Is every telehealth company covered by HIPAA?

No. HIPAA applies to covered healthcare providers, health plans, clearinghouses, and their business associates. A consumer health app or direct-to-consumer service may fall outside HIPAA depending on how it operates and which organizations handle the data. Other federal and state consumer-protection or breach-notification laws may still apply.

What should I do if a telehealth company says my data was exposed?

Read the notice carefully, change the account password, enable multifactor authentication if available, review linked accounts and payment activity, and follow any identity-protection instructions. Save the notice and contact the company about what data was involved. You can also report concerns to the FTC or file an HHS privacy complaint when the organization is covered by HIPAA.

Should I stop using telehealth?

Not necessarily. Telehealth can improve access and convenience. The practical response is to compare services, share only information needed for care, understand who provides the clinical service, review privacy and billing terms, and use secure devices and networks.

Is Your Telehealth Data Private? What to Check Before Sharing Medical Information

Federal cases show that convenient online care does not always come with the privacy protections patients expect

Why telehealth privacy is a major US health issue

Telehealth can make care faster and easier. A patient may be able to discuss symptoms, request a prescription, receive counseling, or manage a chronic condition without traveling to a clinic.

But convenience can obscure an important question: Who receives the information entered into an online form, and what can that company do with it?

CNN reported on September 22, 2026, that federal regulators have accused several telehealth businesses of practices involving sensitive health-data disclosures, confusing subscriptions, difficult cancellations, or treatment processes that may not match what consumers expect. The report highlighted a July 2026 Federal Trade Commission lawsuit against Hims & Hers. The FTC, California, Utah, and Los Angeles County alleged that the company shared sensitive health information with advertising platforms despite privacy assurances and used deceptive billing and cancellation practices.

These are allegations in a pending case, not final findings of liability. Hims & Hers has disputed the government's claims. Still, the case is part of a broader pattern of federal action involving digital health services, including previous FTC matters concerning BetterHelp and GoodRx.

The practical lesson is not that every telehealth company is unsafe. It is that a health-related website can look and feel like a medical office while operating under a different mix of privacy rules.

HIPAA does not cover every health app or website

Many Americans use "HIPAA protected" as shorthand for any medical information. The actual law is narrower.

The Health Insurance Portability and Accountability Act applies to covered healthcare providers, health plans, healthcare clearinghouses, and certain companies working for them as business associates. A hospital's patient portal may be covered. A direct-to-consumer wellness app, symptom questionnaire, or online service may not be covered in the same way.

Coverage depends on the organization, its relationships, and the data involved—not simply on whether the information concerns health.

When HIPAA does apply, regulated organizations must follow privacy, security, and breach-notification requirements. The HHS Office for Civil Rights says HIPAA-regulated entities may not use online tracking technologies in ways that impermissibly disclose protected health information.

When HIPAA does not apply, a company is not automatically free to do anything it wants. The FTC Act prohibits unfair or deceptive practices. The FTC's Health Breach Notification Rule can also require certain health apps and related businesses to notify consumers, the FTC, and sometimes the media after an unauthorized disclosure.

How tracking technology can reveal sensitive information

Websites and apps commonly use software from advertising, analytics, and social-media companies. These tools can measure page visits, button clicks, form activity, device details, and advertising performance.

On a general shopping site, that data might indicate an interest in shoes. On a healthcare site, the same technology could suggest that a person is seeking help for depression, sexual health, weight loss, fertility, substance use, or another sensitive condition.

The risk is not limited to a full medical record. A combination of page URLs, questionnaire answers, email addresses, device identifiers, appointment activity, or medication interests may reveal meaningful health information.

HHS warns that an impermissible disclosure can contribute to harms including identity theft, financial loss, discrimination, stigma, emotional distress, and risks to a person's reputation or safety.

Seven checks before signing up for online care

1. Identify the clinical provider

Find out whether care is delivered by a licensed physician, nurse practitioner, therapist, pharmacist, or another professional. Check when a real clinician reviews the information and whether you can speak with that person before treatment begins.

An online questionnaire can be useful, but it is not appropriate for every condition. Symptoms that require a physical examination, urgent testing, or emergency care should not be handled only through an automated form.

