are receiving.
When Does an App Become a Business Associate?
An app developer becomes a “business associate” when it creates, receives, maintains, or transmits PHI on behalf of a covered entity. This is a formal, legal relationship that is established through a Business Associate Agreement (BAA), a contract that outlines the developer’s responsibilities for protecting the PHI it handles.
For example, if your doctor prescribes a remote patient monitoring app to track your recovery after a procedure, the data you enter into that app is considered PHI. The app developer is acting as a business associate of your doctor, and both parties are legally obligated to protect your data under HIPAA.
The following table illustrates the key differences between a wellness app that is subject to HIPAA and one that is not:
| Characteristic | HIPAA-Covered App | Non-HIPAA-Covered App |
|---|---|---|
| Data Originator | Data is generated at the direction of a covered entity (e.g. a doctor or health plan). | Data is generated by the individual for their own personal use. |
| Relationship to Healthcare Provider | The app developer has a formal Business Associate Agreement with a covered entity. | There is no formal relationship between the app developer and a healthcare provider. |
| Purpose of Data Collection | Data is collected for treatment, payment, or healthcare operations. | Data is collected for personal wellness tracking, fitness goals, or other non-clinical purposes. |
| Governing Regulation | HIPAA Privacy, Security, and Breach Notification Rules. | FTC Act, Health Breach Notification Rule, and state privacy laws. |
What Is the Role of the Federal Trade Commission?
When a wellness app is not covered by HIPAA, it falls under the jurisdiction of the Federal Trade Commission (FTC). The FTC’s authority stems from the FTC Act, which prohibits unfair and deceptive trade practices. The FTC has taken enforcement actions against app developers for a variety of reasons, including:
- Misleading statements about data privacy and security ∞ If an app’s privacy policy claims that it does not share user data, but it does so, the FTC can take action.
- Failure to secure user data ∞ The FTC can penalize companies that do not take reasonable measures to protect the sensitive data they collect.
- Unauthorized disclosure of health information ∞ The FTC’s Health Breach Notification Rule requires vendors of personal health records that are not covered by HIPAA to notify consumers, the FTC, and, in some cases, the media of a breach of unsecured identifiable health information.
The Health Breach Notification Rule is a particularly important tool for protecting consumers. It defines a “breach” not just as a data security incident, but also as an unauthorized disclosure. This means that if an app shares your health data with a third party without your consent, it may be a violation of the rule.
The FTC’s enforcement action against the prescription drug app GoodRx for sharing user data with advertising platforms without user consent is a prominent example of the agency’s commitment to protecting the privacy of health information, even when it falls outside the scope of HIPAA.
The relationship between the user, the app, and a healthcare provider determines whether HIPAA’s protections apply.
Understanding this regulatory framework is essential for anyone who uses a wellness app. While HIPAA provides robust protections for your health information when it is in the hands of your doctor or health plan, the FTC plays a vital role in holding direct-to-consumer app developers accountable for their data privacy and security practices.
As a user, it is important to read the privacy policy of any app you use, understand how your data is being collected and shared, and be aware of your rights under both HIPAA and the FTC’s regulations.
Academic
The regulatory landscape governing health information in the United States is a complex interplay of federal and state laws, with the Health Insurance Portability and Accountability Act (HIPAA) and the Federal Trade Commission (FTC) Act serving as the two primary pillars of federal oversight.
The application of these laws to mobile wellness applications is a nuanced issue that hinges on the specific relationships between the consumer, the application developer, and the healthcare system. A thorough analysis of this issue requires a deep understanding of the legal definitions of “covered entity,” “business associate,” and “personal health record,” as well as the enforcement priorities of the Department of Health and Human Services (HHS) and the FTC.
What Is the Jurisdictional Divide between HHS and the FTC?
HIPAA, enforced by the HHS Office for Civil Rights (OCR), applies to “covered entities” ∞ health plans, healthcare clearinghouses, and healthcare providers that conduct certain healthcare transactions electronically ∞ and their “business associates.” A business associate is a person or entity that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of Protected Health Information (PHI).
The applicability of HIPAA to a wellness app, therefore, is not determined by the nature of the data the app collects, but by the relationship of the app developer to a covered entity.
When a consumer downloads a wellness app of their own volition and enters their own health information, the app developer is not a covered entity or a business associate, and the data is not PHI under HIPAA. This is the case for the vast majority of wellness apps on the market.
However, if a covered entity, such as a hospital or a health plan, contracts with an app developer to provide an app to its patients or members for the purpose of managing their health, the app developer becomes a business associate and is subject to HIPAA.
