81% of Americans wrongly believe that HIPAA protects the health data collected by digital health apps, according to a Harris Poll survey of 2,053 U.S. adults conducted for ClearDATA in May 2023. That belief is mistaken for the vast majority of the fitness trackers, period-tracking apps, mental health platforms, and AI health chatbots people use every day, because HIPAA only reaches "covered entities" and their business associates, not standalone consumer apps.
The gap between what people assume and what the law actually covers is exactly where a patchwork of newer rules has emerged: three state consumer health data statutes, an expanded FTC enforcement rule, and an amended California medical privacy law. Below is what each one covers, who enforces it, and how much has already been collected in penalties.
How many Americans think HIPAA covers health apps?
Most Americans overestimate HIPAA's reach, and the misunderstanding is specific enough to measure. The Harris Poll survey for ClearDATA found that 81% of respondents believed the health data collected by digital health apps is covered by HIPAA and subject to its Privacy and Security Rules, even though 68% of the same respondents claimed familiarity with HIPAA itself. The mismatch matters because 37% of respondents reported having used a digital health app, 44% an online healthcare platform, and 39% a pharmacy mobile app, all categories where HIPAA frequently does not apply.
| Survey finding | Share of respondents |
|---|---|
| Believe HIPAA covers all health app data | 81% |
| Claim familiarity with HIPAA | 68% |
| Never considered where their health data is shared | 58% |
| Prioritize privacy or security when picking a provider | 27% |
Table: Harris Poll survey results for ClearDATA, n=2,053 U.S. adults, conducted May 24 to 26, 2023, margin of error plus or minus 2.7 percentage points at 95% confidence.
A 2019 peer-reviewed study in JAMA Network Open illustrates why the gap matters in practice. Researchers reviewed 36 top-ranked apps for depression and smoking cessation and found that 33 of the 36 (92%) transmitted data to services operated by Facebook or Google, information that could reveal a user's mental health status to advertisers, while only 12 of those apps disclosed the practice accurately in their own privacy policy. The apps studied predate several of the state and federal rules covered below, but the underlying structural gap, that most consumer health apps sit outside HIPAA, has not closed.
What does HIPAA actually cover, and what does it leave out?
HIPAA is not a blanket health-privacy law. It applies only to "covered entities," healthcare providers, health plans, and healthcare clearinghouses, plus their "business associates" who handle data on a covered entity's behalf. A period-tracking app, a wellness wearable, or a direct-to-consumer telehealth platform that never bills insurance or partners with a covered entity typically falls entirely outside HIPAA's Privacy and Security Rules, regardless of how sensitive the data it collects.
That gap is why the U.S. Department of Health and Human Services has published guidance clarifying that HIPAA "does not provide a blanket, overarching protection to all medical, health, or wellness information." For a business that collects health-adjacent data without a HIPAA-covered relationship, the practical compliance question shifts entirely to state consumer health data laws, the FTC's Health Breach Notification Rule, and general state privacy law, not HIPAA.
Figure 1: How a health-adjacent business figures out which rule actually applies once HIPAA is ruled out. Source: HHS Office for Civil Rights guidance, state consumer health data statutes.
Most of the 20 comprehensive state privacy laws in effect nationwide already classify health information as "sensitive data" requiring opt-in consent, so a business handling health data outside HIPAA is rarely in a total regulatory vacuum. See the full list of state privacy laws for how each state's baseline sensitive-data rule works before layering the dedicated health statutes below on top.
Which states have passed a dedicated consumer health data law?
Washington was first, enacting the My Health My Data Act in April 2023 with most obligations taking effect March 31, 2024. Nevada followed within weeks with SB 370, modeled closely on Washington's law but narrower in scope, and Connecticut added consumer health data provisions to its existing Connecticut Data Privacy Act, effective October 1, 2023. All three apply with no minimum revenue or user threshold, meaning even a small health app can be in scope.
| State | Law | Effective date | Private right of action |
|---|---|---|---|
| Washington | My Health My Data Act | March 31, 2024 | Yes, treble damages up to $25,000 |
| Nevada | SB 370 | March 31, 2024 | No, AG enforcement only |
| Connecticut | CTDPA health data amendment | October 1, 2023 | No, AG enforcement only |
| New York | Health Information Privacy Act (revised) | Pending signature as of mid-2026 | No, AG and other officials only |
Washington's law is the most consumer-friendly of the three because it is the only one that lets an individual sue directly. A violation is treated as a per se violation of Washington's Consumer Protection Act, and beyond the $25,000 treble-damages cap, the state Attorney General can separately seek a civil penalty of up to $7,500 per violation. For more on how that private right of action compares across every state's privacy statute, not just the health-specific ones, see the state-by-state private right of action comparison.
