Who is the app working for?
HHS’s app scenarios distinguish services acting on behalf of a covered provider or health plan from apps selected independently by consumers. HIPAA coverage depends on the relationship and activity. A health subject or a doctor’s recommendation alone does not make every app developer a HIPAA business associate.
Make a simple app record
- App name, developer, and version.
- Whether you chose it independently or received it through a provider.
- What information you entered or connected.
- Permissions you approved and any connected services.
- The privacy notice and deletion or account closure instructions.
Read beyond the download description
A store listing may describe benefits without answering how information is used. Look for the notice inside the app and on the developer’s website. Keep the exact language if it describes partners, advertising, account links, or retention. If two notices differ, save both with dates.
If you want to stop using the app
Before changing your account, save records relevant to your concern. Read the account deletion instructions and distinguish removing an app from requesting deletion of information held by the operator. Keep the operator’s response. Avoid uploading your full health history to another service simply to test how the app works.
Go to the source
Official resources for the facts discussed here. Checked October 5, 2026.