When people think about health privacy, they usually think about their doctor’s office. That is the part that is best protected. But your health footprint extends far beyond clinics. It includes the symptoms you search for, the apps you use to track sleep and cycles, the pharmacy loyalty card, the wearable that records your heartbeat and the ads that seem to know too much. Much of that information sits outside the main U.S. health privacy law, and a market of data brokers and advertisers has grown up around it. This guide explains what happens to health data online, who protects it, where the gaps are and how to reduce your exposure. If you want to remove medical details already published, our companion guide on removing medical records from the internet covers it step by step.
1. The two worlds of health data
Think of health data as living in two worlds.
Regulated health data is created and held by health care providers, health plans and their business associates. In the United States this is governed by the Health Insurance Portability and Accountability Act, known as HIPAA. The Department of Health and Human Services explains patients’ rights at hhs.gov/hipaa.
Unregulated or lightly regulated health data is created everywhere else: consumer health and fitness apps, wearables, search engines, websites you visit, loyalty programs, online pharmacies that are not covered entities, social media posts and data brokers. Some state laws and Federal Trade Commission enforcement now reach parts of this world, but the protections are patchier.
The gap between the two is where most surprises happen.
2. What HIPAA covers and does not cover
HIPAA covers health care providers who bill electronically, health plans, clearinghouses and the vendors that handle information for them. Within that world, your information can generally be used and shared for treatment, payment and health care operations, with additional limits and rights for patients, including the right to access your records and request corrections.
HIPAA does not generally cover:
- A fitness app you download that is not run on behalf of your provider.
- A wearable that stores your heart rate with the manufacturer.
- A website where you research symptoms.
- A data broker that infers a condition from your purchases.
- Information you post on social media.
That does not mean those uses are lawless. The FTC has taken action against companies that shared health-related data in ways that contradicted their privacy promises, and several states have passed laws on consumer health data. Our piece on the importance of data privacy explains why those laws matter.
3. How health data leaks into the broader market
Apps and wearables
Many apps collect symptoms, cycles, medications, sleep and mood. Some share data with analytics or advertising partners through software code built into the app. Read the privacy section before entering sensitive details, and look for options to opt out of sharing.
Search and browsing
Searching for symptoms, conditions or treatments creates logs. Websites often embed trackers that let advertising companies associate your visit with a profile. That is how a single search can follow you across the web.
Retail and pharmacy
Loyalty programs record what you buy and when. Pharmacy programs may be covered by HIPAA for prescriptions, but general retail purchases are not.
Data brokers
Brokers combine purchases, browsing, location and public records to infer interests and conditions, then sell segments such as “people interested in diabetes products”. They typically do not need your medical records to do it. See data brokers are selling your personal information.
Public sources
Court filings, obituaries, fundraising pages and social posts can reveal health information that then gets republished by people-search sites.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
4. Why this matters
Health inferences can affect insurance marketing, loan offers, job screening in some contexts, targeted ads that reveal your condition to others who see your screen, and scams that exploit fear. People with sensitive conditions, reproductive health needs or mental health care have particular reasons to be careful.
There are also direct security risks. Medical identity theft happens when someone uses your insurance or patient details to obtain care or file claims. Breaches at health providers expose records that include names, birth dates, insurance IDs and diagnoses. The FBI’s Internet Crime Complaint Center received 67,456 personal data breach complaints in 2025 and 31,675 identity theft complaints (IC3), and you can learn what to do after a breach in what is a data breach.
5. Your rights as a patient
Under HIPAA, patients generally have the right to:
- Get a copy of their medical records and, in many cases, an electronic copy.
- Ask for corrections to inaccurate information.
- Get a notice of privacy practices.
- Request restrictions on certain uses and disclosures.
- Request confidential communications, such as using an alternate phone number or address.
- File a complaint with HHS if you believe your rights were violated.
If you want to see how a provider handled your information, ask for your records and for an accounting of certain disclosures. The HHS site explains how to file a complaint.
6. How to protect your health data
Review app and device permissions
Check what each health app can access, including contacts, location and microphone. Turn off anything it does not need. Our guide on securing privacy on mobile apps shows how.
Think before you search or post
Use a private window and a browser with tracker blocking for sensitive searches. Avoid posting health details on public profiles.
Secure your patient portal
Use a unique password and two-factor authentication, and avoid accessing the portal on public Wi-Fi.
