The HIPAA Loophole: Who Can Sell or Share Your Medical Records Without Asking — and How to Opt Out

HIPAA protects medical records in many traditional health care settings, but health information collected by independent apps, websites, wearables, and data brokers can fall under different rules. Knowing where your information goes—and how to request deletion or opt out—can help reduce your digital health footprint. (Pexels).

Your medical records may feel like some of the most private information you own, but HIPAA does not protect every piece of health-related data about you. The federal law generally applies when protected health information is handled by covered health plans, qualifying health care providers, clearinghouses, and their business associates—not every app, website, wearable, search engine, or data broker that learns something about your health.

That distinction has become increasingly important as Americans use digital tools for everything from checking lab results to tracking sleep, fertility, medications, and mental health. A 2025 KFF poll found roughly three in four U.S. adults had used a health care app or website during the previous year, while 75% were concerned about privacy when such a tool was managed by a private technology company. The so-called HIPAA loophole is therefore less a loophole in one statute than a gap between what consumers assume HIPAA covers and what it actually covers.