HIPAA Was Never Meant to Protect You From This: The Health Data Selling Machine Operating in Plain Sight
Photo: Bryan Beamer, Public domain, via Wikimedia Commons
Most Americans believe, reasonably, that their medical information is protected. They have heard of HIPAA. They assume that what they type into a mental health app, what medications they order through a discount pharmacy card, or what pages they read on a hospital's website is somehow shielded from commerce.
It is not. And the gap is wider than almost anyone realizes.
The Legal Vacuum, Explained Simply
HIPAA, passed in 1996, binds 'covered entities' — health providers, health plans, and their business associates. It says essentially nothing about the rest of the digital health economy. A period-tracking app, a mood diary, a telehealth platform's marketing partners, a hospital's website: these can fall entirely outside HIPAA's reach. The result is a sprawling secondary market in health-adjacent data that operates with near-total legal freedom.
Regulators have begun to notice. The Federal Trade Commission — which does have jurisdiction over deceptive trade practices — has taken action against companies for sharing health data with advertisers, including a high-profile enforcement action against the pharmacy discount platform GoodRx in 2023 for sharing user medication and health information with advertising partners without disclosure. BetterHelp, the online therapy service, faced a similar FTC action over sharing users' mental health information with advertisers. The FTC has also pursued cases involving health data used in targeted advertising through tracking pixels embedded in hospital and health-service websites. These enforcement actions, while significant, address individual bad actors; they do not close the structural loophole that made the practices legal to attempt in the first place.
The consequences are not hypothetical. Investigative reporting in recent years has documented tracking pixels on hospital websites transmitting appointment and condition-related information to technology companies, and health and fertility apps sharing user data with analytics and advertising firms. Once health data enters the broker ecosystem, it can be resold, combined, and re-identified with little transparency — and little recourse for the person it describes.
Why Privacy Is Now a Reproductive Justice Issue
Here is where the editorial argument becomes unavoidable. Since the Supreme Court's Dobbs decision in 2022 overturned Roe v. Wade, abortion is banned or severely restricted in a number of states, and some of those states have considered or pursued measures that could reach people who aid or facilitate abortion care. In that legal environment, data about a pregnancy search, a telehealth consultation, a medication order, or a period app's record of a missed cycle is not merely a marketing asset. It is potential evidence.
The same logic applies to LGBTQ+ health data. Information about gender-affirming care, HIV status, or mental health treatment carries heightened risk in states that have restricted gender-affirming care for minors and, in some cases, scrutinized providers of adult care. A data breach or a broker sale that once meant an awkward targeted ad can now mean exposure.
Progressives should be blunt about this: a healthcare system that surveils its patients is not a healthcare system. It is a watchlist with a waiting room. Privacy is not a luxury consumer preference; it is a precondition of care. People will not seek contraception, addiction treatment, mental health support, or abortion care if they reasonably fear the record will follow them.
The Strongest Rebuttal — and Why It Fails
Defenders of the status quo make two arguments. First, that data is typically 'anonymized' or 'de-identified.' But researchers have repeatedly shown that location data, combined with other data points, is trivially easy to re-identify; a handful of location points can uniquely identify most individuals. Second, that targeted advertising of health products is a consumer benefit — people see ads for things they need. Even granting that, the benefit accrues to advertisers, while the risk — re-identification, breach, legal exposure in hostile jurisdictions — accrues entirely to patients who never meaningfully consented. A trade that privatizes the upside and socializes the danger is not a trade. It is a transfer.
What Real Protection Looks Like
A handful of states have begun to move. Washington's My Health My Data Act, passed in 2023, was the first state law to regulate consumer health data broadly, requiring consent for collection and sale and creating a private right of action. Nevada followed with similar legislation. These are genuine starts, but a state-by-state patchwork leaves residents of most of the country exposed, and data does not respect the borders of states that happen to protect their citizens.
Federal action should include a comprehensive consumer health privacy statute covering all entities that collect health information, a ban on the sale of health data without affirmative opt-in consent, restrictions on health-related targeted advertising, and real enforcement authority with meaningful penalties.
Until then, the advice to patients is grimly practical: read privacy policies, use apps with strong track records, and assume that anything you type into a free health app may someday be read by someone you never agreed to meet.
Your medical privacy should not end where your doctor's office door closes — and every American who has ever searched a symptom deserves a law that says so.
