Is my conversation with an AI about my symptoms covered by HIPAA?

No. HIPAA regulates covered entities — health plans, clearinghouses and providers conducting certain electronic transactions — and the business associates they hire under contract. You are not one, and a general-purpose AI company is not one either, so a conversation between you and a chatbot about your own health sits entirely outside the law rather than being weakly protected by it.

If I connect my patient portal to an AI app, do my records keep their protection?

No. HIPAA follows the entity, not the data. Your hospital stays bound by it; the copy of your chart sitting in a consumer AI account is governed by that company's terms and policies instead. OpenAI's ChatGPT Health, which rolled out across the US on July 23, 2026, states that connected records are not used to train models or target ads and that synced data is deleted within 30 days of disconnecting — but those are product commitments, not HIPAA, and OpenAI does not offer a Business Associate Agreement on the standard consumer plans.

Does deleting the chat remove the health information?

It removes it from your visible history, which is not the same thing. Anything already absorbed into training is not retrievable, memory entries are deleted separately from conversations, retention windows run on the provider's clock, and a legal preservation order overrides the delete button entirely — as happened when a May 2025 order in the New York Times litigation required OpenAI to retain logs that would otherwise have been deleted.

Can advertisers see that I asked about a health condition?

Under current policy, no: OpenAI states that ads are not eligible near sensitive topics including personal health and mental health, and that advertisers do not receive your chats or sensitive information. Treat that as a policy rather than a structural guarantee — it is written by the party it binds and can be revised, and the FTC's actions against GoodRx, BetterHelp and Premom all involved health data reaching advertising platforms after similar assurances.

Is "de-identified" enough for health data?

Less than for most other data. A rare condition plus an approximate age plus a location can be close to unique. Under the EDPB's 2026 draft anonymisation guidelines, and the Court of Justice's EDPS v SRB ruling behind them, anonymity is relative and the test is whether anyone with realistic means could single out, link or infer — a standard that a paragraph of someone's own medical history often fails.

What is the safest way to get a useful answer?

Describe the clinical picture rather than the person: age range and relevant history instead of name and date of birth, transcribed values instead of an uploaded lab PDF, photos with metadata stripped, other people left out. Start in temporary mode, never use a work device, and treat the answer as preparation for an appointment rather than a substitute for one. Using a service that reaches the models without your identity attached — Secret Chat AI — removes the association; keeping identifiers out of the text is still your part.

Asking AI About Symptoms: The Privacy Risk

Published August 10, 2026 · Facts last verified August 10, 2026

This article is general information, not legal or medical advice. For advice about your own situation, consult a qualified professional.

It is almost never a considered decision. Something hurts, or a test result arrives with a number and no explanation, or a mole looks different than it did in the spring — and the appointment is eleven days away, and it is a quarter past one in the morning. So you open an app and start typing, in the plain, unguarded language you would never use on a form.

You are in enormous company. OpenAI reported in January 2026 that more than 40 million people ask ChatGPT healthcare questions every day, that over 5% of all ChatGPT messages worldwide are about health, and — the detail that gives the whole phenomenon away — that roughly seven in ten health conversations happen outside normal clinical hours. A KFF tracking poll fielded from February 24 to March 2, 2026 (1,343 US adults, ±3 points) found that about a third of adults had used AI chatbots for health information in the past year: 29% about physical health, 16% about mental health, with under-30s roughly three times more likely than the over-50s to ask about the latter.

Here is what makes this topic different from every other privacy article you have read. People are not unaware. In that same KFF poll, 77% said they were concerned about the privacy of personal medical information given to AI tools — and among the people who had actually uploaded medical records, 65% were still concerned. That is not ignorance. That is a knowing trade, made at one in the morning, by someone who wants an answer more than they want an argument with themselves.

Which means the useful thing to write is not "be careful." It is the specific mechanics: what a symptom question actually contains, which laws turn out not to apply to it, where it can resurface months later, and how to ask the question in a way that still gets you the answer without handing over a medical record.

