AI in Healthcare & Science · Health Data Privacy and AI

Does HIPAA Cover Data Used to Train AI Health Tools?

HIPAA can apply to health data used to train AI tools when that data is handled by a covered entity or business associate and qualifies as protected health information, but many popular health and wellness apps fall outside HIPAA's scope entirely, so coverage depends heavily on who collects the data and how.

Medical disclaimer

This page is for general educational purposes only and is not medical advice. It does not replace a consultation with a licensed physician, pharmacist, or other qualified health provider. Always talk to your own care team before starting, stopping, or changing any medication or supplement.

Legal disclaimer

This page provides general information only and is not legal advice. Laws vary by jurisdiction and change over time. Consult a licensed attorney in your jurisdiction before making decisions based on this content.

Key takeaways

HIPAA generally applies to covered entities like healthcare providers, insurers, and their business associates, not to every company that touches health-related data.
Many consumer health and wellness apps are not covered by HIPAA because they aren't operated by a HIPAA-covered entity.
Data that has been properly de-identified according to HIPAA standards is generally no longer subject to the same restrictions.
Whether a specific AI tool's training data is HIPAA-protected depends on the exact data source and the entity handling it, not on the fact that the data is 'health-related.'

It Depends on Who’s Collecting the Data, Not Just What Kind It Is

A common misconception is that HIPAA automatically protects any data that relates to a person’s health. In reality, HIPAA’s protections generally apply to “covered entities” — healthcare providers, health plans, and healthcare clearinghouses — along with their “business associates” who handle protected health information on their behalf. If an AI health tool’s training data comes from within this ecosystem, such as a hospital system’s records used under an appropriate business associate agreement, HIPAA’s rules are likely relevant. But if the data comes from a standalone consumer app that isn’t affiliated with a covered entity, HIPAA typically doesn’t apply at all, even though the data itself might be just as sensitive.

This distinction is important because a huge amount of health-related data generated today — through fitness trackers, symptom-checking apps, wellness platforms, and similar consumer tools — is generated entirely outside the HIPAA-covered ecosystem.

Why So Many Health Apps Fall Outside HIPAA

Many popular health and wellness apps are built and operated by technology companies that are not healthcare providers, insurers, or clearinghouses, and they don’t have a business associate relationship with one either. In these cases, HIPAA’s specific rules around use, disclosure, and safeguarding of protected health information generally don’t apply to the data these apps collect, even if users reasonably assume “health app” means “HIPAA-protected.” This is one of the most persistent gaps in consumer understanding of health data privacy, and it has real implications for how freely such data might be used, including as potential training data for AI systems, depending on the app’s own privacy policy and applicable non-HIPAA laws.

De-Identification Changes the Picture

When health data is de-identified according to HIPAA’s defined standards, it generally falls outside HIPAA’s protections going forward, since the rules are built around protecting individually identifiable information. This matters for AI training specifically, because organizations that do handle HIPAA-covered data sometimes use properly de-identified datasets to train models, arguing that de-identification addresses the core privacy concern HIPAA is meant to protect against. Whether de-identification has been done correctly, and whether it truly prevents re-identification in practice, are separate and sometimes debated questions.

Bottom Line

HIPAA can apply to health data used in AI training, but only when that data originates from and is handled by a HIPAA-covered entity or its business associate — a great deal of health-related data collected by consumer apps and wellness platforms falls outside HIPAA’s scope entirely, making the specific data source the key factor rather than the general sensitivity of the information.

Important caveats

HIPAA's applicability is fact-specific and can be legally complex; this is a general overview, not legal advice for a specific situation.

Frequently asked questions

Are consumer fitness and wellness apps covered by HIPAA?

Generally not, unless the app is directly operated by or on behalf of a HIPAA-covered entity such as a healthcare provider or insurer. Most standalone consumer wellness apps fall outside HIPAA's direct scope, which is a common point of confusion for users.

What does it mean for health data to be 'de-identified' under HIPAA?

HIPAA sets out specific methods for removing or altering identifying information from health data so that it can no longer reasonably be linked back to an individual. Once data meets these standards, it's generally no longer treated as protected health information under HIPAA.

If HIPAA doesn't apply, does that mean there's no privacy protection at all?

Not necessarily — other laws, such as state privacy statutes or general consumer protection and data privacy laws, may still apply even when HIPAA does not, though the specific protections vary significantly by jurisdiction and company.

Sources

[1]HIPAA and health information privacy guidance — U.S. Department of Health and Human Services
[2]Health data and AI policy resources — National Institutes of Health

Written by Editorial Team

Last updated July 25, 2026

Get one well-sourced answer a week

No spam. Unsubscribe anytime.