iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protecting medical records in a wearable health app takes more than changing one setting: limit what the app can access, secure its account, check where data goes, and use the service’s own process to request deletion. Do not assume an app is covered by HIPAA just because it handles health information; coverage depends on the organization’s role and relationships.
Start by checking who can access your wearable health data
Review the app’s permissions, connected accounts, and sharing controls. Check which health categories it can read or write, whether it connects to other services, and whether it can share data with other apps or people. Remove access that is not needed for the app’s functions.
On Android, Health Connect provides a place to review and revoke permissions for connected apps, including access to wearable-derived health data. Open Health Connect and use its app-permission controls to inspect the categories each app can access. See Google’s instructions for managing connected apps in Health Connect. Revoking access prevents future access through that permission, but it does not necessarily remove data the app previously copied to its own servers.
Secure the account and devices that hold the records
- Use a strong, unique password for the health-app account rather than reusing a password from another service.
- Turn on multi-factor authentication (MFA) if the app or its sign-in provider offers it. A hardware security key is an option only when that account supports it.
- Install updates for the wearable, phone operating system, and companion app. Updates can address security vulnerabilities.
These measures reduce avoidable risks, but no single setting guarantees that health data cannot be exposed. The FTC’s guidance for app developers recommends authentication, security updates, encryption, and limiting access to what an app needs; those recommendations describe good practices, not proof that a particular app follows them. Read the FTC’s Mobile Health App Developers: FTC Best Practices, published in December 2022.
#1 Best Overall
- What You Get - A 12-month membership, WHOOP 5.0 device, a SuperKnit band, and a waterproof* Wireless PowerPack. Choose from a range of band and accessory combinations, and add a waterproof Wireless PowerPack for on-the-go charging.
- HSA/FSA Eligible - All 12-month WHOOP memberships and battery packs qualify for HSA/FSA reimbursement.
- Screenless, Distraction-Free - No screen, no buzzing notifications. WHOOP focuses entirely on your health and performance, with up to 14+ day battery life so you can wear it around the clock.
- Healthspan with Pace of Aging - Understand how your daily habits shape long-term health. Healthspan measures your WHOOP Age and Pace of Aging so you can take science-backed action to slow biological aging and extend your prime years.
- 24/7 Health Insights - WHOOP monitors your heart rate every second of every day, delivering personalized Sleep, Strain, Recovery, VO2 max, Menstrual Cycle, and Heart Rate insights along with a Real-time Stress Monitor that pinpoints your stressors and shows how your body responds in the moment, so you can make better decisions about training, rest, and daily performance.
Read the privacy notice for the data lifecycle
Look for clear answers to these questions in the privacy policy and in-app notices:
- What health and device data does the app collect, and why?
- Who receives the information, including service providers and other apps?
- How long does the company retain it?
- Can you export or delete the records, and what happens when you close the account?
- Can you opt out of optional collection or sharing without losing a feature you need?
Pay attention to whether sharing is optional and whether the explanation matches the choices the app actually offers. The FTC advises developers to minimize collection and retention, use privacy-protective defaults, vet third-party providers, and communicate clearly about data practices. A company’s privacy promise and its legal obligations are related but distinct questions; a promise should not be treated as a substitute for checking the app’s controls and applicable rules.
Rank #2
- Simple & Screen-Free Design – Easy to use and ultra-lightweight, comfortable for all-day wear without the distraction of a screen
- Powerful Health Monitoring – Accurately tracks heart rate, blood pressure, blood oxygen, HRV, sleep quality, and stress levels to help you better understand your body
- 100+ Sports Modes – Supports a wide range of fitness activities with precise tracking, making it your reliable companion for workouts and daily movement
- Ultra-Long Battery Life – Just 2 hours of charging powers up to 47 days of standby, so you can focus on your goals without constant recharging
- No Subscription Required – Enjoy all features with the free app, fast syncing, and easy Bluetooth connection—no hidden costs
Deleting the app may not delete records already uploaded
Uninstalling an app removes it from your phone; it does not necessarily erase information the service has already received. Likewise, revoking a platform permission may stop future sharing through that connection without deleting previously uploaded records.
- Check the app’s account settings or privacy notice for a data-deletion option.
- If there is no self-service control, contact the service and request deletion of the health data associated with your account.
- Ask whether the request covers data held by service providers and what information, if any, must be retained.
- After the service confirms deletion, revoke unneeded platform permissions and disconnect linked accounts.
