77% of US adults are concerned about the privacy of medical information they give to AI tools, according to a KFF tracking poll of 1,343 US adults published March 25, 2026. That concern sits alongside a health data landscape that already generates 710 HHS-reported breaches a year and covers only part of where health information actually lives, since HIPAA itself stops well short of most consumer health apps.
Below is how AI is reshaping patient trust, what 2025's breach numbers actually show, how far patient portal adoption has come, and where HIPAA's legal coverage runs out.
How worried are patients about AI and their health data?
77% of US adults say they are concerned about the privacy of personal medical information provided to AI tools, according to KFF's tracking poll, and that concern holds across age groups and even among people who already use AI for health purposes. At the same time, 32% of adults report turning to AI for health information or advice, split between 29% for physical health questions and 16% for mental health questions.
The gap between stated concern and actual behavior is wide. 41% of adults who use AI for physical or mental health questions, about 13% of all adults surveyed, said they had uploaded personal medical information into an AI tool despite their own privacy concerns.
Figure 1: Share of US adults concerned about the privacy of medical information given to AI tools, 2026. Source: KFF Tracking Poll on Health Information and Trust, March 2026.
That behavior gap matters because most consumer-facing AI tools are not covered entities under HIPAA, so information a patient types into a general-purpose chatbot typically carries none of HIPAA's legal protections, regardless of how sensitive it is.
How many healthcare data breaches happened in 2025?
HHS's Office for Civil Rights logged 710 healthcare data breaches affecting 500 or more individuals in 2025, a 4.3% decrease from 2024, according to HIPAA Journal's tracking of the federal breach portal. Those breaches exposed roughly 61.6 million individuals' protected health information, a sharp drop from 2024's total, which was inflated by a small number of mega-breaches. HIPAA Journal notes that breach counts have plateaued in the 700 to 750 range since the sharp increases seen between 2018 and 2021, now running at roughly two large breaches a day nationwide.
Where the breach happens matters more than the raw count for understanding what went wrong. Network servers accounted for 61.5% of 2025 breach locations, followed by email accounts at 24.9%, physical records at 5.6%, and electronic medical records specifically at 4.6%.
Figure 2: Location of protected health information in 2025 healthcare breaches. Source: HIPAA Journal, 2025 Healthcare Data Breach Report.
Hacking incidents also differ sharply in scale from other causes: hacking-related breaches averaged 105,623 affected individuals each, compared with 9,909 for unauthorized access or disclosure incidents, meaning a small number of large hacks drive most of the total exposure figure even though they are not the most frequent cause. For a full breakdown of the largest individual breaches and their enforcement follow-up, see HIPAA Violation Statistics: Fines and Cases.
How much progress has patient portal access made?
77% of individuals nationwide were offered online access to their health information in 2024, up from 73% in 2022, according to ONC's data brief on patient engagement technology. Adoption of the underlying hospital capabilities is now close to universal: 99% of hospitals let patients view their records online, 96% support downloading them, and 92% support secure messaging with a provider.
Figure 3: Share of individuals offered online access to their health records, 2024. Source: ONC, Individuals' Access and Use of Patient Portals and Smartphone Health Apps, 2024.
Actual engagement is climbing even faster than access. Frequent portal users, people who logged in six or more times in the past year, more than doubled from 15% in 2019 to 34% in 2024, and caregiver or proxy access more than doubled over the same period, from 24% to 51%. Mobile is now the primary access method: 57% of patients used a smartphone app to view their records in 2024, versus 42% who used a web browser.
Where does HIPAA's coverage actually stop?
HIPAA only applies to covered entities, health plans, healthcare providers, and healthcare clearinghouses, plus their business associates. A standalone health, fitness, or period-tracking app with no relationship to a covered entity generally falls outside HIPAA entirely, no matter how sensitive the data it collects.
Figure 4: The coverage test that determines whether HIPAA, a state health privacy law, or only the FTC's general authority applies to a given app or service. Source: HHS HIPAA covered entity guidance; FTC Health Breach Notification Rule.
Businesses handling health-adjacent data outside HIPAA's boundary still need clear, accurate disclosures. A privacy policy that documents exactly what health-related data is collected, and under which legal framework, is the baseline expectation regulators and users hold even when HIPAA itself does not apply.
What is driving healthcare privacy risk into 2026?
Enforcement pressure and technology adoption are both accelerating at once. OCR's HIPAA Right of Access and Risk Analysis Initiatives have pushed compliance failures into public view faster than in prior years, even as breach counts themselves have leveled off.
Figure 5: Healthcare privacy and data-access milestones, 2019 to 2026. Source: ONC data briefs; HIPAA Journal; KFF Tracking Poll, March 2026.
Small healthcare practices face the same pressure with fewer resources than large hospital systems; see 64% of Small Firms Document Privacy Policies: 2026 Data for how documentation gaps play out across small businesses generally, a pattern that shows up acutely in smaller medical and dental practices.
The Bottom Line
Healthcare privacy in 2026 is no longer just a HIPAA compliance question. Breach counts have plateaued around 700 to 750 a year, patient portal adoption keeps climbing, and a new front, AI tools handling medical questions, has opened up almost entirely outside HIPAA's legal boundary, with 77% of patients uncomfortable about it and a meaningful share uploading sensitive data anyway. Any organization touching health-adjacent data, whether or not it is a HIPAA covered entity, needs a privacy policy generator that states plainly what legal framework applies and what happens to the data collected. A closer look at fintech's parallel compliance gap is available in Fintech Privacy Statistics 2026: Data and Compliance.
Frequently Asked Questions
How many people worry about AI tools handling their health data? 77% of US adults say they are concerned about the privacy of personal medical information provided to AI tools, according to a KFF tracking poll published March 25, 2026, based on a survey of 1,343 US adults. Despite that concern, 41% of adults who use AI for health information said they had uploaded personal medical information into an AI tool anyway.
How many healthcare data breaches were reported in 2025? 710 healthcare data breaches affecting 500 or more individuals were reported to HHS's Office for Civil Rights in 2025, a 4.3% decrease from 2024, exposing roughly 61.6 million individuals' protected health information, according to HIPAA Journal's tracking of the federal breach portal.
Does HIPAA cover data from health and wellness apps? Almost never. HIPAA only applies to covered entities, health plans, providers, and clearinghouses, and their business associates. A standalone fitness, period-tracking, or mental health app with no affiliation to a covered entity generally falls outside HIPAA entirely, regardless of how sensitive the data is.
How many patients now have online access to their health records? 77% of individuals nationwide were offered online access to their health information in 2024, up from 73% in 2022, according to ONC's data brief on patient portal use. Frequent portal use, six or more visits a year, has more than doubled since 2019, from 15% to 34% of respondents.
Where the Numbers Come From
- KFF. (2026). "KFF Tracking Poll on Health Information and Trust: Use of AI for Health Information and Advice." Published March 25, 2026, survey of 1,343 US adults.
- HIPAA Journal. (2026). "2025 Healthcare Data Breach Report." 710 breaches, 61.6 million individuals affected, breach cause and location breakdown.
- ONC (Office of the National Coordinator for Health IT). (2025). "Individuals' Access and Use of Patient Portals and Smartphone Health Apps, 2024." Patient portal offer and usage rates.
- HHS. HIPAA covered entity and business associate guidance, defining HIPAA's legal scope.
Note: All figures verified as of September 2026. The HHS OCR breach portal is continuously updated as investigations close, so 2025's final breach count and affected-individual total may still shift upward from the figures reported here. This post's figures are refreshed at least twice a year to track newer editions of the underlying reports.
