Does HIPAA Apply to Fitness & Health Apps? Wearables Guide
Quick Answer
HIPAA generally does not apply to consumer fitness apps or wearables unless they are specifically marketed for medical/healthcare purposes or connected to healthcare providers. Most fitness data is protected by consumer privacy laws, not HIPAA.
Myth vs. Reality
❌ Myth: All fitness and health apps are HIPAA-protected
Many users assume any app collecting health data must follow HIPAA rules.
✓ Reality: Most fitness apps aren't HIPAA-covered
HIPAA applies only to healthcare providers, health plans, and business associates. Most consumer fitness apps (like Fitbit, Apple Health, Strava) are commercial software companies not covered by HIPAA. Consumer privacy laws govern their practices instead.
❌ Myth: Wearables like smartwatches are protected by HIPAA
Users often think smartwatch health data gets HIPAA protection.
✓ Reality: Wearables are consumer devices with different privacy rules
Smartwatches and fitness trackers are consumer products governed by general privacy laws, not HIPAA. However, if they're prescribed as medical devices by a doctor or used in a healthcare setting, some protections may apply.
❌ Myth: If an app has HIPAA in its marketing, it means it's fully HIPAA-compliant
Some companies claim to be "HIPAA-compliant" to attract users.
✓ Reality: HIPAA compliance claims require scrutiny
An app can claim compliance, but you should verify they're actually a covered entity or business associate. Many apps falsely market themselves as HIPAA-compliant when they're simply privacy-conscious consumer apps subject to other laws.
Understanding Health App Privacy Laws
When HIPAA Applies to Health Apps
HIPAA covers a health app or wearable only if:
- The app/device maker is a healthcare provider treating patients
- The app/device is part of a health plan's operations
- The app/device functions as a healthcare clearinghouse
- The app/device is a business associate to a covered entity
- The device is prescribed as a medical device by a doctor for treatment
Consumer Privacy Laws That Apply Instead
CCPA (California Consumer Privacy Act): Applies to for-profit companies collecting personal information from CA residents:
- Right to know what data is collected
- Right to delete personal information
- Right to opt-out of data sales
- Right to non-discrimination for exercising CCPA rights
CPA (Colorado Privacy Act) & Similar State Laws: Similar to CCPA, apply to residents of Colorado and other states.
FTC Act Section 5: Prohibits unfair or deceptive practices in data handling:
- Apps collecting health data must follow their privacy policies
- Data cannot be used for purposes users didn't consent to
- Must implement reasonable security measures
- Violators can be fined and forced to change practices
What to Check in a Fitness App's Privacy Practices
1. Privacy Policy: Always read it. Look for:
- What data is collected (steps, heart rate, GPS location, etc.)
- Who has access (company employees, third parties, advertisers)
- How long data is retained
- Whether data is sold to third parties
2. Security Measures: Check for:
- Encryption of data in transit and at rest
- Two-factor authentication options
- Regular security testing
- Data breach incident response procedures
3. Third-Party Sharing: Understand:
- Whether your data is shared with advertisers
- If data can be sold to data brokers
- What happens in bankruptcy or acquisition
- Whether you can opt-out
Health Devices FDA Regulates
Some devices are classified as medical devices by the FDA:
- Devices providing medical diagnoses or treatment recommendations
- Devices measuring clinical parameters (ECG, blood glucose)
- Devices with healthcare provider prescriptions
Frequently Asked Questions
Q: Can a fitness app company sell my health data?
A: They can if their privacy policy permits it. However, they must follow their stated practices and state privacy laws. Many states (CA, CO, etc.) allow you to opt-out of data sales. Always read the privacy policy before using an app.
Q: Is my data more protected if my doctor recommends an app?
A: Not necessarily. Even if a doctor recommends it, the app isn't automatically HIPAA-covered. Ask your doctor if the app is a business associate under a BAA. If not, it's governed by consumer privacy laws.
Q: Can I get compensation if a fitness app is hacked?
A: Possibly, under state breach notification laws and consumer protection statutes. You may pursue claims for actual damages (credit monitoring costs, fraud losses) or statutory damages if the company failed to notify you timely.
Q: What should I do if a fitness app misuses my data?
A: File a complaint with the FTC, your state attorney general, or relevant state agencies. You can also delete the app and consider filing a private lawsuit for breach of contract or consumer protection violations.
Understand Your Health Data Privacy Rights
Get a comprehensive security risk analysis to understand what privacy protections apply to your health data across different platforms and apps.
Get Your Risk Analysis →