The service’s own deletion process determines what it can remove; check its instructions rather than assuming that removing the app or disconnecting a wearable erases server-side records.
Rank #3
- What You Get - A 12-month membership, WHOOP MG device, a SuperKnit Luxe band, and a waterproof* Wireless PowerPack. Choose from a range of band and accessory combinations, and add a waterproof Wireless PowerPack for on-the-go charging.
- HSA/FSA Eligible - All 12-month WHOOP memberships and battery packs qualify for HSA/FSA reimbursement.
- Screenless, Distraction-Free - No screen, no buzzing notifications. WHOOP focuses entirely on your health and performance, with up to 14+ day battery life so you can wear it around the clock.
- Heart Screener with On-Demand ECG - Take an ECG reading from your wrist in seconds to check for signs of atrial fibrillation. Heart Screener gives you a medical-grade view of your heart rhythm whenever you need it.
- 24/7 Health Insights - WHOOP monitors your heart rate every second of every day, delivering personalized Sleep, Strain, Recovery, VO2 max, Menstrual Cycle, and Heart Rate insights along with a Real-time Stress Monitor that pinpoints your stressors and shows how your body responds in the moment, so you can make better decisions about training, rest, and daily performance.
Is a wearable health app covered by HIPAA?
Not automatically. In the United States, HIPAA applies to covered entities and their business associates. An app’s function and its relationship with a provider, health plan, or other covered organization matter. An app supplied by a provider or operating on a covered organization’s behalf may have a different role from a consumer app that you choose and manage yourself. HHS publishes mobile health app scenarios to help explain when an app developer may be a business associate.
If an app claims to be “HIPAA compliant,” ask which organization provides it and what role the app company plays. The label alone does not establish that HIPAA governs every record in the app.
Rank #4
- Google Fitbit Air is the unbelievably comfortable, exceptionally smart way to transform your health[1]; and Google Health brings together effortless tracking and adaptive coaching to help make the most of your everyday[2]
- Unlock more with Google Health Premium: With a premium membership, get personalized coaching that’s built with Gemini and adapts to your life[2]; get a 3-month trial at no cost to you[5] (Google Health Premium subscription sold separately)
- Comfortable fit - One Size Tracker (130-210 mm): The lightweight, micro-adjustable fit sits comfortably and quietly, so you can wear Google Fitbit Air through work, play, and sleep; advanced sensors and new algorithms power more accurate, precise health tracking, 24/7[1]
- Designed for every occasion: With no screen to distract you or disrupt your style, your tracker moves seamlessly from bracelet to workout band to sleep band, and you can change looks in seconds – just press the pebble in, click, and go
- Long battery life: Google Fitbit Air’s battery lasts up to a week, and fast charging gets you one day of battery life in just five minutes[6,7]
What protections may apply outside HIPAA?
Some health apps outside HIPAA may still fall under the FTC’s Health Breach Notification Rule. The FTC describes a personal health record (PHR) as an electronic record of identifiable health information that can draw from multiple sources and is managed, shared, and controlled by or primarily for the individual. Its guidance says an app that collects consumer data and can sync with a fitness tracker is probably a PHR vendor. The Rule also addresses certain PHR-related entities and service providers. Read the FTC’s compliance guidance for the Health Breach Notification Rule.
The FTC says amendments to the Rule clarified its application to health apps and similar technologies; they took effect July 29, 2024. Depending on the entity and incident, the Rule can require notification to affected consumers and the FTC, and in some circumstances the media, after a breach involving unsecured identifying health information. Those duties depend on the specific facts; the Rule is not a promise that an app is safe or that every health app is covered. HHS also explains the distinction between HIPAA and consumer health information in “Collecting, Using, or Sharing Consumer Health Information?”
These are U.S. federal sources. State privacy laws and laws outside the United States may add requirements, and the rules for a particular app depend on its services, data, and location.
Quick Recap
Use these checks when choosing or keeping an app
- Data collected: Are the health categories collected necessary for the features you use?
- Permissions: Can you independently control access to health categories and connected services?
- Sharing: Does the app explain third-party sharing, and can you decline optional sharing?
- Account security: Does it offer MFA and clear account recovery controls?
- Retention and deletion: Can you export records, request deletion, and understand what happens when you close an account?
- Updates and support: Does the provider maintain the app and explain how to get help with privacy or security concerns?
- Provider relationship: Is the app operated for a health provider or plan, or is it a direct-to-consumer service? That distinction can affect which legal protections apply.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
