Your Health Data May Be Less Private Than You Think

Many users assume their health data, such as blood pressure readings or glucose levels from consumer apps, is protected by the same privacy laws as data held by doctors' offices. However, this is often not the case. The Health Insurance Portability and Accountability Act (HIPAA) primarily protects health information held by covered healthcare providers, health plans, and their business associates. Consumer apps, when used independently, frequently fall outside this protection.

While these apps may not be covered by HIPAA, they are not entirely without regulation. Many can fall under the FTC's Health Breach Notification Rule, state consumer health laws, and general prohibitions against unfair or deceptive business practices. A proposed bill, the Health Information Privacy Reform Act introduced by Sen. Bill Cassidy, aims to extend HIPAA-like privacy and security standards to some health information held outside the traditional HIPAA framework, but it has not yet become law.

Federal regulators have found instances where major health apps have shared sensitive user data. For example, GoodRx agreed to a $1.5 million civil penalty for allegedly failing to report disclosures of health information to companies like Facebook and Google. The Federal Trade Commission (FTC) stated that GoodRx uploaded identifiers linked to individuals taking certain heart disease and blood pressure medications, which Facebook then used for targeted advertising. Similarly, BetterHelp paid $7.8 million after the FTC alleged it shared user data, including personal health questions, with advertising platforms. Flo Health also faced allegations of sharing sensitive user data with Facebook, Google, and other analytics providers, leading to settlements.

These examples involve mainstream health services, and the FTC has indicated that data sharing often occurs through ordinary advertising and analytics tools. This highlights the importance for users to review the privacy practices of their specific health apps, understanding what data is collected, where it is stored, and which third parties receive it.

Data Brokers and Health Profiles

A concerning aspect of health data privacy involves data brokers, companies that collect and sell information. Research has shown that some data brokers are willing to sell health-related profiles, including data linked to mental health conditions like depression and anxiety, alongside demographic details. Prices for this data can range from hundreds of dollars for aggregated counts to tens of thousands of dollars annually for licensing fees.

The FTC has documented data broker categories that include pregnancy, diabetes, high cholesterol, and other sensitive health interests. In California, a data broker was fined for failing to register and for reselling lists containing contact information tied to sensitive conditions, such as Alzheimer's disease and addiction. Such lists could be exploited by scammers.

Scammers can leverage this information to make their pitches more convincing. For instance, a caller might offer free diabetic supplies by impersonating Medicare or a diabetes association, asking for a Medicare number to process a fraudulent shipment or bill Medicare. Another tactic involves callers referencing existing health conditions like high blood pressure or diabetes to tailor deceptive Medicare Advantage plan pitches or supplement offers, making fraudulent claims appear more legitimate.

Even without directly sharing information with a data broker, users can inadvertently contribute to these profiles. Blood pressure apps, glucose monitors, and smart scales can feed data into a larger profile, depending on the service, its partners, and user settings. Data brokers can combine this information with other sources, such as property records and online activity, to create comprehensive profiles.

Understanding Device and App Specifics

Privacy controls and data handling practices vary significantly between devices and applications.

• Omron Connect: Connected Omron blood pressure monitors can sync readings to the Omron Connect app, allowing users to store and share their heart health history. Data handling depends on device, permissions, and connected services.
• Dexcom: Certain Dexcom continuous glucose monitoring products may fall under HIPAA when provided through healthcare providers. Other services may operate outside this HIPAA-covered context, but Dexcom offers opt-outs for certain data sales and sharing.
• Withings: Withings states it does not share health information with advertising partners but may share non-health personal information for tailored advertising. Information can sync with external apps when authorized.
• Fitbit: Google has committed to not using Fitbit health and wellness data for Google Ads, keeping it in a separate data silo, as a condition of its acquisition.
• Medisafe: The medication reminder app notes that personal information might be disclosed to partner pharmacies or coupon companies if users utilize those features.
• Apple Health: Apple Health data is encrypted on devices and in iCloud. Apple prohibits apps from using HealthKit data for advertising, and users control which apps can access specific health information categories.

Steps to Enhance Privacy

Users can take several steps to improve their privacy when using health apps:

1. Disable Ad Tracking: On iPhones, turn off "Allow Apps to Request to Track" and "Personalized Ads." On Android, adjust "Ads privacy" settings to limit ad topics, app-suggested ads, and ad measurement, and consider deleting the advertising ID.
2. Manage In-App Sharing: Review the account or privacy settings within each health app. Disable options for marketing, ad personalization, or third-party sharing, and disconnect unused linked apps.
3. Utilize Opt-Outs: Look for links such as "Do Not Sell or Share My Personal Information" or "Your Privacy Choices." These can restrict certain data practices, though they do not guarantee complete data removal.
4. Recognize Red Flags: Be aware that Medicare does not make unsolicited calls for free medical supplies. If a caller references specific health conditions, this information may have come from commercial profiles or other sources, not necessarily legitimate representation.

While these steps can help reduce future data collection, they do not remove data already gathered, shared, or sold. Data removal services can assist in submitting opt-out requests to data brokers and monitoring for reappearing information, though complete removal of all personal data is challenging.