New York came closest to becoming a fourth state in January 2025, when both legislative chambers passed the New York Health Information Privacy Act, but Governor Hochul vetoed the bill in December 2025 after businesses argued its definitions of "regulated health information" and "regulated entities" were too broad. Lawmakers reintroduced a revised version with far more exemptions in 2026; as of this post's publication it had passed both chambers again and was awaiting the governor's signature.
Figure 2: Timeline of state and federal health data privacy milestones. Sources: Washington MHMDA, Nevada SB 370, Connecticut CTDPA amendment, California AB 254, FTC press releases, New York State Senate records.
How is the FTC enforcing health data privacy outside HIPAA?
The FTC has used its Health Breach Notification Rule, a rule that predates most state health data laws, to bring five enforcement actions against health apps and platforms since February 2023, none of which were HIPAA covered entities. Combined, the assessed civil penalties and monetary relief across those five cases exceed $18.9 million, though regulators later waived a portion of the Cerebral and Monument penalties after both companies said they could not pay.
| Company | Announced | Penalty or relief | Allegation |
|---|---|---|---|
| GoodRx | February 2023 | $1.5 million | Shared health data with Facebook, Google, and Criteo for ads |
| BetterHelp | March 2023 | $7.8 million | Shared health questionnaire data with Facebook and Snapchat |
| Premom (Easy Healthcare) | May 2023 | $100,000 | Shared ovulation-tracking data with advertisers |
| Cerebral | April 2024 | $7 million | Disclosed nearly 3.2 million patients' data via tracking tools |
| Monument | April 2024 | $2.5 million (waived) | Disclosed alcohol treatment data without consent |
Figure 3: Share of FTC Health Breach Notification Rule penalties by case, 2023 to 2024. Source: FTC press releases for each case, listed below.
The pace of enforcement accelerated rather than slowed once the FTC established that its Health Breach Notification Rule reaches apps HIPAA never touches. The cumulative total assessed climbed from $1.5 million after the first case to nearly $19 million within fourteen months.
Figure 4: Running total of assessed FTC Health Breach Notification Rule penalties, in order of case announcement. Source: FTC press releases, February 2023 to April 2024.
Does California's medical privacy law cover more than HIPAA?
Yes, for reproductive and sexual health data specifically. California's Confidentiality of Medical Information Act (CMIA) has applied more broadly than HIPAA since 1981, but AB 254, signed by Governor Newsom in September 2023 and effective January 1, 2024, expanded it further. The amendment redefines "medical information" to include reproductive or sexual health application data and deems any business offering a reproductive or sexual health digital service a "provider of health care" under the CMIA, even if that business has no connection to a licensed medical provider.
That reclassification matters because it pulls period-tracking apps, fertility apps, and similar reproductive-health digital services in California under a state medical privacy statute for the first time, closing a gap that became a national talking point after the 2022 Dobbs decision raised concerns about app data being used against people seeking reproductive care. A business offering this kind of app to California users needs a privacy policy that reflects CMIA obligations specifically, not just a generic template, and can generate a privacy policy covering health and medical data disclosures as a starting point before adding CMIA-specific consent language.
The Bottom Line
HIPAA was written for hospitals, insurers, and clearinghouses, not for the fitness tracker on a consumer's wrist or the mental health app on their phone, and 81% of Americans have not caught up to that fact. The laws that have moved in to cover the gap are still a patchwork: three states with dedicated consumer health data statutes, an FTC rule that has already produced nearly $19 million in assessed penalties across five cases, and one state medical privacy law that reaches further than HIPAA for a specific category of data. A business collecting health-adjacent information from users in Washington, Nevada, Connecticut, or California needs to treat each of those regimes as a separate compliance obligation, not as something HIPAA already covers by default. The safest starting point is a privacy policy that discloses exactly what health data is collected, why, and who it is shared with, since that disclosure requirement runs through every law covered above.