What a Symptom Question Actually Contains

A health question is one of the densest pieces of personal data an ordinary person ever writes down voluntarily. Look at what a realistic one carries, beyond the symptom itself:

A condition, or a suspicion of one — which is the sensitive part in every privacy framework on earth.
A timeline. "Three weeks after I started the new medication" dates the event and identifies the medication.
Your age, sex, weight and habits, because you supplied them to get a better answer.
Other people's health data. "My mother had the same thing at 50" is a disclosure about your mother, who was not asked.
Attachments. A photo of a rash carries its capture time and often GPS coordinates in the file's metadata; a lab PDF carries your full name, date of birth and medical record number in a header nobody reads. See what providers see in your uploaded files.
Everything around the message. The account, the IP address, the device, the timestamp — the envelope, which stays legible even when the letter is deleted (the prompt metadata problem).

And unlike a search query, it is written in continuous, candid prose. Search taught people to type keywords. Chat taught them to confess.

HIPAA Was Never About You

The single most common misconception in this area is that health information is protected because it is health information. It is not. In the United States, HIPAA protects protected health information held by covered entities — health plans, healthcare clearinghouses, and healthcare providers who conduct certain electronic transactions — plus the business associates those entities hire under a signed contract.

HIPAA follows the entity, not the data. Read that sentence twice, because everything else here follows from it:

You are not a covered entity. Nothing you say about your own health is regulated by HIPAA when you say it.
A general-purpose AI company is not a covered entity either, and it is not your provider's business associate unless your provider hired it under a Business Associate Agreement.
So a conversation between you and a chatbot about your symptoms sits entirely outside HIPAA. Not weakly protected. Not covered. Outside.

Vendors do sign BAAs — but per product, per plan and per feature, and never for the consumer tiers most people use. OpenAI maintains an explicit HIPAA-eligible list covering things like ChatGPT for Healthcare and Enterprise with a Regulated Workspace; Anthropic's coverage matrix reaches Claude Enterprise and the first-party API on a HIPAA-ready organisation while Free, Pro, Max and Team sit outside entirely; Google's Gemini is coverable through Vertex AI under the Google Cloud BAA, while the consumer Gemini app is covered by neither that nor the separate Workspace agreement. We go through what those documents actually promise in SOC 2, BAAs and DPAs explained and, for clinicians specifically, in is ChatGPT HIPAA compliant?

One nuance in your favour, and it is worth knowing: the picture flips when a clinician types your information into a chatbot. Then a covered entity is disclosing your PHI to a vendor, and under HIPAA the disclosure itself is the violation — no breach, no leak and no harm required. Your own late-night question carries no such rule, in either direction.

The Line Your Own Records Cross

Until recently this was a distinction with limited practical bite: you typed a description of your symptoms, not your chart. That changed in 2026.

OpenAI announced ChatGPT Health on January 7, 2026 and rolled it out across the US on July 23, 2026 to the Free, Go, Plus and Pro plans — a dedicated space where you can connect patient portals, Apple Health and wellness apps, and then ask questions grounded in your own lab results, medications, visit notes and sleep data.

The privacy commitments attached to it are real, and it would be dishonest to skip them. OpenAI says connected medical records and the conversations that use them are not used to train foundation models or to target ads, regardless of your model-training setting; that connected information receives additional encryption; that memories are not created directly from it; and that synced data is deleted from OpenAI's systems within 30 days when you disconnect a source.

Now the part that makes this section necessary. US rules that give patients electronic access to their own records — the mechanism that makes portal linking possible at all — hand you a copy of your chart. The moment that copy lands in a consumer product, HIPAA stops travelling with it. Your hospital remains bound. The record in your ChatGPT account does not, and there is no federal health privacy law standing behind it: what governs it is a company's terms and its own policies. OpenAI's own health leadership has said as much plainly — HIPAA applies to clinical and professional settings, not to consumer products — and the company does not offer a Business Associate Agreement on the standard ChatGPT plans.

