> ## Content Index > Fetch the complete content index at: https://firegap.org/llms.txt > Use this file to discover other available public pages before exploring further. # Medical Data Part I: The Illusion of HIPAA - URL: https://firegap.org/medical-data-part-i-the-illusion-of-hipaa/ - Published: 2026-08-26T11:22:09.000Z - Updated: 2026-08-31T14:16:55.000Z - Description: HIPAA was written in 1996 — before smartphones, fitness trackers, and health apps. It doesn't cover what you think it covers, your medical records can't be deleted, and hundreds of millions of Americans have already had theirs stolen. - Author: Ryan Gardner - Tags: Privacy, Medical Data Series, Series, Data Collection, Artificial Intelligence You think your family's medical data is protected by law. It isn't. HIPAA was signed in 1996\. Nobody was carrying a device that tracked their heart rate, sleep, location, and conversations. The law was written for a world where medical data lived in filing cabinets and moved by fax. Today, most of the health data your family generates has no federal privacy protection at all. ## What HIPAA Actually Covers (And What It Doesn't) HIPAA regulates "covered entities" — hospitals, health plans, and healthcare clearinghouses — and the Protected Health Information they handle. If your doctor's office or your insurer creates or transmits your health data, HIPAA applies. There are rules about how they store it, who they share it with, and what they have to tell you. Here's what HIPAA does not cover: your smartwatch's heart rate data, your period tracking app, your mental health app, your genetic testing results, your employer wellness program, and anything you voluntarily type into a system that isn't tied to a covered entity. All of that — data that feels intensely personal and medical to you — sits outside HIPAA's jurisdiction entirely. It's governed by whatever privacy policy you clicked through without reading, backed by an FTC rule (the [Health Breach Notification Rule](https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule)) that sat on the books for over a decade before anyone started enforcing it. When a health app markets itself as "HIPAA compliant," it usually means the app partners with a covered entity and therefore falls technically within scope. It doesn't mean your data is safe. For most consumer health apps, HIPAA doesn't apply at all. Senator Bill Cassidy introduced the Health Information Privacy Reform Act in late 2025, which would extend HIPAA-like protections to wearable-generated health data. It's the first serious federal attempt to close the gap — nine months later, it's still a bill. ## The Permanent Record Problem You cannot delete a medical record. You can amend it, but the original entry stays. Even if it's wrong. Even if a doctor contradicted it an hour later. Under HIPAA you have the right to request an amendment, and the provider has 60 days to respond. If they approve it, a correction is appended as an addendum and the original remains intact. If they deny it, you can file a statement of disagreement, which also gets attached to the file. Either way, the original record is inalterable. Think about what that means for your kid. Every pediatrician visit, every ER trip, every lab result accumulates into a digital trail that follows them into adulthood — and they have no mechanism to remove any of it. ## The Breach Economy Medical data is the most valuable data on the black market. A stolen credit card number sells for $1 to $8\. A comprehensive medical record can go for $20 to $1,000, which some estimates put at 10 to 50 times the value of card data. It's worth more because you can't change it. You can cancel a card. You can't cancel your medical history. A stolen record carries your name, date of birth, Social Security number, insurance information, prescription history, and diagnoses — a complete identity package. The lifespan of the exploit is essentially the lifespan of the person. And the systems holding it are getting hammered. In February 2024, Change Healthcare — a UnitedHealth Group subsidiary and one of the largest claims processors in the US — [was hit by a ransomware attack](https://energycommerce.house.gov/posts/what-we-learned-change-healthcare-cyber-attack). The attackers walked in through a Citrix remote access portal with no multi-factor authentication. Stolen credentials. Nothing clever. The breach ultimately [affected an estimated 192.7 million people](https://www.hipaaguide.net/change-healthcare-data-breach/) — nearly two-thirds of the US population. ALPHV/BlackCat, a Russian-linked ransomware group, exfiltrated names, Social Security numbers, medical information, and insurance details. UnitedHealth paid a $22 million ransom. The data leaked anyway. Total costs exceeded $2.5 billion. It was the largest healthcare data breach in US history, and it wasn't an anomaly. In 2025, 772 healthcare breaches were reported to HHS, affecting roughly 138.5 million individuals — the worst year on record. In the first four months of 2026, another 252 breaches hit nearly 16 million people. The pattern holds. Collect enormous amounts of sensitive data, store it in systems with inadequate security, absorb the fine. The average healthcare breach costs $9.77 million, which sounds significant until you set it against UnitedHealth Group's $400 billion in annual revenue. Now add AI. Health systems are wiring assistants into patient interactions, which means every question you ask and every symptom you describe is potentially stored, analyzed, and attached to your profile. These models operate as black boxes — even their developers can't fully explain what a model retains. [Inference attacks](https://en.wikipedia.org/wiki/Inference%5Fattack) can reconstruct identifying details from supposedly anonymized outputs, and weak de-identification during training makes people re-identifiable once datasets are combined. The NIST AI Risk Management Framework flags exactly these risks, including disclosure of facial likenesses and speech patterns, but NIST's framework is voluntary. At least eight states had passed AI-specific health data statutes by early 2026, and [Texas House Bill 149](https://legiscan.com/TX/bill/HB149/2025), effective January 1, 2026, requires that patients be told when AI is involved in their care. Knowing an AI is processing your child's medical data doesn't give you any way to stop it. ## What Parents Can Actually Do There's no fix for data that's already been collected and breached. There are ways to limit what gets added. **Ask what's being recorded and where it lives.** Every time your kid sees a new provider: what goes in the official record, who has access, how long is it retained? You may not be able to prevent documentation, but you should know what exists. **Treat health apps as publishers, not vaults.** Period trackers, mental health apps, symptom checkers — deeply personal data, almost no regulatory protection. Assume anything you enter could be sold, shared, or breached. **Ask whether the AI tool is a business associate.** If your provider offers an AI assistant, that one question tells you whether your interactions fall inside HIPAA or outside it entirely. Some doctors understand the stakes better than the law does. Psychiatrists deliberately keep certain diagnoses out of their patients' official files. They withhold clinically relevant information from the insurance company — from the system — because they know that once it's in the record it stays forever, and they can't control who reads it or what it gets used for in ten years. They are practicing defensive medicine against the medical system itself. That should tell you everything you need to know about how much the people inside the system trust it.