Is it safe to upload my medical records to an AI chatbot?
Federal pages say HIPAA covers most providers but, in most cases, not an app you choose yourself.
Arun Verma, co-founder of Triangle · 2026-10-17
This is not clinical evidence and not medical advice. It does not replace your care team. Discuss anything here with your clinician before you act on it.
Is it safe to upload my medical records to an AI chatbot?
The federal pages cited here don't rate any chatbot as safe or unsafe. They describe which rules apply, and HHS says whether HIPAA protects what you put into an app depends on whether the app is provided to you by a covered entity or its business associate. That doesn't mean no law applies. The FTC says other federal laws likely apply when HIPAA doesn't. HHS's examples are written about apps and are fact-specific, so this page doesn't say how they apply to any particular chatbot.
Does HIPAA cover records I share with an app I chose myself?
Generally no. In most cases, HHS says, unless the app is provided to you by a covered entity or its business associate, the HIPAA Rules do not protect the privacy of data you've downloaded or entered into mobile apps for your personal use. HHS's FAQ 3009 says the same of records a covered entity sends at an individual's direction to an app that is neither a covered entity nor a business associate: the information is no longer subject to the protections of the HIPAA Rules. The same goes for records you download from a portal and upload yourself. OCR's scenarios treat that as a consumer organizing her own information, with no sign the provider hired the developer. And the origin of the records doesn't change it: HHS says HIPAA doesn't apply to health information you enter into such an app even if it came from a record created by a regulated provider.
What does HIPAA cover, and who is responsible for an app I choose?
HHS describes the HIPAA Rules as applying only when protected health information is created, received, maintained or transmitted by covered entities (health plans, most health care providers and clearinghouses) and their business associates. On the provider's side, HHS says in FAQ 3009 that a covered entity would have no HIPAA responsibilities or liability if an app you designated, one not provided by or on behalf of the provider, later has a breach.
When does HIPAA apply to a chatbot or app?
OCR's pages describe HIPAA reaching a tool when it is offered by or on behalf of a provider or health plan. The business associates page lists, as one example, a third-party AI chatbot on a provider's patient portal, handling things like symptom assessment, reminders and scheduling with a patient's information. In the app scenarios, a developer is a business associate when a provider contracts with it for patient management services. A tool you pick yourself looks different. OCR asks developers whether the app was independently selected by a consumer, and says a developer offering services only directly to consumers, and not on behalf of a provider, health plan or clearinghouse, is not likely to be subject to HIPAA as either a covered entity or a business associate. The scenarios are fact and circumstance specific, OCR says, and a change in the facts may change the analysis.
What protects my records if HIPAA doesn't apply?
Other federal law may, the FTC says: the FTC Act, which prohibits unfair or deceptive practices, applies to most app developers. Sharing consumers' health information with third parties after telling or implying that it will be kept private could violate it. The FTC also enforces the Health Breach Notification Rule. It requires certain organizations, both businesses and nonprofits, that aren't covered by HIPAA to notify customers, the FTC and sometimes the media after a breach of unsecured, individually identifiable health information. The FTC says the Rule isn't only about hacking: when a company itself discloses covered information without a person's authorization, that triggers notification too. The FTC's guidance says whether a product falls under the Rule turns on definitions, such as a personal health record's "technical capacity to draw information from multiple sources." ONC's 2011 consumer guide to web-based PHRs says federal and state privacy laws could potentially apply to a PHR company, depending on factors such as who provides the PHR and where they operate.
What if a tool says it is HIPAA-compliant?
OCR's older personal health records guidance says some PHRs not offered by covered entities may advertise that they are "HIPAA-compliant," yet the Privacy Rule doesn't apply to the information in them. They are governed by their own privacy policies plus any other applicable laws. The FTC separately tells businesses not to make false or misleading "HIPAA Compliant" claims. A fair question is whether the tool works on behalf of your provider or health plan, which is how OCR's business associates page describes a business associate: a person acting on behalf of, or providing certain services to, a covered entity.
What could I check before uploading anything?
HealthIT.gov's checklist for health apps says an app should have a privacy policy you can read and should state how it protects your information, such as whether it is encrypted and whether it is stored on your device or on the developer's servers. It also says the app should explain whether and how the developer may access and exchange your health information, or allow anyone else to use or sell it. OCR's personal health records guidance says people choosing a PHR that a covered entity doesn't offer should evaluate its privacy policy to decide if they are comfortable with the protections and rights offered, such as how their information will be safeguarded. These pages were written about health apps and PHRs, not chatbots, so you could ask any tool the same questions. A fair question is what happens to your information after you close your account, and whether you can opt out of sharing.
