Remote care means writing things down. That is most of why it works — a written record beats a remembered one — and it is also the part that deserves scrutiny, because a written record exists somewhere, on something, belonging to someone.
This is general information, not legal advice. It is the set of things worth knowing before you decide how candid to be.
The distinction that matters most
In the US, health privacy law (HIPAA) applies to covered entities — clinicians, clinics, health plans — and to business associates, the companies they contract with to handle health information. Those business associates sign an agreement that binds them to the same rules.
A great many health-adjacent companies are neither. A direct-to-consumer wellness app, a symptom tracker you downloaded, a supplement quiz — these are typically governed by their own privacy policy and general consumer protection law, not by health privacy law. That is a much weaker constraint and it permits things you would probably not expect.
So the first question about any service is not "do you protect my data". Everybody says yes to that. It is: are you a covered entity or a business associate, and who else is?
Where health information actually leaks
Rarely a dramatic breach. Usually one of these:
Advertising trackers on health pages. This is the common one. A tracker on a page whose URL names a condition can report that URL, along with a cookie and an IP address, to an advertising company that has no health-privacy obligation. The page does not have to collect anything. The URL is the disclosure.
It is worth knowing this exists, because it is the reason a careful service will deliberately keep trackers off any page that names a symptom, a condition, or a clinic — and why a service with a marketing tracker running on its logged-in pages has made a choice about you.
Analytics inside the product. Product analytics are normal and useful. The question is what gets sent: an event saying a page was viewed is very different from an event carrying the text you typed. Ask whether analytics providers are covered by agreements, and whether free-text is excluded.
Third-party AI. If a service uses a model to summarise your notes or answer your questions, your text goes to whoever runs that model. Reputable arrangements cover this with a business associate agreement and configure zero data retention. Ask.
Your own devices. Notifications on a lock screen that name a condition. A shared computer with a logged-in session. A household member with your phone. Mundane and by far the most frequent.
Who can see your record inside the service
Legitimately, more people than you might assume: your clinician, the care team, billing, and technical staff with database access under audit. That is normal in every clinic, in person or not.
What is worth asking:
- Can the clinic that referred me see everything I write, or only what I share? In arrangements where a local practice and a remote service are linked, this is a real question with different possible answers.
- Is there an access log, and can I see it? Some systems can tell you who opened your record.
- What happens to the coach conversations? If a service has a chat function, ask whether those transcripts are part of your medical record, visible to your clinician, or separate.
Questions worth asking outright
- Are you a HIPAA covered entity or business associate?
- Which subprocessors handle my health information, and do they have agreements in place?
- Do you run advertising trackers on pages that name a health condition?
- Is any of my information used to train a model?
- Do you sell or share data with data brokers, in any de-identified form?
- Who at your company can read what I write, and is access logged?
- How do I get a full export of my record?
- How do I delete my account, and what is retained afterwards?
That last pair is the most practical. A service that can produce an export and describe its deletion policy in a sentence has thought about this. One that cannot has not.
De-identification, briefly
"We only share de-identified data" is a real practice with a real standard behind it, and it is also doing more work in marketing copy than it can carry. De-identified health data has been re-identified by researchers often enough that the claim deserves a follow-up: de-identified by which method, and shared with whom?
What reasonable candour looks like
The point of all of this is not to write less down. A record you have censored is a record that produces worse care — a side effect you did not mention because it was embarrassing is a side effect nobody adjusts for.
The point is to know which box you are writing into. A clinical record inside a covered entity, readable by your care team, is a reasonable place to be completely honest. A consumer wellness app with an advertising SDK is a reasonable place to be brief.
Most people's actual privacy risk is not their clinic. It is the four health apps on their phone that are not part of their care at all.