Two further details deserve attention because they are easy to misread:

Disconnecting deletes the synced data, not the conversation. The record leaves within 30 days; the chat in which you discussed the record stays until you delete it yourself.
The protections are scoped to the connected-data feature. Ordinary health conversations that do not use connected data follow your standard training setting — which, on consumer tiers, is on unless you turned it off (the ten toggles worth flipping).

None of that makes the feature a bad idea. It makes it a decision worth taking deliberately, at a time other than one in the morning.

What the Law Does Reach — and What It Doesn't

Outside HIPAA is not outside all duty. It is simply a patchwork instead of a floor.

Washington's My Health My Data Act, in force since March 2024, is the sharpest instrument in the US. It regulates "consumer health data" far beyond HIPAA's reach, applies to companies rather than only to clinical entities, and — uniquely — a violation is a per se violation of the state Consumer Protection Act, which means consumers can sue directly rather than waiting for a regulator.

The FTC's Health Breach Notification Rule was amended on April 26, 2024, effective July 29, 2024, specifically to make its application to health apps explicit: a "vendor of personal health records" is an entity not covered by HIPAA that offers or maintains a personal health record. Whether a general-purpose assistant qualifies has not been tested, and we should not pretend otherwise. But the FTC's enforcement record shows exactly which risk the agency treats as the live one — and it is not hackers:

GoodRx — a $1.5 million civil penalty in 2023 over disclosure of identifiable health information to Facebook, Google and other advertising platforms.
BetterHelp — $7.8 million in consumer refunds in 2023 over sharing that let third parties retarget people based on their interest in mental health services.
Easy Healthcare (Premom) — a $100,000 penalty in 2023 over sharing cycle, fertility and pregnancy data plus precise location with advertisers.

Three cases, one shape: health data that flowed to advertising, not to attackers.

In the EU and UK, health data is a special category under Article 9 of the GDPR. Processing it is prohibited in principle unless a specific Article 9(2) exception applies — for a consumer app, that is normally your explicit consent, which is what the box you ticked was for. Article 9 does not stop the processing; it conditions it, and adds obligations on the company. It is a real protection and a narrower one than the phrase "special category" suggests. If you want to test it in practice, the interesting exercise is the erasure request: what the right to be forgotten does and does not reach inside an AI system.

Four Ways a Health Question Comes Back

The reason to care is not that someone is reading your chat right now — almost certainly nobody is, beyond the sampling every provider does for safety review. It is that a health disclosure has an unusually long tail, along four separate paths.

1. It stops being one conversation

Memory is the mechanism people underestimate most. A symptom mentioned once, in one chat, can be summarised into a persistent profile and referenced back to you in unrelated conversations weeks later — which is charming when it remembers your coffee order and startling when it remembers your diagnosis while helping you write a cover letter. Training scatters your words into a statistical average; memory does the opposite and concentrates them into a compact, readable record of you. Our full argument is in AI memory is a privacy time bomb.

2. It becomes a commercial signal

Advertising arrived inside AI assistants in 2026, which changes the economics of every sensitive conversation. The current guardrails are meaningful: OpenAI's ad policies state that ads are not eligible to appear near sensitive or regulated topics including personal health and mental health, and that advertisers never receive your chats, history, memories, name, email, precise location, IP address or sensitive information such as health topics.

Take that at face value — and then notice that it is a policy, written by the party it constrains, revisable at that party's discretion. The three FTC cases above were all companies that had also promised not to do the thing they were doing. The point is not to predict bad faith; it is that a promise and a structural impossibility are different classes of protection, and health data has a documented history of migrating toward advertising.

