Is your health app private? What to check

What HIPAA covers

HIPAA's privacy and security rules apply to two groups, which the US Department of Health and Human Services (HHS) calls covered entities and business associates.

• Covered entities are health care providers (such as doctors, clinics, dentists and pharmacies, if they transmit health information electronically in certain standard transactions), health plans (such as health insurance companies, HMOs, company health plans, Medicare and Medicaid) and health care clearinghouses.
• Business associates are people and companies that create, receive, maintain or transmit protected health information on behalf of a covered entity, such as a company that runs a patient portal for a provider.

If an organization is neither, HHS says it doesn't have to comply with the HIPAA Rules.

Why most health apps you download aren't covered

HHS's guidance for consumers is direct: HIPAA generally doesn't protect health information on your personal phone or tablet. In most cases, unless the app is provided to you by a covered entity or its business associate, HIPAA doesn't protect what you enter into an app for your own use, wherever that information came from.

HHS's health app scenarios make this concrete:

• You download an app and type in your own readings. HIPAA doesn't apply to the developer.
• Your doctor recommends an app, and you use it to send them a summary. Still not covered. A recommendation doesn't make the developer a business associate, and neither does sending your data to the doctor.
• Your provider or health plan hires a developer to provide an app as part of its services. HIPAA applies to that work. If the same developer also offers a separate version directly to consumers, that version isn't covered.

So a useful first question is: who gave you the app? If you found it in the App Store yourself and you enter your own records, HIPAA most likely doesn't apply. If your provider or health plan provides it, it may.

HHS also warns that information your phone and apps collect can be used to send you ads, or sold to data brokers. That's why the practical questions below matter more than which law applies.

Questions to ask any health app

Whichever law applies, these questions show how an app actually handles your records. Most of the answers are on its App Store page, in its privacy policy and help pages, or in its settings.

Where are my records stored? On your phone, on the company's servers, or both. Records kept only on your phone are as private as the phone is, and can be lost with it. Records on a company's servers can follow you to a new phone, but the company, and any service providers it uses, hold them too. Either can be a reasonable choice, as long as you know which one you're making.

Is there an account, and what does it hold? Only your email address and name, or your health records as well? If the policy names other companies that hold account data, such as a sign-in provider, note who they are.

Does it use ad trackers or share data for advertising? Each app's App Store page has an App Privacy section, where the developer says what data the app may collect, whether it's linked to you and whether it's used to track you. Apple says this information is self-reported by the developer, so read it alongside the privacy policy. On your iPhone, go to Settings, then Privacy & Security, then Tracking, to see which apps have asked to track your activity across other companies' apps and websites. You can turn off "Allow Apps to Request to Track" there too.

Is there a copy in the cloud? If there is, ask where it's stored and who can reach it. If there isn't, keeping a copy is up to you, usually by exporting.

Can I export my records, and in what format? An export is your own copy, and the simplest way to share your records with a clinician. A CSV file opens in spreadsheet apps, JSON keeps the full structure, and some apps make PDFs. Check what's left out, and keep the file somewhere private: see how to store your records safely.

How do I delete my account, and what does that remove? Apple requires App Store apps that let you create an account to also let you start deleting it from within the app. Check whether deletion covers the records on your phone and any copies on servers, and whether the privacy policy gives a timescale. Deleting an app from your phone usually isn't the same as deleting your account.

What permissions does it ask for, and what shows on my lock screen? HHS suggests not giving apps your location unless they really need it, and the FTC suggests turning off permissions an app doesn't need. Reminders can also show what's due to anyone who glances at your phone, so see whether the app can hide the details.

What does the privacy policy say? The FTC suggests checking that it explains, in simple terms, what health information the app collects and how it uses and shares it. Look for whether it sells your data or shares it with advertisers, analytics companies or researchers, and what it says about breaches. The FTC also notes that default settings often encourage sharing, so review them after you install an app.