How much of my record should I share?
HHS's guidance on personal phones and tablets, which is about device tracking such as location and activity, says the best way to keep your health and personal information from being collected and shared by the device without your knowledge is to limit what personal information you send and store on or through it. That page doesn't mention chatbots. The FTC says, for purposes of the FTC Act, that "health information" includes more than treatments and diagnoses: anything that conveys information or enables an inference about a consumer's health. A fair question before uploading a full record is which parts the tool needs for what you want to ask it.
Who takes a complaint if something goes wrong?
HHS says that if you believe your health privacy rights have been violated, you can file a complaint online through the OCR complaint portal. OCR enforces the HIPAA Rules against covered entities and business associates. For other businesses, the FTC says to file a complaint at ReportFraud.ftc.gov or by calling 1-877-FTC-HELP.
Sources
- HHS OCR: Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet (content last reviewed June 29, 2022): HHS says the HIPAA Rules apply only when protected health information is created, received, maintained, or transmitted by covered entities (health plans, most health care providers, health care clearinghouses) and business associates.
- HHS OCR: Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet (content last reviewed June 29, 2022): HHS says that in most cases, unless the app is provided to you by a covered entity or its business associate, the HIPAA Rules do not protect the privacy of data you have downloaded or entered into mobile apps for your personal use, regardless of where the information came from.
- HHS OCR: HIPAA FAQ 3009, covered entity liability for an app the individual designates (created 04/18/19, last reviewed May 9, 2019): HHS FAQ 3009 says that once health information is received from a covered entity, at the individual's direction, by an app that is neither a covered entity nor a business associate, the information is no longer subject to the protections of the HIPAA Rules.
- HHS OCR: Health App Use Scenarios & HIPAA (PDF, Feb 2016): OCR's scenarios say a consumer who downloads data from her doctor's EHR through a patient portal and uploads it into a health app, adding her own information, does not make the app developer a business associate: she obtains the information from her provider, combines it with information she inputs, and uses the app for her own purposes, with no indication the provider or its business associate hired the developer.
- HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, section "Tracking within mobile apps" (content last reviewed June 26, 2024): HHS says the HIPAA Rules do not apply to health information that an individual enters into a mobile app offered by an entity not regulated by HIPAA, even if the individual obtained that information from their medical record created by a regulated entity.
- HHS OCR: HIPAA FAQ 3009, covered entity liability for an app the individual designates (created 04/18/19, last reviewed May 9, 2019): HHS FAQ 3009 says that where an app chosen by the individual was not provided by or on behalf of the covered entity, the covered entity would have no HIPAA responsibilities or liability if the app later experiences a breach.
- HHS OCR: Business Associates, section "Examples of Business Associates" (content last reviewed July 30, 2026): OCR's business associates page lists, among its examples of business associates, a third-party vendor artificial intelligence (AI) chatbot on a provider's patient portal that provides services involving the patient's PHI, such as symptom assessment, medical reminders, and appointment scheduling.
- HHS OCR: Business Associates, section "What is a Business Associate?" (content last reviewed July 30, 2026): OCR's business associates page says a business associate is, generally, a person that performs certain functions or activities regulated by the HIPAA administrative simplification regulations on behalf of a covered entity that involve creating, receiving, maintaining, or transmitting PHI, or that provides certain services to or for a covered entity that involve the disclosure of PHI to that person.
- HHS OCR: Health App Use Scenarios & HIPAA (PDF, Feb 2016): OCR's scenarios say a developer is a HIPAA business associate when a provider contracts with it for patient management services involving PHI, and also with respect to a personal health record app offered by a health plan; it is not one for its direct-to-consumer version of an app that is not provided on behalf of a covered entity or other business associate.
- HHS OCR: Health App Use Scenarios & HIPAA (PDF, Feb 2016): OCR's scenarios list "Is your app independently selected by a consumer?" among its key questions for developers, and say that a developer offering services only directly to and collecting information for or on behalf of consumers, and not on behalf of a provider, health plan or clearinghouse, is not likely to be subject to HIPAA as either a covered entity or business associate.
- HHS OCR: Health App Use Scenarios & HIPAA (PDF, Feb 2016): OCR's scenarios say the answers to its HIPAA questions are fact and circumstance specific, and that a change in a scenario may change the analysis.
- FTC: Mobile Health App Interactive Tool (page dated November 2024): The FTC's Mobile Health App Interactive Tool says the FTC Act applies to most app developers, including developers of health apps, and prohibits unfair or deceptive acts or practices, including those relating to the privacy and security of personal information that apps collect, use, maintain, or share.