3. It can be produced under legal process

In July 2025, Sam Altman said publicly what most users assume is not true: people talk to ChatGPT about intensely personal problems the way they would talk to a therapist, a lawyer or a doctor — and unlike those conversations, there is no privilege and no doctor–patient confidentiality, so OpenAI could be required to produce the records. Nothing since has changed that.

And it is not hypothetical. In the New York Times litigation, a preservation order issued in May 2025 required OpenAI to retain output log data that would otherwise have been deleted, reaching consumer tiers and standard API traffic; in January 2026 the court affirmed production of a 20-million-conversation de-identified sample of consumer chats from December 2022 to November 2024. Whether a given conversation was included turned on whether it was retained and fell inside that dataset and date range — not on the subject matter, and not on anything about the user. Nobody was notified, and nobody got to object. The full chronology is in can your AI chats be subpoenaed?

4. It outlives the company

Health records are durable, and so are the corporate accidents around them. 23andMe suffered a credential-stuffing breach affecting roughly seven million customers in 2023, filed for Chapter 11 in March 2025, and was sold in a bankruptcy auction that closed on July 14, 2025 — with several state attorneys general arguing that genetic data was being transferred without customers' renewed, opt-in consent. The buyer committed to additional safeguards, and the episode still makes the point: your data can change owners in a proceeding you are not a party to, under terms you never agreed to. A breach is the same story compressed (what happens when an AI provider is breached). A diagnosis does not expire; a company's control over it does.

Why "De-identified" Is Weaker Here Than Anywhere Else

Every reassurance in this field leans on de-identification, and health data is precisely where that leaning is weakest. A rare condition, an approximate age and a city can be close to unique on their own. Add a treatment date, an employer or an unusual combination of symptoms and the set of people it could be often collapses to one.

European regulators have moved in exactly this direction. Under the EDPB's anonymisation guidelines, adopted at the July 2026 plenary and open for public consultation until October 30, 2026 — and following the Court of Justice's binding ruling in EDPS v SRB in September 2025 — anonymity is treated as relative: the same data can be anonymous for one party and personal for another, and the test is whether anyone with realistic means could single out a record, link it to another dataset, or infer something about an identifiable person. Stripping a name off a paragraph in which someone describes their own medical history rarely survives that test.

Which is why the honest framing is not "de-identified, therefore safe" but "de-identified, therefore harder — depending on who is holding it and what else they have."

How to Ask Without Handing Over a Medical Record

You should still ask. Used well, these tools are genuinely good at translating jargon, generating the questions you should be putting to your doctor, and telling you which symptoms mean go now. The goal is to get that value while lowering the amount of you attached to it.

Describe, don't identify. "A woman in her forties" answers as well as your name and date of birth, because the model is reasoning from the clinical picture, not from who you are.
Type the numbers, don't upload the document. A lab PDF or a portal screenshot carries your name, date of birth and record number in the parts you are not looking at. Transcribe the three values that matter instead.
Strip photos before sending. A skin or wound photo usually carries capture time and often GPS. Re-save it, or use a tool that removes the metadata.
Leave other people out, or anonymise them harder than yourself. Your family's medical history is theirs to disclose.
Use temporary or incognito mode by default for this category — and enter it before you start typing, not three messages in, which is when it usually occurs to people (the fine print of temporary chat).
Never on the work laptop. Managed devices, enterprise browsers and endpoint tooling can log the prompt itself as searchable text, and your employer is the one party whose knowledge of your health has direct consequences (what your IT department can see).
Decide about record-linking separately. Connecting a patient portal is a different act from asking a question, with a different set of consequences. Treat it as its own decision.

A framing that works well, and keeps the conversation on the clinical picture rather than on you:

I want to understand a set of symptoms without giving you any identifying details. Please explain the plausible causes, what would make this urgent enough to seek care today, and what questions I should ask a clinician. Do not ask me for my name, location, or anything else that identifies me. Here is the situation, described in general terms:

And one non-privacy caution that belongs here anyway, because the same KFF poll measured it: of the people who asked an AI about mental health, 58% did not go on to consult a healthcare provider — 42% for physical health questions. A confident paragraph is not a diagnosis. Use these answers to arrive at the appointment better prepared, not to replace it.

