Sharing your health records with an app: what to check first

The short answer

Connecting your records to an app can be reasonably safe, but the safety depends mostly on the app, not on the connection.

• HIPAA usually stops at the handoff. HIPAA, the federal health privacy law, protects your records while your doctor's office, hospital or health plan holds them. Once you send a copy to an app you chose yourself, HIPAA generally no longer covers that copy, and your clinic is not responsible for what the app does with it.
• Thinner protections take over: the app's own privacy promises, federal consumer-protection law enforced by the Federal Trade Commission (FTC), and some state laws, including California's.
• Who can see your data is whatever the app's privacy policy and your settings allow. That can include the company, its contractors, and sometimes advertisers or "partners."
• Share the minimum and know how to stop. Read the policy first, choose only the record types the app needs, and learn where to disconnect. Disconnecting stops new data; it does not by itself erase what the app already copied.

First, sort out what kind of app it is

"HIPAA compliant" is not a promise about how a company treats information you hand it yourself. In a 2023 case, the FTC said the drug-discount and telehealth company GoodRx displayed a seal falsely suggesting HIPAA compliance while sharing users' prescription and health-condition information with advertising platforms such as Facebook and Google. GoodRx agreed to pay a $1.5 million civil penalty.

Your clinic and plan generally have to let you connect

A 2016 federal law, the 21st Century Cures Act, and the rules that followed made sharing your electronic records the expected default.

Doctors and hospitals. Under a 2020 federal rule, government-certified health record systems offer a standard, secure doorway for apps, called an application programming interface (API). Once you approve an app, it can pull a copy of your records through it. The connection is "read-only": the app cannot change your chart. The federal health IT office at HHS says a provider that insists on its own security review of an app you picked before letting it use that certified doorway is likely interfering with your access, which the "information blocking" rules restrict. Your clinic may warn you about an app's privacy risks if the information is accurate, unbiased and given the same way for every app. HHS also says a provider or plan generally may not refuse to send your records to your chosen app because it worries how the app will use them.

Health plans. Rules from the Centers for Medicare & Medicaid Services (CMS) require Medicare Advantage plans, Medicaid and the Children's Health Insurance Program (CHIP) and their managed care plans (in California, Medi-Cal), and plans sold through the federally run marketplace at HealthCare.gov to run a "Patient Access API." Through it you can send an app your claims and costs, visit (encounter) information and clinical information the plan keeps, generally within one business day after the plan processes or receives it. Starting in 2027, most prior authorization requests and decisions (not those for drugs) must be included too. Plans must post plain-language guidance on choosing an app and on complaining to the HHS Office for Civil Rights and the FTC. A plan may refuse or disconnect an app if it reasonably decides the app would pose an unacceptable security risk to its own systems, using objective criteria applied the same way to every app. This rule does not cover employer plans or plans bought through state-run marketplaces such as Covered California; ask your plan whether it offers app connections anyway.

Original Medicare. Medicare's Blue Button service lets you link apps you pick to your Medicare.gov account to share your Part A, Part B and Part D claims, and stop sharing any time. With a Medicare Advantage plan, Medicare's connected apps get only your drug (Part D) information; ask your plan about the rest. Medicare.gov also lists private companies' apps that, according to Medicare, were independently verified for privacy and will not sell or share your data; read each app's own policy anyway. Call 1-800-MEDICARE (1-800-633-4227; TTY 1-877-486-2048) if you think someone else downloaded your Medicare information or you need help to stop sharing.

If a clinic or plan says no, ask for the reason in writing and whether another electronic option exists. What Information Blocking Means for You explains how to judge a refusal and where to complain.

What protects your data after the app has it

The app's promises, backed by the FTC. The FTC can act against companies that break their privacy promises or use data unfairly. In January 2021, it described a settlement with the maker of Flo, a period and ovulation tracker, which the FTC said had shared users' health information with marketing and analytics firms, including Facebook and Google, despite promising privacy. The settlement requires the company to get users' consent before sharing. The GoodRx case above was the FTC's first under its Health Breach Notification Rule.

The Health Breach Notification Rule, as updated in 2024. This rule covers many health apps and devices outside HIPAA. Its 2024 changes took effect July 29, 2024. As it now reads:

• It reaches apps that can pull health information from more than one source (say, your clinic's records and your fitness tracker) and are managed for you, plus companies that connect to them. Its definitions name apps and devices that track conditions, medications, vital signs, symptoms, fitness, fertility, sexual health, sleep, mental health, genetic information or diet.
• A "breach" includes an unauthorized disclosure, such as sharing your information without your authorization, not only a hack.
• The company must notify you no later than 60 calendar days after discovering a breach, and also notify the FTC, plus prominent news outlets when 500 or more residents of a state are affected. The notice must say what happened, what information was involved, who got it (if known), and steps you can take.

