iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ask what information is collected, why it is used, who can access or receive it, whether it is sold or used for advertising, how long it is kept, how it is protected, what choices you have, and whom to contact with concerns. For an app or wearable, also ask who operates it and whether HIPAA applies to that data in this situation. HIPAA does not automatically cover every health app or information stored on a personal device.
Start with these questions
You can ask a provider, health plan, clinic, app developer, or other organization handling your information. Ask for specific answers about your data, not just a general promise to protect privacy.
- What information do you collect, create, or receive about me?
- Why do you use it—for treatment, payment, health care operations, research, quality improvement, marketing, or another purpose?
- Who can see it within your organization, and which outside organizations or people receive it?
- What information goes to each recipient? Is any information sold or used for advertising?
- Which uses or disclosures can happen without my authorization, and which require my written permission?
- How long do you keep the information? Where is it stored, and what safeguards protect it?
- How can I request access to my information, a copy, or a correction? Can I ask for deletion, where that option is available?
- Who should I contact with a privacy question, complaint, or suspected breach?
- Do state laws give me additional protections?
These questions follow the main distinctions in ONC’s guidance on health apps, HHS guidance on HIPAA rights, and HHS information about privacy practices.
Find out whether HIPAA covers the information
HIPAA protection depends on who holds the information and in what role—not simply on whether the data is health-related. HIPAA’s Privacy and Security Rules apply to covered entities, such as health plans and most health care providers, and to their business associates when they handle protected information on their behalf. Many consumer apps used independently by patients are not covered by HIPAA. An app connected to a provider or plan may have a different role than the same app used on its own. Ask who operates the service, whether it is acting for a covered entity, and which information is covered. HHS explains the distinction in its consumer guidance on HIPAA.
#1 Best Overall
ONC cautions that health information shared with an organization outside HIPAA coverage may not receive HIPAA protection. Do not assume that a symptom tracker, wearable, or other personal-use app follows the same rules as your clinic or insurer.
Separate routine permitted sharing from uses that need authorization
Some information can be used or disclosed without asking you for permission first. Under HIPAA, covered entities may use or disclose information for treatment, payment, and health care operations, subject to applicable conditions; some public-health purposes are also permitted. This does not mean every transfer is allowed—the purpose, recipient, and legal conditions matter. See HHS guidance on disclosures for public-health activities and ONC’s overview of health information privacy law.
Other uses generally require written authorization. Many marketing uses and sales of information by covered entities, for example, generally require authorization, though legal rules have specific conditions and exceptions. Ask the organization to identify the basis for a disclosure rather than treating all sharing as either automatically permitted or always prohibited. HHS describes authorization requirements in its marketing guidance.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When an organization asks you to sign an authorization
Before signing, check that the document clearly says who may use or disclose the information, what information is involved, who will receive it, the purpose, and when the authorization expires. Ask what happens if you decline and whether you can revoke the authorization. HHS says authorization language must be understandable: “If people can’t understand it, it is not effective.” Read the HHS authorization guidance for the required elements.
Rank #3
- Chronic Illness Essential Gift: This A4 200-page medical records organizer is a perfect chronic illness gift. It serves as a comprehensive medical journal, ensuring you never miss vital information. Ideal for organizing health details with ease and efficiency.
- Blood Pressure Chart for Seniors: Our medical journal features detailed blood pressure charts for seniors, facilitating easy tracking of vital signs. This health journal for women and men is a crucial tool for managing blood pressure and maintaining health records.
- Comprehensive Medical Planner: The medical planner offers a structured approach to managing chronic illness. This blood pressure log book for daily tracking includes a blood pressure guide chart, making it a reliable chronic illness journal and vital signs log book.
- Medical Notebook for Patients: Designed as a medical notebook for patients, this organizer is perfect for maintaining detailed medical records. It serves as a blood pressure log, chronic illness journal, and health planner, ensuring all essential health data is recorded.
- Versatile Medical Log Book: This medical log book for daily tracking is ideal for organizing health information. As a medical records organizer, it includes a blood pressure log book, vital signs log book, and a planner for chronic illness management.
Review apps, wearables, and patient portals separately
For a consumer app or wearable, read the privacy policy and terms before entering sensitive information or connecting the service to a portal. Look for clear answers about what the developer can access, what data is exchanged with other parties, whether information may be used or sold, where it is stored, what security measures are described, and what control you have over sharing. ONC recommends checking whether information can be viewed, stored, downloaded, and shared securely, and whether the policy explains encryption and storage on your device or on the developer’s servers. Its guidance says: “If it does not, keep looking for one that does.” See ONC’s app privacy checklist.
Ask the app provider directly if the policy is unclear. A policy’s existence alone does not establish that HIPAA applies; ask who operates the app and whether it is acting for a covered entity or business associate in your particular use.
Ask how family and caregivers can access information
A provider may share information relevant to a family member’s or caregiver’s role in care or payment when the patient does not object. You can tell the provider not to share that information with a particular person. Ask what the provider currently shares, how to limit access, and whether a portal or other service has separate access settings. HHS explains this in its guidance on family members and friends involved in care and sharing information with family, friends, and others.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Know your rights and where to raise a concern
Ask how to exercise your HIPAA rights, including requesting access to information and a copy, and how to submit a complaint if you believe your rights were denied or your information was not protected. HHS and ONC describe patient rights and complaint routes; state law may provide additional protections. Start with the organization’s privacy contact, and consult HHS instructions for filing a HIPAA complaint if you believe a covered entity or business associate violated your rights.
Best Value
- No more exposed information in unprotected notary journals. This product shields clients' confidential information from prying eyes. It allows the Notary Public to keep the journal open during the transaction, as NO prior client information is viewable.
- Shields clients' AND Notaries Public' confidential information
- GLBA and HIPAA require strict confidentiality policies and procedures. Notary Privacy Guard is a compliance tool for the professional Notary Public.
- Decreases Notary Public's liability from exposing client information
- Journal column headers are printed on the Notary Privacy Guard, no having to peek underneath to complete the journal entry. Becomes part of the journal and also acts as a place marker.
Compare the answers, not just the privacy promises
When deciding whether to use a service or connect it to other accounts, compare the actual data-use arrangement across these points:
- Organization and role: Who operates the service, and is it a covered entity, business associate, or independent app provider?
- Information: What data does it collect, create, receive, or exchange?
- Purpose: What does it use the information for?
- Recipients: Which people or organizations receive it, and what do they receive?
- Permission: Which activities rely on your authorization, and which may occur without it under applicable rules?
- Retention and deletion: How long is the data kept, and what deletion choices are available?
- Storage and safeguards: Where is the information stored, and what protections are described?
- Access and complaints: How can you get a copy or correction, limit sharing where possible, and raise a concern?
This is U.S. federal consumer guidance, not a determination of how a particular state’s laws apply. Check applicable state guidance when you need to understand protections beyond federal HIPAA rules.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
