Protecting Your Health Data Online: What's Covered, What Isn't, What to Do

Covered by HIPAA: your providers, your health plan, pharmacies, and the software they use on your behalf (portals, ambient scribes under proper agreements). Not covered: consumer health apps, wearables, search engines, social platforms, most direct-to-consumer genetic tests, and general AI chatbots. Those live under their own privacy policies and consumer-protection law — which mostly means: whatever the policy says, plus FTC enforcement when companies lie about it.

The routine leak isn't a hacker — it's business as usual: apps sharing 'de-identified' or ad-ID-linked data with brokers, web trackers on health-related pages reporting your visits into ad profiles, and quizzes built explicitly to harvest conditions. Regulators have repeatedly acted against period-tracking and therapy apps for exactly this. Assume any free consumer health tool monetizes data unless its policy convincingly says otherwise.

One: keep identifying health details out of consumer chatbots and quizzes — symptoms yes, identity no. Two: prefer your provider's portal for anything real; it's the HIPAA-covered channel. Three: in phone settings, reset or limit your advertising ID and review which apps hold health permissions. Four: for sensitive searches, a private browser window and skipping 'log in with' buttons breaks most easy linkage. Five: before installing a health app, read just the 'data sharing' section of its policy — 'we share with partners for advertising' means exactly that.

New Yorkers get one extra protection worth knowing: New York's SHIELD Act requires companies holding state residents' private data to maintain real safeguards and disclose breaches — one more reason breach notices deserve two minutes of your attention rather than the trash.