Limit what pharmacies and loyalty programs capture
Consider paying cash for sensitive items or opting out of tracking where possible.
Opt out of broker profiles
Remove your listings from people-search sites and marketing lists, which reduces how many data sets can be matched to you. See our data broker overview.
Use state rights
Several states give residents the right to know, delete and opt out of the sale of personal data, and some have special rules for sensitive health information. California’s privacy regulator, the California Privacy Protection Agency, publishes information about those rights and the DROP platform for data broker deletion at privacy.ca.gov/drop.
7. What to do after a health data exposure
| Step | Action |
|---|---|
| 1 | Read the notice and identify what was exposed |
| 2 | Review explanation-of-benefits statements for claims you did not make |
| 3 | Freeze your credit and consider fraud alerts |
| 4 | Contact your insurer if the insurance ID was exposed |
| 5 | Report medical identity theft at identitytheft.gov |
| 6 | File a complaint with HHS if a covered entity was responsible |
| 7 | Remove published copies where possible |
8. Timeline: a health privacy tune-up
| When | Action |
|---|---|
| Today | Review apps with health data, turn off unnecessary sharing |
| This week | Secure patient portals, request records and read privacy notices |
| This month | Search yourself for published health details and submit removals |
| Every quarter | Re-check broker listings and app permissions |
9. Three scenarios and what to do
Scenario 1: You track your health in apps. Choose apps that let you delete data, avoid linking them to social media and review sharing settings after each update.
Scenario 2: Your information appears on a people-search page. Opt out of the page and ask the source if a record was published improperly. See removing medical records from the internet.
Scenario 3: A provider you use is breached. Follow the notice, monitor claims and freeze credit. Medical data is hard to change, so stay alert for years.
10. Myths and facts
| Myth | Fact |
|---|---|
| HIPAA protects all health data | It covers providers, plans and associates, not most apps |
| Anonymous data cannot be tied back to me | Combined data can often be re-identified |
| Deleting an app deletes my data | The company may retain it until you request deletion |
| Private browsing hides health searches from everyone | It limits local history but not all tracking |
| Health data only matters if I am sick | Inferences affect everyone |
11. Common mistakes
- Entering sensitive details into apps without reading the policy.
- Using the same password for the patient portal and email.
- Posting about a diagnosis publicly and forgetting it is searchable.
- Ignoring explanation-of-benefits statements.
- Assuming a data breach notice is just routine.
12. How Wiperts fits
Health data is only one part of what brokers can infer, but the pages that publish your name, address and phone number are what make those inferences actionable. Wiperts scans more than 100 data brokers and people-search sites, submits removals, requests removal of personal search results and monitors for new listings. Start with the free diagnosis to see what is public.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
13. Key takeaways
- HIPAA protects data held by providers and plans, but much consumer health data sits outside it.
- Apps, searches, purchases and data brokers can reveal or infer health conditions.
- Limit permissions, secure your portals, use state rights and opt out of broker lists.
- After an exposure, monitor claims, freeze credit and report medical identity theft.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
14. Frequently Asked Questions
Is all my health data protected by HIPAA?
No. HIPAA covers health care providers, health plans, clearinghouses and their business associates. Many consumer apps, wearables, websites and data brokers are outside it.
Can data brokers sell health information?
Brokers can sell inferences drawn from shopping, browsing and location, such as interest in a condition, even when they never see a medical record. State laws increasingly restrict this.
Who can see my medical records?
You, your care team, your insurer for payment and operations, and others you authorize, plus parties allowed by law such as in certain legal proceedings and public health reporting.
Are health apps safe?
It depends on the app. Review what it collects, whether it shares data with advertisers, whether you can delete data and who the company is.
How do I see who accessed my health information?
Under HIPAA you can request your records and an accounting of certain disclosures. The HHS website explains how.
What should I do if my health data is exposed?
Contact the provider or company, review the notice, monitor statements and explanations of benefits, freeze credit and file a complaint with HHS if a covered entity mishandled your data.
Sources
Related Reading
- Removing Medical Records and Health Data From the Internet
- Do You Know Where Your Library Records Are?
- Everything You Need to Know About Data Brokers in 2026
- How to Secure Your Privacy When Using Mobile Apps
- What Can Your Digital Footprints Reveal About You?
- Your Data, Their Advantage: How Your Footprint Is Used Against You
- Data Brokers Are Selling Your Personal Information. Here’s How
- Why Data Privacy Is Important: What Most People Miss
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing