Health data in mobile apps: which US laws apply and what your privacy policy must say

Does HIPAA apply to my app?

Usually not. HIPAA applies to health care providers, health plans and health care clearinghouses (covered entities) and to the businesses that handle protected health information on their behalf (business associates). A fitness tracker, a sleep app, a period tracker or a meditation app that people download for themselves is usually outside it. An app that a hospital or a health plan gives its patients or members, or that you build for one under contract, may be inside it.

Being outside HIPAA does not leave the data unregulated. It moves the question to the laws below, several of which are stricter in practice.

Source: HHS, covered entities and business associates.

What does the FTC require?

Section 5 of the FTC Act prohibits deceptive and unfair practices. The FTC applies it to apps that say one thing in a privacy policy or a store listing and do another in their code, for example by passing health information to an advertising partner through a software development kit (SDK). It has brought cases on that basis against several health and wellness apps, including a prescription discount service, an online counseling service, a fertility app and a period tracker. The orders are listed on the FTC's health privacy page.

The FTC also enforces the Health Breach Notification Rule. Its amendments, in effect since 29 July 2024, state that the rule reaches health apps that draw information from more than one source (for example from the user and from a connected device or another app), and that a "breach" includes a disclosure the user did not authorize, not only a security incident. A breach requires notice to the affected users and to the FTC, and in some cases to the media.

Sources: 15 U.S.C. § 45; FTC, health privacy; FTC, GoodRx Holdings; FTC, BetterHelp; FTC, Easy Healthcare Corporation; FTC, Flo Health; 16 CFR Part 318 (eCFR).

Which state health data laws apply?

Washington. The My Health My Data Act has applied since 31 March 2024 (30 June 2024 for small businesses). It defines consumer health data broadly, including information that identifies a past, present or future health condition and some inferences and location data. It requires separate consent to collect the data and to share it, a signed authorization to sell it, and a consumer health data privacy policy of its own. Individuals can sue under it. A first class action under the Act, about location data collected through SDKs in other companies' apps, was filed in federal court in Seattle in February 2025.

Nevada. Nevada's consumer health data law (NRS 603A.400 to 603A.550) follows a similar model. It states that it does not create a private right of action; a violation is treated as a deceptive trade practice.

Connecticut. The Connecticut Data Privacy Act treats consumer health data as sensitive data that needs consent, and amendments in Public Act 25-113 widen its scope from 1 July 2026.

These laws can apply to an app developer outside those states when it collects data from their residents.

Sources: RCW 19.373; Washington Attorney General, My Health My Data Act; NRS chapter 603A; Connecticut Public Act 25-113; Connecticut Attorney General, Data Privacy Act.

What does California add?

The Confidentiality of Medical Information Act treats a business that offers consumers software, including a mobile app, designed to maintain medical information as a provider of health care for the purposes of the Act (Civil Code section 56.06). The Act limits disclosure of that information without the user's authorization.

The California Consumer Privacy Act treats health information as sensitive personal information. Users may limit its use, and the app must give a notice at collection and publish a privacy policy with set contents. Under the regulations in effect since 1 January 2026, processing sensitive personal information is one of the activities that requires a written risk assessment; for processing that began before that date and continues, the assessment is due by 31 December 2027.

CalOPPA requires any operator of an online service, including an app, that collects personal information from California residents to post a privacy policy with set contents.

Sources: AB 658 (2013), adding mobile applications to Civil Code section 56.06; CCPA, Civil Code title 1.81.5; California Privacy Protection Agency, approved regulations; Business and Professions Code section 22575.

What do the app stores require?

Apple and Google require developers to declare what data the app and the SDKs it ships with collect, and whether it is used to track the user. Apple's review guidelines also restrict the use of health data for advertising. These declarations are store terms rather than law, but a declaration that does not match the app's behavior can support a deception claim under the FTC Act.

Sources: Apple, app privacy details; Apple, App Review Guidelines, section 5.1; Google Play, Data safety section.

What should the privacy policy say?

In plain terms, a health app's privacy policy should:

• list the health-related data the app collects, including what it infers;
• say why each kind of data is collected and how long it is kept;
• name the categories of partners that receive it, including SDK providers, and for what purpose;
• explain how users give consent and how they withdraw it;
• describe the rights users have and how to use them, by state where the rules differ;
• say whether any data is sold or used for advertising, and if so on what basis.

Where Washington's law applies, the consumer health data privacy policy is a separate document, and the law requires a prominent link to it.

The policy is only as good as its match with the app. A useful first step is to compare three things side by side: what the policy says, what the store labels say, and what the app actually sends to its partners.

Checklist

• HIPAA position recorded: covered entity, business associate, or neither
• Every health-related data element listed, including inferences
• Every SDK and partner that receives that data identified, with its purpose
• Consent flows checked against Washington, Nevada and Connecticut
• Privacy policy, store labels and the app's actual data flows compared
• Breach procedure covers unauthorized disclosures, not only security incidents
• CCPA risk assessment scheduled where sensitive data is processed

Questions people ask

Our app is free and we do not sell data. Do these laws still apply? Yes. Most of them turn on collecting or sharing health data, not on selling it or charging for the app. Passing data to an analytics or advertising SDK can be sharing.

We are not in Washington. Does the My Health My Data Act matter? It can. It protects Washington residents and people whose health data is collected in Washington, wherever the business is based.

Is a wellness app the same as a health app for these laws? Often, yes. The state laws define health data by what it reveals or suggests about a person's health, not by the name of the app.

Do the store labels replace the privacy policy? No. Both are required, and they must tell the same story.

Update log

• 5 November 2026: first published. Sources checked the same day.