2. Look for a clear privacy notice

Read the privacy policy before entering detailed symptoms. Look for explanations of:

What information is collected.
Whether information is used for advertising or analytics.
Which companies receive it.
Whether data is sold or shared.
How long it is retained.
How to request access or deletion.
Who handles privacy complaints.

Statements such as "we value your privacy" are not enough. Look for specific practices.

3. Ask whether HIPAA applies

Do not assume that a medical-looking service is a HIPAA-covered provider. The service should explain which entity delivers care, which privacy notice governs the clinical relationship, and whether nonclinical parts of the platform operate under different rules.

4. Check payment and cancellation terms

Before submitting an intake form, determine whether it authorizes a charge. Confirm:

Whether the payment is one-time or recurring.
When the first charge occurs.
Whether medication, consultation, laboratory work, and shipping are billed separately.
How to cancel.
Whether unused services are refundable.

Take screenshots or save copies of important terms and confirmation pages.

5. Share only what is needed

Accurate clinical information is essential for safe care. However, avoid uploading unrelated records, identification documents, or contacts unless the service explains why they are needed.

Do not omit allergies, medications, pregnancy status, or medical conditions that could affect treatment. Data minimization means avoiding unnecessary information, not withholding facts needed for safe prescribing.

6. Secure your account and device

Use a unique password and enable multifactor authentication when available. Keep the phone, browser, and operating system updated. Avoid entering medical information over public Wi-Fi. Confirm that the address begins with HTTPS and that you are using the company's real website rather than a link from an unsolicited message.

These steps cannot prevent a company from misusing data, but they reduce the risk of account takeover and interception.

7. Know how follow-up works

Before paying, ask what happens if treatment causes side effects, does not work, or requires a medication change. Confirm whether the company communicates with your regular clinician or pharmacy and how to obtain your records.

Warning signs that deserve caution

Pause before using a service that:

Hides the identity or credentials of the treating professional.
Promises a prescription before a clinical review.
Pressures you to act immediately.
Makes cancellation instructions difficult to find.
Uses prechecked marketing consent boxes.
Requests extensive permissions unrelated to care.
Makes broad claims that information is "completely private" without explaining exceptions.
Offers no clear way to contact a privacy or customer-service team.

One warning sign does not prove misconduct, but several together justify choosing another provider.

What to do after a suspected privacy exposure

If a company sends a breach or privacy notice, do not ignore it. Determine what information was affected, when the event occurred, and whether Social Security numbers, payment details, identification documents, account credentials, diagnoses, prescriptions, or questionnaire responses were involved.

Then:

Change the account password and any reused password.
Enable multifactor authentication.
Review card, bank, insurance, and pharmacy activity when relevant.
Be alert for messages that refer to the exposed health issue and ask for money or credentials.
Save the notice and your communications with the company.
Follow any credit-monitoring or identity-protection instructions that apply to the exposed data.

Consumers can report deceptive practices at ReportFraud.ftc.gov. People who believe a HIPAA-regulated organization violated their privacy rights can review the HHS Office for Civil Rights complaint process. State attorneys general and state privacy regulators may provide additional options.

When telehealth is—and is not—the right setting

Telehealth can be valuable for medication follow-up, chronic-disease management, behavioral health, reviewing test results, and situations where travel is difficult. Privacy concerns should lead to informed choices, not automatic avoidance of remote care.

Telehealth is not a substitute for emergency services. Call 911 or seek immediate care for chest pain, severe trouble breathing, signs of stroke, loss of consciousness, severe bleeding, suicidal intent, or another emergency. A service that relies on delayed messages or questionnaires should not be used for urgent symptoms.

Key Takeaways

A health app or telehealth website is not automatically covered by HIPAA.
Federal regulators have alleged that some telehealth businesses shared sensitive health information or used deceptive billing and cancellation practices.
Advertising and analytics tools can reveal sensitive health interests even without transmitting a complete medical record.
Check the clinical provider, privacy practices, billing terms, security controls, and follow-up process before signing up.
Use accurate clinical information, but avoid sharing unrelated personal data.
After a breach notice, secure accounts, review affected information, monitor relevant activity, and use official complaint channels.

Sources

This article reflects information available on September 23, 2026. It is for general educational purposes and is not legal advice, personalized medical advice, diagnosis, or treatment.