Frequently Asked Questions
Does HIPAA cover data from fitness trackers and period-tracking apps? No, in almost every case. HIPAA only applies to "covered entities," health plans, healthcare providers, and clearinghouses, and their business associates. A standalone app downloaded from an app store, with no affiliation to a covered entity, falls outside HIPAA entirely, which is why 81% of Americans hold a mistaken belief about their coverage, per a 2023 Harris Poll for ClearDATA.
Which states have a dedicated consumer health data privacy law? Three as of 2026: Washington's My Health My Data Act, Nevada's SB 370, and Connecticut's amended Data Privacy Act, all enacted in 2023. New York passed a fourth, the New York Health Information Privacy Act, in January 2025, but Governor Hochul vetoed it in December 2025, and a revised version was awaiting her signature as of mid-2026.
Can I sue a company for misusing my health data under Washington's law? Yes, if the company is subject to Washington's My Health My Data Act. Consumers can bring a private lawsuit seeking actual damages, injunctive relief, and treble damages up to $25,000 per violation. Nevada's SB 370 and Connecticut's amended law do not include a private right of action; only the state Attorney General can enforce those two.
How much has the FTC fined health apps for privacy violations since 2023? More than $18.9 million in combined civil penalties and monetary relief across five Health Breach Notification Rule cases since February 2023: GoodRx, BetterHelp, Premom, Cerebral, and Monument. Regulators waived a portion of the Cerebral and Monument penalties after both companies cited an inability to pay.
Where the Numbers Come From
- ClearDATA. (2023). "Survey Reveals Many Americans Don't Realize Personal Data Shared With Digital Health Apps Could Be Sold Without Their Consent." Harris Poll, n=2,053 U.S. adults, conducted May 24 to 26, 2023.
- JAMA Network Open. Huckvale, K., et al. (2019). "Assessment of the Data Sharing and Privacy Practices of Smartphone Apps for Depression and Smoking Cessation." 36 apps reviewed, 33 of 36 transmitted data to Facebook or Google services.
- Federal Trade Commission. (2023). "FTC Enforcement Action to Bar GoodRx From Sharing Consumers' Sensitive Health Info for Advertising." $1.5 million civil penalty, February 2023.
- Federal Trade Commission. (2023). "FTC Gives Final Approval to Order Banning BetterHelp From Sharing Sensitive Health Data for Advertising, Requiring It to Pay $7.8 Million." July 2023.
- Federal Trade Commission. (2023). "Ovulation Tracking App Premom Will Be Barred From Sharing Health Data for Advertising Under Proposed FTC Order." $100,000 civil penalty, May 2023.
- Federal Trade Commission. (2024). "Proposed FTC Order Will Prohibit Telehealth Firm Cerebral From Using or Disclosing Sensitive Data for Advertising Purposes, and Require It to Pay $7 Million." April 15, 2024, nearly 3.2 million consumers affected.
- Federal Trade Commission. (2024). "Alcohol Addiction Treatment Firm Will Be Banned From Disclosing Health Data for Advertising to Settle FTC Charges That It Shared Data Without Consent." Monument, $2.5 million civil penalty waived, April 11, 2024.
- Covington Digital Health. (2023). "California Enacts Amendments to the CMIA." AB 254 signed September 27, 2023, effective January 1, 2024.
- Morrison Foerster. (2026). "NYHIPA Returns in 2026: Revised Health Information Privacy Bill Introduced in New York." Following Governor Hochul's December 2025 veto of the original bill.
Note: All figures verified as of August 2026. The New York Health Information Privacy Act's revised version was awaiting the governor's signature as of this post's publication and may change status before this post's next refresh. FTC penalty figures for Cerebral and Monument reflect assessed amounts; a portion of each was waived due to the companies' stated inability to pay. Figures are refreshed at least twice a year to track new state legislative sessions and FTC enforcement activity.