In this scenario, the app developer must enter into a Business Associate Agreement (BAA) with the covered entity, a legally binding contract that imposes many of the same privacy and security obligations on the business associate as are imposed on the covered entity.
The following table provides a detailed comparison of the regulatory requirements under HIPAA and the FTC Act:
| Regulatory Provision | HIPAA (enforced by HHS) | FTC Act and Health Breach Notification Rule (enforced by the FTC) |
|---|---|---|
| Applicability | Covered entities and their business associates. | Vendors of personal health records and other entities not covered by HIPAA. |
| Protected Information | Protected Health Information (PHI). | Personally identifiable health information. |
| Privacy Rule | Establishes national standards for the protection of PHI. | Prohibits unfair or deceptive practices, including misrepresentations about data privacy. |
| Security Rule | Requires administrative, physical, and technical safeguards for electronic PHI. | Requires reasonable and appropriate data security measures. |
| Breach Notification | Requires notification to individuals and HHS (and the media in some cases) of a breach of unsecured PHI. | Requires notification to individuals and the FTC (and the media in some cases) of a breach of unsecured personally identifiable health information. |
How Does the Health Breach Notification Rule Reshape the Landscape?
The FTC’s Health Breach Notification Rule (HBNR) is a critical component of the regulatory framework for non-HIPAA-covered wellness apps. The HBNR requires vendors of personal health records and related entities to provide notice to consumers, the FTC, and, in some cases, the media following a breach of unsecured personally identifiable health information.
The FTC has clarified that the HBNR’s definition of a “breach of security” is not limited to cybersecurity intrusions. It also includes unauthorized disclosures, such as sharing a user’s health information with third parties without their consent.
The FTC’s enforcement actions against GoodRx and Easy Healthcare (Flo) demonstrate the agency’s expansive interpretation of its authority under the HBNR. In the GoodRx case, the FTC alleged that the company had shared users’ sensitive health information with advertising platforms like Facebook and Google without the users’ knowledge or consent.
The FTC argued that this unauthorized disclosure constituted a breach of security under the HBNR, even though it was not the result of a traditional data breach. This interpretation of the HBNR has significant implications for the wellness app industry, as it puts developers on notice that they can be held liable for sharing user data without clear and conspicuous consent.
The FTC’s enforcement of the Health Breach Notification Rule has created a new paradigm for data privacy in the wellness app industry.
The evolving regulatory landscape for wellness apps reflects a broader societal conversation about data privacy and the need to protect sensitive personal information in an increasingly digital world. While HIPAA remains the cornerstone of health information privacy in the United States, the FTC’s growing role in this space is a recognition that the traditional healthcare system is no longer the sole repository of our health data.
As consumers increasingly turn to technology to manage their health and wellness, the FTC’s enforcement of the HBNR will be a critical mechanism for ensuring that their sensitive health information is protected, regardless of who is collecting it.
References
- U.S. Department of Health and Human Services. (2013). Summary of the HIPAA Privacy Rule. HHS.gov.
- U.S. Department of Health and Human Services. (2013). Summary of the HIPAA Security Rule. HHS.gov.
- U.S. Federal Trade Commission. (2021). FTC Policy Statement on Breaches by Health Apps and Other Connected Devices.
- U.S. Federal Trade Commission. (2023). FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising.
- Al-Khalili, Y. (2023). Protected Health Information. In StatPearls. StatPearls Publishing.
- Gostin, L. O. & Halabi, S. F. (2020). Consumer Health Data ∞ The Need for a Public Health Approach to Privacy. JAMA, 323(3), 209 ∞ 210.
- Cohen, I. G. & Mello, M. M. (2018). HIPAA and the Evolving Health Information Landscape. JAMA, 320(3), 231 ∞ 232.
Reflection
What Does This Mean for Your Personal Health Journey?
The information you have just read provides a map of the complex legal and regulatory landscape that governs your health data. This knowledge is a powerful tool. It allows you to move from being a passive consumer of technology to an active participant in your own healthcare. As you continue to use wellness apps and other digital health tools, consider the following questions:
- Who am I sharing my data with? Is it my doctor, my health plan, or a third-party app developer?
- What are the privacy policies of the apps I use? Do I understand how my data is being collected, used, and shared?
- What is my personal comfort level with data sharing? Am I willing to trade a certain amount of privacy for the convenience and insights that a wellness app can provide?
Your answers to these questions will be unique to you. There is no one-size-fits-all approach to managing your digital health footprint. The goal is not to avoid technology, but to engage with it thoughtfully and intentionally. By understanding the rules of the road, you can make informed decisions that align with your personal values and empower you to take control of your health and well-being.
