The HIPAA loophole, summarised
US health privacy law (HIPAA) covers "covered entities" — hospitals, insurers, clinical providers. It does not cover the wellness app that helps you track your period, the SSRI-symptom journal, or the fertility chatbot that ingested your most intimate questions.
That gap created a multi-billion-dollar parallel market. The 2023 GoodRx and BetterHelp settlements made the playbook explicit. The 2026 wave showed it never really stopped.
The pattern that keeps repeating
FTC GoodRx (Feb 2023) — first enforcement under the Health Breach Notification Rule, for sharing prescription data with Meta and Google. The FTC press release lays out the exact data flows.
FTC BetterHelp (March 2023) — barred the company from sharing mental-health intake data with advertisers, with a $7.8M consumer refund. Same playbook, different vertical.
Mozilla Privacy Not Included reproductive-health reviews — ongoing audits show most period and fertility apps still share cycle data with third parties despite post-Dobbs scrutiny.
These are the cases the regulators have already proven on the record. The 2026 wave of activity is built on top of this same Health Breach Notification Rule framework.
What's actually in the broker file
The categories regulators have already documented in enforcement actions are specific:
Prescription data shared with advertising platforms (FTC GoodRx, February 2023)
Mental-health intake data shared with advertisers (FTC BetterHelp, March 2023)
Cycle data from period and fertility apps shared with third parties (Mozilla Privacy Not Included)
Each individual signal is "anonymous." STAT's investigation of the health-data broker market found that brokers trade in Americans' health information "without their knowledge or consent, and beyond the reach of federal health privacy laws," and that advances in artificial intelligence now allow that data to be sliced, diced, and cross-referenced cheaply and at scale.
How to shrink your file
Stop using period and fertility apps that aren't local-first. A short list of audited local-first options exists; Mozilla maintains one.
Use a separate email for any health-adjacent service. Aliases (one per service) make later opt-out trivial.
File a CCPA/state-equivalent deletion request with the major health-data brokers (LiveRamp, Acxiom, Experian Health).
Pay attention to wearable cloud sync. Local mode + manual export is almost always available; vendors hide it.
Health data was supposed to be the most protected category. It became the most freely traded. The fix is largely regulatory — and it is finally moving.