On September 9, 2026, the FTC withdrew a 2021 policy statement about health apps, saying the 2024 update made it unnecessary. The rule itself remains in the federal regulations as of October 2026.

The rule is mainly about telling you after something goes wrong. It is not a general ban on sharing, which is why the checklist below matters.

Checklist: before you tap "Allow"

Before you download

• Who makes the app, and how does it make money? Subscriptions, advertising, or selling or licensing data. If the app is free, look for the answer in its privacy policy.
• Can you read the privacy policy before connecting? The federal health IT office has said an app's policy should, at a minimum, be public at all times, be shown to you before the app gets your records, use plain language, say whether others may use or buy your data (now or later), and require your express consent first.
• Search the policy for "sell," "share," "advertising," "partners," "affiliates," "de-identified," "research" and "changes." Note what is shared, with whom, and whether you must opt in or opt out.
• If the company is sold or changes its policy, will it ask you again?
• Can you download your data and delete your account, including the data on the company's computers, not just the app on your phone?

While you connect

• Use the official connection. Standard patient-access connections send you to your clinic's, plan's or Medicare's own sign-in page, then show an approval screen. If an app asks you to type your portal password into the app itself, stop and ask your clinic whether the app uses its official connection.
• Choose only the record types the app needs. The iPhone Health app lets you turn on only the categories you want each app to use. Android's Health Connect lets you pick data permissions per app; Google notes that, with your permission, connected apps can see your whole medical history.
• Refuse phone permissions the app does not need, such as location, contacts, camera or microphone. HHS advises not giving apps your location unless it is necessary.
• Take extra care with sensitive records: reproductive and sexual health, mental health, substance use, genetic results, and anything about a child or teen. Does the app need them at all?

After you connect

• Look at what arrived. If a record is wrong, ask the clinic or plan that created it to correct it; fixing the app's copy does not fix the original. See Understanding Your Medical Privacy Rights.
• Protect the account with a strong, unique password and two-step sign-in if offered, and keep the app and phone updated; the FTC notes updates can fix privacy and security flaws.
• Review connections every few months and remove apps you no longer use: in your Medicare.gov account; in your portal or plan account if it lists connected apps; on iPhone in Health under your profile, then Privacy, then Apps; on Android in Health Connect under App permissions.
• When you leave, disconnect and then delete. Turning off access stops new data but does not by itself erase what the company already copied, so use its delete-account or data-deletion option and keep the confirmation.

Stop signs: no privacy policy you can read first; selling health data or using it for ads without asking; "HIPAA compliant" as the main privacy promise; a request for your portal password; far more data or permissions than the features need; no way to delete your data.

In California

• Some apps count as health care providers under state law. California's Confidentiality of Medical Information Act (CMIA) treats a business as a "provider of health care" if it offers consumers software or hardware, including a mobile app, designed to keep medical information so you or your provider can use it, or to help diagnose, treat or manage a medical condition (Civil Code section 56.06). The same goes for mental health and reproductive or sexual health digital services: apps or websites that collect that information, market themselves as helping with those services, and use the information to provide them. These businesses must meet a doctor's office's confidentiality standards and face the law's penalties.
• What that means. A covered provider generally may not disclose your medical information without your written authorization, apart from listed exceptions (section 56.10). A person can sue over a negligent release and, in many cases, seek $1,000 in nominal damages without proving harm, plus any actual damages (section 56.36). Whether a particular app is covered depends on what it is designed and marketed to do.
• Health care chatbots are next. A law signed September 30, 2026 (AB 1979) adds businesses offering consumers a "health care chatbot" to the CMIA; it is expected to take effect January 1, 2027. See Using an AI chatbot for a health question? How to check the answer before you act on it.
• The California Consumer Privacy Act (CCPA) does not cover medical information already governed by the CMIA or HIPAA, but it can cover other health data a business collects, which it treats as "sensitive personal information." Californians can ask a covered business what it collects and shares, ask it to delete or correct information, tell it not to sell or share it, and limit its use of sensitive information. Not every business is covered.

Other states

Some states have laws aimed at consumer health data outside HIPAA. Washington's My Health My Data Act, for example, has applied to most covered businesses since March 31, 2024, and centers on getting consumers' consent before collecting or sharing health data. Check your state attorney general's website.

Where to report a problem

These agencies do not act as your lawyer. For a dispute about your own records or a specific app, a legal aid office or a privacy attorney can explain your options.

Keep reading

• Consumer Health Apps Outside HIPAA: the policy analysis of why HIPAA's reach ends where it does.
• Understanding Your Medical Privacy Rights: your rights to see, copy and correct records your doctors and plans hold.
• Using an AI chatbot for a health question?: keeping private details out of a health chat.
• What Information Blocking Means for You and Using a Patient Portal.

