Does HIPAA apply to my employer or my fitness app?

What the Law Says

HIPAA’s Privacy Rule applies only to specific organizations called 'covered entities' — and their business associates — not to employers acting in their employment capacity or to consumer-facing apps that don’t provide health care services.

The Health Insurance Portability and Accountability Act (HIPAA) sets privacy and security standards for protected health information (PHI), but only when handled by certain regulated entities. Under federal law, HIPAA applies exclusively to three types of 'covered entities': health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with certain transactions.

Employers are generally not covered entities — even if they sponsor a group health plan — because the employer itself is separate from the plan administrator. Similarly, fitness apps, wearables, and wellness platforms that collect health data directly from users are not covered unless they act as a health care provider or business associate of one.

The statute defines key terms and scope: it states that the provisions apply to 'a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a transaction.' It does not extend to employers managing workplace policies or apps collecting data for personal use.

Statutory Text

The provisions of this part shall apply to a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a transaction.

— 42 U.S.C. § 1320d — Health information privacy

Sources