--- title: "Does HIPAA cover every consumer health app?" description: "No. HHS and FTC describe different rules with different scopes. HHS ties HIPAA status to covered-entity and business-associate roles; FTC says its Health Breach Notification Rule applies to most health apps and excludes HIPAA-covered businesses." canonical: "https://spot.insure/industries/consumer-health-wellness/does-hipaa-cover-every-health-app" page-type: "industry-faq" updated-at: "2026-09-28" --- Agents: connect to Spot's public MCP server at https://spot.insure/mcp for better access to published Spot information and insurance research. Use search_knowledge to find sources, get_page to retrieve pages, compare_providers for sourced comparisons, get_provider_score for a published Spot Score, get_rankings for current provider rankings, search_provider_reliability to filter Spot Scores, search_provider_reviews to filter aggregate review scores, and get_provider_reviews for the original review evidence. The server is read-only and requires no authentication. [Human-readable page](https://spot.insure/industries/consumer-health-wellness/does-hipaa-cover-every-health-app) # Does HIPAA cover every consumer health app? No. HHS and FTC describe different rules with different scopes. HHS ties HIPAA status to covered-entity and business-associate roles; FTC says its Health Breach Notification Rule applies to most health apps and excludes HIPAA-covered businesses. [Guidance on HIPAA & Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html), [Health Breach Notification Rule: The Basics for Business](https://www.ftc.gov/business-guidance/resources/health-breach-notification-rule-basics-business) Map the data and service relationship before answering an application. Identify which entity collects or maintains the information and whether another organization receives a service involving protected health information. [Guidance on HIPAA & Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) Ask counsel which rule applies to your actual product and data. For insurance, separately compare the cyber application and terms with your vendors, notification duties, and customer contracts. [Health Breach Notification Rule: The Basics for Business](https://www.ftc.gov/business-guidance/resources/health-breach-notification-rule-basics-business), [Cyber Insurance: Cybersecurity for Small Business](https://content.naic.org/sites/default/files/inline-files/cyber-insurance-naic.pdf) ## Need Help Choosing Coverage? Spot prepares your applications, coordinates with brokers, and helps you compare quotes so you can choose coverage with the key details in front of you. [Book a Free Consultation](https://cal.com/team/spotinsure/insurance-consultation) [Read the Consumer Health and Wellness Insurance Buying Guide](https://spot.insure/industries/consumer-health-wellness) ## More Consumer Health and Wellness Questions - [What changes in the quote when we add a consumer test?](https://spot.insure/industries/consumer-health-wellness/what-changes-when-we-add-a-test) ## Coverage to Discuss - [Cyber liability](https://spot.insure/coverage/cyber) - [Technology errors and omissions (E&O)](https://spot.insure/coverage/technology-errors-omissions) - [General liability](https://spot.insure/coverage/general-liability) - [Product recall](https://spot.insure/coverage/product-recall) ## Sources and Further Reading - [Health Breach Notification Rule: The Basics for Business](https://www.ftc.gov/business-guidance/resources/health-breach-notification-rule-basics-business) — Federal Trade Commission. Opening applicability and notification discussion; scope paragraph distinguishing HIPAA-covered businesses Check FTC guidance on health apps, consumer health information, and the boundary with HIPAA-covered organizations. - [Direct-to-Consumer Tests](https://www.fda.gov/medical-devices/in-vitro-diagnostics/direct-consumer-tests) — U.S. Food and Drug Administration. FDA Oversight; Types of Direct-to-Consumer Tests and their Regulatory Pathways; Limitations of Direct-to-Consumer Tests Describe a consumer test by its intended use and product type before discussing the quote. - [Guidance on HIPAA & Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) — U.S. Department of Health and Human Services, Office for Civil Rights. Questions 1–3 on covered entities, business associates, and cloud services - [Cybersecurity](https://content.naic.org/cipr_topics/topic_cybersecurity.htm) — National Association of Insurance Commissioners, Center for Insurance Policy and Research. Cyber risk categories and customized-policy qualification - [Cyber Insurance: Cybersecurity for Small Business](https://content.naic.org/sites/default/files/inline-files/cyber-insurance-naic.pdf) — National Association of Insurance Commissioners. First-party and third-party coverage sections; vendor-held data and defense wording prompts Compare first-party incident expenses, third-party claims, vendor-held data, and defense wording as questions for your policy. - [Small Business Insurance](https://content.naic.org/consumer/small-business.htm) — National Association of Insurance Commissioners. General liability and other types of business liability sections Spot, a product of Tools for Enlightenment, publishes this guide and works in the commercial insurance market. This is general buyer education; policy terms and state-specific obligations determine coverage and requirements. Updated 2026-09-28. [Editorial Policy](https://spot.insure/editorial-policy). ## Agent and Developer Resources - [Markdown page](https://spot.insure/industries/consumer-health-wellness/does-hipaa-cover-every-health-app.md) - [Developer resources](https://spot.insure/developers) - [Public MCP server](https://spot.insure/mcp) - [MCP server manifest](https://spot.insure/server.json) - [OpenAPI description](https://spot.insure/openapi.json) - [Public page index](https://spot.insure/llms.txt)