It depends on who runs the AI tool, not on the fact that it uses AI. HIPAA only applies to health care providers, health plans, clearinghouses and the business associates that work for them, so an AI app you download on your own is often outside HIPAA. Many of those apps fall under the FTC instead, which can act when an app breaks its privacy promises or shares health data without permission. Before you type symptoms into any AI tool, read what it says it collects, who it shares with, and whether you can delete it.
Does HIPAA cover AI doctor apps?
HIPAA is not a rule about health information in general. It is a rule about who holds it. HHS says the HIPAA Rules apply to covered entities and business associates, and if an organization does not meet either definition, it does not have to comply with the HIPAA Rules.
Covered entities are health care providers (such as doctors, clinics, psychologists, dentists and pharmacies, but only if they send certain health care transactions electronically, such as insurance claims), health plans, and health care clearinghouses. A business associate is a company a covered entity hires to help with its health care work, under a written contract that requires it to protect your information.
So the same AI tool can sit in different places depending on how you reach it:
- An AI tool your clinic or hospital gives you, such as a chat feature in its patient portal, is often provided by or on behalf of the provider. HHS says that kind of app can be in a business associate relationship, so HIPAA rules can follow your data there.
- An AI app or chatbot you find and sign up for yourself, with no link to your provider, is often not a covered entity or business associate. HIPAA may not apply at all.
- Records you send from your provider to an app you chose: HHS says once an app that is neither a covered entity nor a business associate receives your records at your direction, that information is no longer protected by the HIPAA Rules.
If HIPAA does not apply, what protects me?
For many consumer health apps, the FTC can step in instead. It took action against the Flo period app after it shared health data it had promised to keep private. The FTC's Health Breach Notification Rule also covers health apps and connected devices that are not covered by HIPAA.
Two parts of that rule matter for you:
- A breach is not only a hack. The FTC says a breach includes unauthorized disclosures, such as sharing your health data with an ad network without your permission.
- You must be told. A covered app must notify affected people without unreasonable delay and within 60 calendar days of discovering a breach, and the notice must say what kinds of health information were involved and which third parties got it.
What should I check before I type symptoms into an AI?
The FTC's tips for health apps are a good start for any AI doctor or medical chatbot. Read the privacy policy before your first message, and look for direct answers to these questions:
- What does it collect? Look for a plain list of the health information it keeps from your chats.
- Who does it share with? Watch for advertising, analytics or "partners" with no explanation. The FTC says Flo shared users' health information with marketing and analytics companies like Facebook and Google after promising to keep it private.
- Does it sell your data or use it for ads? A clear "no" is what you want.
- Can you change the settings? The FTC notes defaults often favor sharing, so pick the more protective options.
- Can you delete your data? Look for a way to request deletion.
- Is it tied to a provider? If it is, ask whether HIPAA applies to your chats.
What does "de-identified data" mean in a privacy policy?
Many health privacy policies say they may use or share "de-identified" data. Under HIPAA, that means either 18 types of identifiers are removed, such as names, street addresses, phone numbers, email addresses and dates other than the year, or an expert finds the risk of identifying someone is very small.
HHS is clear about 2 limits. First, the risk of linking de-identified data back to a person is very small but not zero. Second, HIPAA does not restrict how de-identified data is used or shared, because it no longer counts as protected health information. If a policy says it shares de-identified data, it is fair to ask who receives it and why.
Outside HIPAA, an app may use the term loosely. Read the definition in the policy itself.
How does Pymander handle my data?
Pymander's safety page states its practices: your data is encrypted when it is sent and when it is stored, protected with HIPAA-aligned safeguards, and never sold or used for ads. You choose what to connect and who sees your notes, and every consult is saved to your care notes so you and your doctor can see what was said.
Pymander describes these as "the same kinds of protections hospitals use." HIPAA-aligned is not the same as saying HIPAA legally applies, so read the safety page and privacy policy for the exact wording, the same way you would for any AI tool.
When should you get care?
In an emergency, call 911Do not let privacy worries stop you from getting care. If symptoms are getting worse fast, or you are not sure they can wait, see a clinician or urgent care the same day.
Call 911 for a medical emergency, not an app or chatbot. If you are in a mental health crisis or thinking about suicide, call or text 988.
How our AI doctor decides when to send you to care ›How can I share less and still get help?
Whatever tool you use, you control what you type. A few habits lower your risk:
- Share the details the question needs: symptoms, timing, age, medications. Skip your Social Security number, insurance ID or full address unless a provider asks for them.
- Do not paste full medical records into a general chatbot that is not built for health care. The FTC's advice is to share only what you are comfortable with.
- Keep the app and your phone updated, since updates often fix privacy and security problems.
- If an app breaks its privacy promises, report it at reportfraud.ftc.gov. If you think a provider or health plan violated HIPAA, you can file a complaint with HHS.
Common questions
Is my health data private with an AI doctor?
It depends on who runs it. HIPAA covers providers, health plans and their business associates, so an AI tool your clinic gives you usually falls under HIPAA, while one you sign up for yourself often does not. Many consumer health apps fall under the FTC instead. Check the privacy policy for what it collects, who it shares with, and how to delete your data.
Is ChatGPT or another general chatbot covered by HIPAA?
HIPAA applies only to covered entities and their business associates. A general-purpose chatbot you use on your own is usually neither, so HIPAA protections may not apply to what you type. Read that company's privacy policy and settings before sharing health details.
Can an AI health app sell my data?
Outside HIPAA, what an app may do depends largely on its own privacy promises, and the FTC has acted against an app that broke them. For apps covered by the FTC's Health Breach Notification Rule, sharing health data without your permission counts as a breach that must be reported to you. Look for a clear statement that the app does not sell your data or use it for ads.
If my doctor sends my records to an app, does HIPAA still protect them?
Not if you chose the app and it is not working for your provider. HHS says once such an app receives your records at your direction, the information is no longer protected by the HIPAA Rules. If the app was provided by or on behalf of your provider, HIPAA can still apply.
Is de-identified health data safe?
HHS says the risk of linking de-identified data back to a person is very small, but not zero. HIPAA also does not limit how de-identified data is used or shared, because it is no longer protected health information. If a policy mentions it, look for who receives it and why.
Where do I report an AI app that misused my health data?
Report apps that break their privacy promises to the FTC at reportfraud.ftc.gov. If the problem involves a doctor, clinic, pharmacy or health plan, you can file a HIPAA complaint with HHS.
Pymander is not a replacement for a physician and does not provide medical advice, diagnosis, or treatment. Always seek the advice of a qualified health provider with questions about a medical condition. If you think you may have a medical emergency, call 911.