Much of the health data a product collects falls outside HIPAA's reach

A product team says two sentences in a review. The first is "we're HIPAA compliant." The second is "and anyway the data is de-identified." An Indiana University law professor, writing in The Conversation, takes both apart. ^[11]

HIPAA reaches covered entities and their business associates: hospitals, physicians, insurers, the contractors they hire. ^[1] It does not reach the period-tracking app, the search someone ran about a diagnosis, the DNA mailed to a genealogy company, or the wearable counting heartbeats. ^[2] So a team shipping any of those sits outside HIPAA entirely, and the compliance posture governs a slice of the data that, for most consumer products, is nearly empty.

Inside the line, the protection is thinner than the reputation. A hospital fully bound by HIPAA can release records with no authorization and no notice across roughly a dozen categories that include treatment, payment, law enforcement, research, and a catchall for essential government functions. ^[3] And the instant a covered entity hands data to something outside the system, HIPAA's limits fall away with it. ^[4]

The de-identification defense carries the weight in most data-sharing agreements. The professor's claim is that stripping identifiers to anonymize data is far weaker than officials assert, and that a growing body of research shows it. ^[5] The source describes that research in the aggregate rather than citing a specific study, so read the strength as asserted, not quantified here. The direction still matters to anyone signing a sharing deal: the safeguard your counterparty leans on is the one under the most pressure.

On the collection side, every state runs a prescription drug monitoring program logging who filled which controlled substance and when ^[6], and federal law enforcement can often pull those logs with a self-issued administrative subpoena, no judge involved. ^[7] Since spring 2025, HHS under Robert F. Kennedy Jr. has courted state health information exchanges for records, according to KFF Health News, with one proposal reaching 90% of Americans' records by 2028. ^[9]

The forcing question for a product owner is small: for each field collected, what door can it leave through. A claim that "HIPAA covers us" needs checking against whether HIPAA covers that field at all; often it does not. ^[2] A claim that data is "de-identified" needs a name attached: who verified that, and against what re-identification attempt. ^[5] The two are separate claims, and only one of them holds for the app on the phone.