Why Your Smartwatch and Wearables Aren’t HIPAA-Protected

HIPAA (Health Insurance Portability and Accountability Act) was designed to protect patient health information within the U.S. healthcare system. It applies specifically to covered entities like doctors, hospitals, insurance providers, and their business associates who process data on their behalf. But here’s the catch: if a technology company collects health data directly from you and doesn’t work on behalf of a covered entity, that data is not protected by HIPAA.

The extensive health data collected by your Apple Watch, Fitbit, or other wearable devices falls into a precarious regulatory gap. This means if your smartwatch syncs your heartbeat, exercise patterns, or sleep habits to a fitness app owned by a tech company that isn’t a covered entity or working with a healthcare provider, that information likely falls outside HIPAA’s jurisdiction.

Wearable adoption is exploding. From smart rings to ECG-enabled watches, these devices collect an ever-expanding array of sensitive health data. Yet many manufacturers are tech companies, not healthcare providers. Without HIPAA obligations, they aren’t legally required to secure that data to the same standards or limit how it’s used, sold, or shared.

The implications of this protection gap are far-reaching. Without HIPAA safeguards, wearable companies can:

1. Share Your Health Data With Third Parties: Companies can legally share, sell, or transfer your health metrics to partners, advertisers, and data brokers without your explicit permission.
2. Use Data for Marketing and Product Development: Your personal health information may be analyzed to target you with advertisements or used to develop new products without your knowledge.
3. Apply Weaker Security Standards: Non-HIPAA entities aren’t bound by the same rigorous security protocols required of healthcare providers, potentially leaving your data vulnerable to breaches.
4. Retain Data Indefinitely: Without HIPAA’s limitations on data retention, companies may store your sensitive health information indefinitely.
5. Lack of Transparency: Many apps bury privacy policies in legal jargon, making it unclear how your data is being handled.

It’s critical to understand that not all health data is considered Protected Health Information (PHI). HIPAA only protects health information when it’s:

• Created, received, or maintained by a covered entity or business associate,
• And tied to a person’s identity.

So, if your heart rate data is stored by your doctor’s remote monitoring app, it’s PHI. But if that same data is logged by a fitness app unaffiliated with healthcare? It likely isn’t.

• “My smartwatch tracks my health – it must be protected.”
  • False. Unless the data is being handled by a covered entity or business associate, HIPAA doesn’t apply.
• “All health apps follow the same rules.”
  • Not true. Apps tied to your doctor or insurer likely fall under HIPAA. Standalone fitness or wellness apps generally do not.
• “I gave permission, so my data is secure.”
  • You may have accepted terms, but without HIPAA, those permissions can allow broad data sharing.

The situation becomes more complex when healthcare providers enter the equation. When consumers are collecting health data for their own use, HIPAA doesn’t come into play. But “all wearables, once they are interfacing with your healthcare organization’s information, your physician practice EHR, that’s where HIPAA applies.”

This creates an important distinction in how your wearable data is handled:

• Personal Use: When you track steps, heart rate, or sleep patterns for personal fitness goals, HIPAA protections don’t apply.
• Provider-Directed Use: If your doctor prescribes or recommends a wearable device and that data is transmitted to your medical record, HIPAA protections activate.
• Provider-Integrated Data: When wearable data is integrated into electronic health records or used for treatment decisions, it becomes protected health information.

Healthcare organizations increasingly rely on patient-generated health data (PGHD) from wearables to enhance care. When a provider asks a patient to submit the health data they collected with wearable tech, HIPAA compliance plays a role. HIPAA applies once a wearable interfaces with a practice’s EHR system. This creates significant compliance requirements for medical practices incorporating wearable technology into patient care.

Several major technology companies have also recognized the need for stronger security measures. Samsung wearable devices meet HIPAA compliance with its built-in Knox security platform and the Apple Watch uses HealthKit to ensure a user’s data is shared securely. These industry initiatives, while promising, still leave significant protection gaps without comprehensive regulation.

While legislative solutions develop, consumers can take proactive steps to better protect their wearable health data:

• Read App Privacy Policies: Look for statements on whether the company is a covered entity or business associate.
• Use HIPAA-Compliant Platforms: If you’re managing chronic conditions, choose platforms working with healthcare providers.
• Control App Permissions: Limit access to only the data that’s necessary for app functionality.
• Avoid Linking Wearables with Social Media: Cross-platform sharing increases exposure.
• Use Encryption-Capable Devices: Choose wearables and apps with strong encryption for data in transit and at rest.

Regulatory agencies are increasingly scrutinizing the digital health space. The FTC has already penalized companies for misleading health privacy claims. While HIPAA reform is slow, there’s growing discussion about expanding protections to cover more digital health data sources.

The privacy landscape for wearable technology continues evolving, with several potential approaches under consideration:

1. Extended HIPAA Coverage: Expanding existing HIPAA frameworks to include consumer health technology companies.
2. Standalone Wearable Privacy Legislation: Creating new regulatory frameworks specifically designed for wearable health technology.
3. Consent-Based Models: Implementing robust informed consent requirements for health data collection and usage.
4. Enhanced Security Requirements: Establishing minimum security standards for devices collecting sensitive health information.

In the meantime, the burden largely falls on consumers and companies to bridge the privacy gap.

Most consumers assume their health data is protected by law. The reality is more complicated. As wearables become more powerful and pervasive, it’s critical to understand where HIPAA ends and your exposure begins.

Cyber threats don’t wait, and neither should your privacy strategy. Evaluate the platforms and partners you trust with your health data – and hold them to a higher standard. Connect with professionals who understand the intersection of cybersecurity, compliance, and digital health to help you close the gaps.

WE WILL TAKE YOU TO THE PEAK.