What is HIPAA and what does it protect?
Last updated September 3, 2026.
The federal health-privacy law, per HHS: providers, insurers, and their partners cannot share your identifiable health information without your written authorization - with narrow exceptions for treatment, payment, operations, and specific public-interest carve-outs. Your rights: see and copy your records (30-day response), request corrections, get some disclosure accounting, complain to HHS. The surprises - not covered: most employers, health apps not tied to a provider, authorizations you sign, and what you share yourself. The daily-work rights: your records are yours to see, and sharing them needs your say-so.
What to do
- Request your records freely. Yours by right - 30-day response, small copy fee allowed.
- Read authorizations before signing. A signature is permission - scope it.
- Do not assume apps are covered. Non-provider health apps sit outside HIPAA.
- Complain to HHS for violations. The channel exists and is used.
Related questions
- Does my employer get to know my diagnosis?
- Can my doctor share my records with my family?
- Can my parents see my medical records if I am 18?
- Who can see my prescription history?
