The article provides official guidance on how the Health Insurance Portability and Accountability Act (HIPAA) applies to online tracking technologies. It emphasizes the importance of protecting patient privacy and ensuring compliance when using digital tools for tracking purposes. The content is aimed at professionals navigating these regulations.

• Tracking tech on healthcare websites/apps (cookies, web beacons, pixels) can transmit PHI to third parties like Google or Meta, triggering HIPAA obligations even without login credentials
• Covered entities must have a valid HIPAA authorization or a Business Associate Agreement with tracking vendors before allowing them access to PHI, not just a general privacy policy disclosure
• IP addresses combined with visits to health-related pages can count as PHI, so even "de-identified" or aggregate analytics tools carry compliance risk
• Organizations face liability exposure if third-party trackers disclose PHI without proper safeguards, making an audit of existing tracking tools and vendor contracts a practical necessity

Many users are unaware that conversations with consumer AI about health issues lack legal protections, unlike communications with licensed healthcare providers. This article highlights the risks of disclosing personal health information to AI, which can be subpoenaed in legal situations, exposing users to potential misuse of their private data. It emphasizes the importance of understanding what privileges are lost when opting for AI assistance over traditional healthcare communications.

• Conversations with AI like ChatGPT or Claude aren't protected by legal privilege, unlike those with doctors or therapists, meaning they can be subpoenaed and used in court
• A wrongful death lawsuit already involved private mental health conversations being submitted as evidence
• OpenAI admits it doesn't train on user chats but authorized staff can still access them, leaving data vulnerable to legal requests
• Surveys show many users mistakenly believe AI chats carry the same confidentiality as conversations with doctors or lawyers

ChatGPT Health may be a marketing strategy rather than a genuine innovation, potentially allowing tech giants to dominate the healthcare sector. The article questions OpenAI's claims of enhanced security and adherence to HIPAA standards, drawing parallels to past controversies with data privacy in the tech industry.

• OpenAI's claims of HIPAA compliance and enhanced security for ChatGPT Health may be more marketing spin than substantive privacy protection
• The move could let a tech giant leverage user trust to gain a dominant foothold in the healthcare data market
• The situation echoes past tech industry controversies over data privacy, raising skepticism about the sincerity of OpenAI's promises