Wearable data privacy in the United States rests on a split that surprises most owners of fitness bands: the main health privacy law, HIPAA, usually does not cover the app on your phone. A different rule, enforced by the Federal Trade Commission, covers part of the gap. This guide explains who is covered, who is not, and what a recent case shows.
What HIPAA covers, and what it does not
HIPAA is the Health Insurance Portability and Accountability Act, passed in 1996. Its privacy rules bind a short list of groups: health plans, health care clearinghouses, and most health care providers. These are called covered entities. Companies that handle patient data for them, called business associates, must follow the rules too.
A wearable maker is usually none of these. In guidance from February 2016, the HHS Office for Civil Rights walked through app examples. When a person downloads a health app on her own and types in her own readings, the developer is not a business associate. The reason is simple. The app is not working for a doctor or a health plan. It works for the consumer.
The same guidance shows the other side. If a provider hires an app company to monitor patients and feed an electronic health record, that company is a business associate and HIPAA applies. The facts decide the answer, and OCR said small changes to a scenario can change it.
Sources: HHS Office for Civil Rights, "Health App Use Scenarios and HIPAA," February 2016.
Why this matters for your step counts and sleep scores
Heart rate, sleep, activity, and location data feel like health records. Under HIPAA, though, the same data is protected only when a covered entity or its business associate holds it. The very same heart rate reading can be protected in a hospital system and unprotected inside a consumer app.
That does not mean the data is free for anyone to use. It means other rules do the work. The two that matter most here are the FTC Act, which bans unfair or deceptive practices, and the FTC Health Breach Notification Rule.
The FTC Health Breach Notification Rule
The Health Breach Notification Rule is older than most apps. The FTC issued it under a 2009 law. It applies to vendors of personal health records and related companies that are not covered by HIPAA. If they suffer a breach of unsecured health information, they must tell consumers and the FTC, and sometimes the media.
For years the FTC never enforced it. On September 15, 2021, the Commission voted to issue a policy statement that said how it reads the rule. Three points stand out for wearable users.
- Health apps and connected devices count. The FTC treats an app as covered if it can pull data from more than one source, such as user input plus a link to a fitness tracker.
- A breach is not only a hack. The statement says sharing health data without the person's authorization is also a breach.
- Penalties are real. The statement lists civil penalties of $43,792 per violation per day.
The statement also noted that the FTC had never enforced the rule, and it said the Commission intended to bring actions to enforce it.
Sources: Federal Trade Commission, "Statement of the Commission on Breaches by Health Apps and Other Connected Devices," September 15, 2021.
The GoodRx case: the first test
On February 1, 2023, the FTC announced its first action under the Health Breach Notification Rule. The target was GoodRx, a drug discount and telehealth company. GoodRx is not a wearable brand, but the case shows how the FTC thinks about health data held outside HIPAA.
The agency said GoodRx shared users' health data, including medications and health conditions, with advertising platforms such as Facebook and Google, even though it had promised not to. It also said the company failed to tell consumers, the FTC, or the media about these disclosures. The proposed order included a $1.5 million civil penalty. It also barred GoodRx from sharing health data with outside parties for advertising, and required clear consent before sharing it for other reasons. The order still needed a federal court's approval when it was announced.
The lesson for wearables is direct. A company that promises to keep health data private and then sends it to ad platforms can face this rule, even with no hacker involved.
Sources: Federal Trade Commission press release, February 1, 2023.
What the law still misses
These rules leave real gaps. Be clear about them before you rely on any app.
- No single federal privacy law covers wearable data. Protection comes from the FTC Act, the breach rule, and a patchwork of state laws.
- The breach rule is about notice after the fact. It tells you when something went wrong. It does not set limits on what a company may collect in the first place.
- The FTC's reading of the rule is new. A court has not yet tested it.
- Many apps fall outside the rule if they do not meet the definition, so coverage is not guaranteed.
Practical steps for wearable owners
You cannot fix the law, but you can lower your exposure.
- Read the privacy policy for the words "share," "partners," and "advertising." Look for a plain statement about whether health data is sold or shared.
- Turn off data sharing with third-party apps you do not use.
- Check what your account stores in the cloud, and learn how to delete it.
- Be careful with any seal or badge that implies HIPAA compliance. In the GoodRx case, the FTC said such a seal on a telehealth page was false.
- Keep your app and device software up to date.
The short version: HIPAA mostly protects data held by your doctor and insurer, and the FTC is now filling in for the apps and devices outside that circle. Treat your wearable data as lightly protected, and share it with that in mind.
Sources: HHS Office for Civil Rights, February 2016 guidance; FTC policy statement, September 15, 2021; FTC press release, February 1, 2023.