Less than most people assume, and the gap is structural rather than criminal. HIPAA protects a setting, not a category of information. It binds health plans, clearinghouses and providers who bill electronically. It does not bind most of the places health information is now generated. That distinction is not academic. When the Federal Trade Commission acted against GoodRx in February 2023, it could not use HIPAA at all — it used the Health Breach Notification Rule, and part of its complaint was that GoodRx had falsely suggested to consumers that it complied with HIPAA. What GoodRx had actually done was compile lists of users who bought particular medications and upload their email addresses, phone numbers and mobile advertising identifiers to Facebook, Google, Criteo, Branch and Twilio, so those users could be advertised to on the basis of their prescriptions and health conditions. The penalty was $1.5 million. The FTC brought a comparable action against BetterHelp over mental-health questionnaire data shared with advertisers. Scale is the other half. In 2024 a ransomware attack on Change Healthcare, a UnitedHealth subsidiary that processes a large share of American medical claims, exposed the data of roughly 190 million people — the largest health-data breach in United States history, and not a break-in at a doctor's office but a failure at a clearing house most patients had never heard of and none had chosen. So the honest answer is that medical privacy in America is strong where a clinician is involved and weak nearly everywhere else, and the largest single loss of it was not a violation by anyone treating a patient.
- HIPAA binds covered entities — plans, clearinghouses, and providers billing electronically — not most apps, wearables or websites that collect health information
- FTC v. GoodRx, February 2023: $1.5m civil penalty under the Health Breach Notification Rule, not HIPAA
- GoodRx uploaded email addresses, phone numbers and mobile advertising IDs of users of specific medications to Facebook, Google, Criteo, Branch and Twilio
- The FTC complaint stated GoodRx had falsely suggested to consumers that it complied with HIPAA
- The FTC brought a comparable action against BetterHelp over mental-health questionnaire data shared with advertisers
- 2024: a ransomware attack on Change Healthcare, a UnitedHealth subsidiary, exposed the records of roughly 190 million people — the largest US health-data breach on record
Open questions
- These are enforcement actions and a breach. None of them establishes that any individual's records were accessed by any particular party for any particular purpose.
- A breach exposes data. It does not establish what was subsequently done with it, and in most cases that cannot be traced.
- This concept does not address law-enforcement access to medical records, which is governed by different rules and is a separate question.
References
- FTC enforcement action against GoodRx (2023)
- What happens to everyone around a target?
- Are people made into intelligence assets without knowing it?
The FTC is cited for its own enforcement action. The linked concepts describe adjacent collection markets and neither corroborates this one.
Not independently verified
This concept reports enforcement actions and a publicly disclosed breach. It establishes no unlawful access to any individual's records, and no conduct by any clinician or care provider.
Topics: Technology · Surveillance & memory access · Law enforcement & government