HIPAA does not protect every piece of sensitive or medical information. It generally applies when identifiable health information is handled by a covered health care entity or by a business associate working for one. Data on your phone or in an independent consumer app may fall outside HIPAA—even if it came from a medical record—though other laws, including FTC rules, may apply.
When does HIPAA protect health information?
HIPAA’s Privacy, Security, and Breach Notification Rules apply to covered entities and, in relevant circumstances, their business associates. Covered entities include health plans, certain health care providers, and health care clearinghouses. Business associates perform specified services for covered entities that involve protected health information (PHI).
As an Amazon Associate I earn from qualifying purchases.
The key questions are who holds or handles the information and in what role. Information can be highly sensitive without being subject to HIPAA. Conversely, identifiable health information handled by a regulated entity in its covered role may be PHI.
- Provider portal: A portal operated by a health care provider generally handles information within the provider’s covered operations.
- Provider-sponsored app: If the app is offered by or on behalf of a provider and handles ePHI for it, the app may be the provider’s business associate.
- Independent consumer app: An app used on your own, without acting for a covered entity, is not automatically covered by HIPAA just because it stores health information.
For any app, consider who operates it, whether it handles information on behalf of a covered entity, and whether the data identifies someone and is linked to health. Other laws may also apply.
#1 Best Overall
Does HIPAA protect health information on your phone or in an app?
Usually not when personal device data or app information is not handled by or for a HIPAA-regulated entity. Health information you enter into an unrelated app, as well as personal phone data, search history, and location data, is generally outside HIPAA’s scope. The information’s medical sensitivity or origin alone does not change that.
If you ask a provider to send records to an independent app
HHS says that when a covered entity sends ePHI to an app at an individual’s direction, and the app is neither a covered entity nor a business associate, the information is no longer subject to HIPAA Rules once received by the app. HHS also says the provider generally is not liable under HIPAA for the independent app’s later use or breach after fulfilling that request.
The result can differ if the app handles ePHI for the provider. In that case, the app may be a business associate, and the provider may have HIPAA exposure for an impermissible disclosure. The app’s relationship to the provider—not simply its health focus—is central to the distinction. HHS: liability when a covered entity sends ePHI to an app at an individual’s request.
Recommended Free Tools
What can protect health data outside HIPAA?
Outside HIPAA does not mean outside all legal protection. The FTC Act and the FTC Health Breach Notification Rule can apply to some health technology companies and consumer health apps that are not covered by HIPAA. Which rules apply depends on the service and the facts; not every app or dataset is covered by the same law. FTC Health Breach Notification Rule.
Rank #3
State privacy laws and other federal rules may add protections. Their application varies, so HIPAA’s boundary alone does not determine all the rights or notice duties that may apply to a particular incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What happens after a HIPAA data breach?
Under HHS’s Breach Notification Rule, a breach generally involves an impermissible use or disclosure of PHI that compromises its privacy or security. A breach is presumed unless the regulated entity demonstrates a low probability that the PHI was compromised through a risk assessment. That assessment considers the nature and extent of the information, who received it, whether it was acquired or viewed, and what mitigation occurred.
Rank #4
The rule has three exceptions for specified circumstances: certain good-faith access within the organization’s authority, certain inadvertent disclosures between authorized people, and disclosures where the recipient could not reasonably retain the information. Whether an exception or the low-probability assessment applies depends on the facts.
Which information triggers HIPAA breach notice?
The HIPAA Breach Notification Rule applies to breaches of unsecured PHI. HHS guidance identifies encryption and destruction as methods that can render information unusable, unreadable, or indecipherable to unauthorized people for this purpose. A breach involving secured information therefore does not trigger this rule’s notice requirement on that basis, though other obligations may still be relevant.
Best Value
Who must be notified, and by when?
For a reportable breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. It must also report the breach to HHS. HHS’s deadlines for that report vary by the number of affected people:
| People affected | HHS reporting deadline |
|---|---|
| 500 or more | No later than 60 days after discovery |
| Fewer than 500 | May be reported annually; due no later than 60 days after the end of the calendar year in which the breach was discovered |
The annual reporting option for incidents affecting fewer than 500 people does not extend the individual-notice deadline. The 60-day individual-notice limit and reporting rules are described by HHS’s Breach Notification Rule.
Quick Recap
How to assess a health-data exposure
- Identify the holder. Determine whether the information was with a health plan, provider, clearinghouse, or a service working for one.
- Check the app’s role. Ask whether the app operates independently or handles data on behalf of a covered entity. A provider’s act of sending records at your direction to an independent app does not make that app a business associate.
- Establish what was exposed. Consider whether the information identifies a person and is linked to health, and whether it was unsecured. Those facts matter to HIPAA’s application and breach-notice rules.
- Look beyond HIPAA. If an independent consumer service was involved, FTC rules or state and other federal laws may still be relevant.
- For a suspected regulated-entity breach, seek the entity’s notice or contact its privacy office. HIPAA’s assessment and notification duties depend on the incident’s facts; an exposure report alone does not establish that a reportable HIPAA breach occurred.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
