Telehealth privacy: the clinic, app and data-sharing boundary

Identify who is providing each service

A telehealth offer can involve a storefront, a medical practice, a pharmacy, a video platform and a separate wellness app. Those names may appear in different documents. Start by identifying who provides clinical care, who maintains the medical record and who operates any optional app or tracking feature.

A public privacy policy and a healthcare provider’s notice of privacy practices can describe different activities. Read the document attached to the service you intend to use. A familiar brand name across several screens does not establish that every company has the same legal role or handles information in the same way.

Where HIPAA protection may change

HHS explains that HIPAA applies to covered entities and business associates. Health information in personal devices or consumer apps is not automatically covered merely because it is sensitive or originated in a medical record. Whether an app is provided by, or acts on behalf of, a covered entity matters.

For example, choosing a separate app and transferring information into it can change the privacy context. This is different from assuming that a provider’s patient portal is outside HIPAA. The useful question is who operates the specific service and in what capacity, rather than whether the screen looks clinical.

Questions that make a privacy notice useful

Look for the organization responsible for the information, the purposes for collecting it, the parties with whom it may be shared and the available privacy contact. Distinguish information needed for care from optional features or additional tracking. If the documents use several company names, ask how their roles connect.

Before connecting a separate app, ask what information will be transferred, whether the connection is optional and how to stop future transfers. Do not assume that removing an app also deletes existing records or stops an unrelated subscription. Those are separate requests whose consequences should be explained by the relevant service.

Privacy claims are not an independent security audit

A HIPAA statement or a padlock icon cannot, on its own, establish how a service secures all of its data. Reading a policy also cannot verify its technical implementation. Peptide Alliance’s business-identity criterion checks whether the responsible business is identified; it does not certify a seller’s privacy or cybersecurity practices.

Businesses outside HIPAA may still have obligations under other laws. FTC guidance describes a Health Breach Notification Rule that applies to certain health-information businesses. Being outside HIPAA is therefore not the same as being outside all privacy requirements, and this guide does not determine which law governs an individual dispute.

For a telehealth appointment itself, HHS recommends practical steps such as choosing a private location and considering who can see or hear the consultation. Those steps complement questions about the service’s data practices; they do not replace them.

Related reading

• Canceling telehealth: what happens to the next charge, order and refund?
• Does nationwide telehealth mean every prescription is available?
• Medical records and prescription transfers are different requests