Digital tracking
Health-app data, advertising and privacy coverage
Understand how personal-use health-app data can differ from provider-held records, and what a dated enforcement case shows about advertising disclosures.
Sources checked .
The relationship behind the app matters
HHS explains that HIPAA protects health information handled by covered entities and their business associates. Personal-use app data is generally outside those rules unless the app is provided by a covered entity or business associate. The fact that information originated in a medical record does not by itself settle coverage of the app copy. HHS: personal devices and HIPAA scope
A specific 2023 advertising-disclosure case
On 02-22-2023, DOJ announced a GoodRx settlement and a court order entered on 02-17-2023. The government alleged unauthorized disclosures of identifying and health information despite privacy assurances. DOJ reported that the consent order prohibited health-data disclosures for advertising and imposed corrective obligations. This is historical case evidence, not a finding about the company's present practices. DOJ: GoodRx consent order, 2023
Phone permissions are only one part of the system
The FTC's developer guidance addresses minimizing collection, limiting permissions and evaluating third-party code and providers. It treats the app developer as responsible for its privacy promises when outside components are used. That recommendation is not proof of what a particular installed app actually sends. FTC: app permissions and third parties
Read collection and sharing claims together
The FTC's 2021 consumer advice recommends checking what health information an app collects, how it uses or shares it, and what its settings let a user control. Reading a notice identifies the company's claims; it does not independently verify all data flows. FTC: health-app privacy review
Questions and answers
Is every health app covered by HIPAA?
HHS says personal-use app data is generally outside HIPAA unless the app is supplied by a covered entity or business associate. HHS: personal devices and HIPAA scope
Does the GoodRx example establish a current violation?
The cited DOJ announcement describes a resolved 2023 case and its consent order. It does not audit present-day app behavior. DOJ: GoodRx consent order, 2023
Does a permission list establish every data flow?
The FTC's guidance also addresses third-party components, providers and privacy promises. A complete assessment needs evidence beyond a permission list. FTC: app permissions and third parties
Sources and scope
HHS, DOJ and FTC sources checked 10-23-2026. The GoodRx example is explicitly dated to 2023; the FTC consumer article is dated 2021. This page addresses data practices and legal-coverage context, not clinical effectiveness or an individual app's current compliance.
- DOJ announcement 02-22-2023: Digital Healthcare Platform Ordered to Pay Civil Penalties and Take Corrective Action. Checked 10-23-2026.
- Does your health app protect your sensitive info? (01-13-2021). Checked 10-23-2026.
- Mobile Health App Developers: FTC Best Practices. Checked 10-23-2026.
- Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet. Checked 10-23-2026.