AI Wearables and Health Data Privacy

Wearables can collect heart rate, sleep, location, activity, temperature, and other signals. Machine-learning features may infer additional information, such as a possible condition or behavioral pattern, that the user did not directly enter. Whether a law covers the data depends on the organization and relationship, not simply on whether the information looks medical. HIPAA applies to covered entities—health plans, health-care clearinghouses, most providers that conduct specified electronic transactions—and business associates acting on behalf of a covered entity. A consumer who independently downloads an app and enters or imports health information does not automatically bring the app developer under HIPAA. HHS explains that HIPAA generally does not protect information a person voluntarily puts into an app that is not offered by or for a regulated entity. A vendor may have HIPAA duties if it creates, receives, maintains, or transmits protected health information for a covered entity as a business associate. The same wearable can therefore sit in different legal contexts depending on who provides it and how the data flow. HIPAA is not the only possible protection. The FTC Act can apply to deceptive or unfair practices, and the FTC’s Health Breach Notification Rule covers certain personal health record vendors and related entities, including some health apps and connected devices outside HIPAA. State consumer-health-data laws and general privacy statutes may add duties. A privacy policy is not necessarily the only rule, but it is important to know what the company promised and whether its practices match. Breach-notice coverage is also different from a comprehensive restriction on collection or sharing. For a privacy review, map who collects each signal, whether it is disclosed to a provider or vendor, what inferences are created, what laws apply, and what retention or sharing settings the user can control. Avoid assuming that “health data” automatically means HIPAA-covered or that “not HIPAA” means unregulated. Check current federal and state rules before making a product decision.