- FTC: Mobile Health App Interactive Tool (page dated November 2024): The FTC's tool says that if you develop an app and share consumers' health information with third parties after telling or implying that their information will be kept private, you could be violating the FTC Act.
- FTC: Mobile Health App Interactive Tool (page dated November 2024): The FTC's tool says that when health information is not protected by the HIPAA Rules, other federal laws likely apply, and that the FTC Act applies to most app developers.
- FTC: Complying with FTC's Health Breach Notification Rule (edited January 2025): The FTC says its Health Breach Notification Rule requires certain organizations (businesses and nonprofits) not covered by HIPAA to notify their customers, the FTC and, in some cases, the media if there is a breach of unsecured, individually identifiable health information.
- FTC: Complying with FTC's Health Breach Notification Rule (edited January 2025): The FTC says a breach under its Rule is not limited to cybersecurity intrusions, and that unauthorized access, including a company's disclosure or sharing of covered information without a person's authorization, triggers notification obligations.
- FTC: Complying with FTC's Health Breach Notification Rule (edited January 2025): The FTC says its Rule applies to vendors of personal health records, PHR related entities and third party service providers, and defines a personal health record as an electronic record of identifiable health information with the technical capacity to draw information from multiple sources that is managed, shared, and controlled by or primarily for the individual.
- ASTP/ONC: Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices (PDF, 26 pp.; file dated September 2011), p. 5 ("What privacy and security requirements apply to Web-based PHRs?"): ONC's 2011 consumer guide to web-based PHRs says federal and state laws related to privacy and security could potentially apply to a PHR company and the information in its PHR, and that the legal requirements depend on many different factors, such as who provides the PHR and in which states they operate.
- HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF), section "PHRs Not Offered by HIPAA Covered Entities": OCR's personal health records guidance says some PHRs not offered by covered entities may advertise that they are "HIPAA-compliant," but the Privacy Rule does not apply to or protect the health information within them; they are governed by the privacy policies and practices of the entity offering them, plus any other applicable laws.
- FTC: Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule (August 2024): The FTC tells businesses not to make false or misleading claims that they are "HIPAA Compliant," "HIPAA Secure," "HIPAA Certified" or the like.
- HealthIT.gov (ASTP/ONC): How to Use It, section "What Should I Look For in a Health App?" (last updated January 20, 2026): HealthIT.gov's checklist says a health app should have a privacy policy you can read and should state how it protects your information, such as whether it is encrypted and whether it is stored on your device or on the app developer's servers. The checklist is written about health apps and does not mention chatbots.
- HealthIT.gov (ASTP/ONC): How to Use It, section "What Should I Look For in a Health App?" (last updated January 20, 2026): HealthIT.gov's checklist says a health app should explain whether and how the app developer may access and exchange your health information, or whether they may allow any other person or company to use it, or sell it.
- HHS OCR: Personal Health Records and the HIPAA Privacy Rule (PDF), section "PHRs Not Offered by HIPAA Covered Entities": OCR's personal health records guidance says that when selecting a PHR, individuals should evaluate the privacy policies to decide if they are comfortable with the protections and rights offered, such as how their information will be safeguarded, for what purposes it will be used and disclosed, and the extent to which the individual will control access to it. The guidance is about PHRs and does not mention chatbots.
- HHS OCR: Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet (content last reviewed June 29, 2022): HHS's guidance on personal phones and tablets, which addresses how devices and apps collect and share information such as location and activity, says the best way to protect your health and personal information from being collected and shared by your personal cell phone or tablet without your knowledge is to limit what personal information you send and store on or through the device. The page does not mention chatbots.
- FTC: Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule (August 2024): The FTC says, in its section on how the FTC Act applies to health information, that "health information" includes more than treatments and diagnoses: it is anything that conveys information or enables an inference about a consumer's health.
- HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, section "Tracking within mobile apps" (content last reviewed June 26, 2024): HHS says that if you believe your (or someone else's) health privacy rights have been violated, you can file a complaint online through the OCR complaint portal, and that OCR administers and enforces the HIPAA Rules, including by investigating breach reports and complaints about regulated entities' noncompliance with the HIPAA Rules (regulated entities being covered entities and business associates).
- FTC: Complying with FTC's Health Breach Notification Rule (edited January 2025): The FTC says that to file a complaint, you can visit ReportFraud.ftc.gov or call toll-free 1-877-FTC-HELP.
Start your 7-day free trialhealthmemory is made by Triangle. 7-day free trial, then $9 a month. Cancel anytime.