Sources

1. Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet — U.S. Department of Health and Human Services, Office for Civil Rights, content last reviewed June 29, 2022.
2. The access right, health apps, & APIs — U.S. Department of Health and Human Services, Office for Civil Rights, content last reviewed May 30, 2025.
3. FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising — Federal Trade Commission, February 1, 2023.
4. Does your health app protect your sensitive info? — Federal Trade Commission consumer alert, January 13, 2021.
5. 21st Century Cures Act, Public Law 114-255 — U.S. Government Publishing Office, enacted December 13, 2016.
6. ONC's Cures Act Final Rule — Office of the National Coordinator for Health Information Technology, HHS, accessed October 22, 2026.
7. 45 CFR 170.315(g)(10), Standardized API for patient and population services — Electronic Code of Federal Regulations, current as of October 2026.
8. FAQ: If an actor requires third-party apps to be vetted for security reasons before patients use them with certified API technology, is that likely an interference? — Office of the National Coordinator for Health Information Technology, May 2023.
9. FAQ: Will educating patients about the privacy and security risks posed by third-party apps that the patient chooses be considered interference? — Office of the National Coordinator for Health Information Technology, November 2020.
10. Information Blocking — Office of the National Coordinator for Health Information Technology, accessed October 22, 2026.
11. 2020 CMS Interoperability and Patient Access Final Rule (CMS-9115-F) — Centers for Medicare & Medicaid Services, page last modified September 10, 2026.
12. CMS Interoperability and Prior Authorization Final Rule CMS-0057-F (fact sheet) — Centers for Medicare & Medicaid Services, January 17, 2024.
13. 42 CFR 422.119, Access to and exchange of health data and plan information (Medicare Advantage) — Electronic Code of Federal Regulations, current as of October 2026.
14. 42 CFR 431.60, Beneficiary access to and exchange of data (Medicaid) — Electronic Code of Federal Regulations, current as of October 2026.
15. 42 CFR 438.242, Health information systems (Medicaid managed care) — Electronic Code of Federal Regulations, current as of October 2026.
16. 45 CFR 156.221, Access to and exchange of health data and plan information (plans on Federally-facilitated Exchanges) — Electronic Code of Federal Regulations, current as of October 2026.
17. State-based Exchanges — Centers for Medicare & Medicaid Services, list of state-based exchanges for plan year 2026 (California: Covered California), updated August 13, 2026.
18. Share your Medicare claims — Medicare.gov, accessed October 22, 2026.
19. Medicare Connected Apps Directory — Medicare.gov, accessed October 22, 2026.
20. Third-party apps that connect to Medicare — Medicare.gov, accessed October 22, 2026.
21. FTC Finalizes Changes to the Health Breach Notification Rule — Federal Trade Commission, April 26, 2024.
22. Health Breach Notification Rule, final rule (89 FR 47028) — Federal Trade Commission, Federal Register, published May 30, 2024, effective July 29, 2024.
23. 16 CFR Part 318, Health Breach Notification Rule — Electronic Code of Federal Regulations, current as of October 19, 2026.
24. FTC Withdraws Obsolete Policy Statement — Federal Trade Commission, September 9, 2026.
25. Health App & Privacy — Apple, accessed October 22, 2026.
26. Manage Health data on your iPhone, iPad, or Apple Watch — Apple Support, accessed October 22, 2026.
27. Health Connect: connect your apps and what data is shared — Google Android Help, accessed October 22, 2026.
28. Filing a Complaint — U.S. Department of Health and Human Services, Office for Civil Rights, content last reviewed February 13, 2026.
29. California Civil Code section 56.05 (definitions) — reproduced by California.Public.Law from the official code, accessed October 22, 2026.
30. California Civil Code section 56.06 — reproduced by California.Public.Law from the official code, accessed October 22, 2026.
31. California Civil Code section 56.10 — reproduced by California.Public.Law from the official code, accessed October 22, 2026.
32. California Civil Code section 56.36 — reproduced by California.Public.Law from the official code, accessed October 22, 2026.
33. AB 1979, Health care services: artificial intelligence, chaptered text (Chapter 854, Statutes of 2026) — California Legislature, via LegiScan, approved September 30, 2026.
34. California Constitution, Article IV, Section 8 — reproduced by Justia, accessed October 22, 2026.
35. California Consumer Privacy Act (CCPA) — California Department of Justice, Office of the Attorney General, updated August 28, 2026.
36. California Civil Code section 1798.146 — reproduced by California.Public.Law from the official code, accessed October 22, 2026.
37. Complaint Form — California Privacy Protection Agency, accessed October 22, 2026.
38. Consumer Complaint Against a Business/Company — California Department of Justice, Office of the Attorney General, accessed October 22, 2026.
39. Protecting Washingtonians' Personal Health Data and Privacy — Washington State Office of the Attorney General, accessed October 22, 2026.
40. ReportFraud.ftc.gov — Federal Trade Commission, accessed October 22, 2026.