Where Secret Chat AI Fits — and Where It Doesn't

Look back at that list and notice what every item has in common: each one is you being more careful inside a product that knows exactly who you are. The account, the email, the payment method and the device stay attached to every message you send. There is no setting anywhere labelled stop associating this with me.

That missing setting is what Secret Chat AI is built to be. It is an anonymizer and depersonalizer, and the design is deliberately narrow: no profile, no association, no training.

No profile of you. Registration takes an email, used only for account access and payment — never to store or associate your prompts with you. No behavioural profile is assembled across your chats, which is the mechanism by which one health question normally becomes a permanent attribute of a person.
No chat associated with you. Requests reach the leading models through their business APIs under our gateway's credentials, from our servers. Whatever a provider holds under its own terms, the record on that side carries our credentials and server address — not your name, your account or your IP. You use the model as a stranger.
Nothing kept under your name. Chat history lives in your own browser, and a prompt exists on our side only for as long as it takes to fetch your answer — there is no stored chat archive on our servers. Each message gets a Session Privacy Report.
No training. Your queries are never used to train models.

Now the boundary, which for a health article matters more than the claim. Secret Chat AI is an anonymizer, not a content filter. "Anonymously" describes the link, not the words: no account identifier travels with your prompt, but the text is not altered, redacted or hidden — the provider reads exactly what you wrote in order to answer it. Write your own name, your date of birth or your medical record number into a message and it is all still sitting there in the message. Removing identifying details before you send is yours to do. What we remove is who is asking; what is being asked is still up to you.

It is also not a legal shield. Anonymity is not privilege, it does not create doctor–patient confidentiality, and it is not a way to hide anything a court is entitled to.

Frequently Asked Questions

Is my conversation with an AI about my symptoms covered by HIPAA?
No. HIPAA regulates covered entities — health plans, clearinghouses and providers conducting certain electronic transactions — and the business associates they hire under contract. You are not one, and a general-purpose AI company is not one either, so a conversation between you and a chatbot about your own health sits entirely outside the law rather than being weakly protected by it.
If I connect my patient portal to an AI app, do my records keep their protection?
No. HIPAA follows the entity, not the data. Your hospital stays bound by it; the copy of your chart sitting in a consumer AI account is governed by that company's terms and policies instead. OpenAI's ChatGPT Health, which rolled out across the US on July 23, 2026, states that connected records are not used to train models or target ads and that synced data is deleted within 30 days of disconnecting — but those are product commitments, not HIPAA, and OpenAI does not offer a Business Associate Agreement on the standard consumer plans.
Does deleting the chat remove the health information?
It removes it from your visible history, which is not the same thing. Anything already absorbed into training is not retrievable, memory entries are deleted separately from conversations, retention windows run on the provider's clock, and a legal preservation order overrides the delete button entirely — as happened when a May 2025 order in the New York Times litigation required OpenAI to retain logs that would otherwise have been deleted.
Can advertisers see that I asked about a health condition?
Under current policy, no: OpenAI states that ads are not eligible near sensitive topics including personal health and mental health, and that advertisers do not receive your chats or sensitive information. Treat that as a policy rather than a structural guarantee — it is written by the party it binds and can be revised, and the FTC's actions against GoodRx, BetterHelp and Premom all involved health data reaching advertising platforms after similar assurances.
Is "de-identified" enough for health data?
Less than for most other data. A rare condition plus an approximate age plus a location can be close to unique. Under the EDPB's 2026 draft anonymisation guidelines, and the Court of Justice's EDPS v SRB ruling behind them, anonymity is relative and the test is whether anyone with realistic means could single out, link or infer — a standard that a paragraph of someone's own medical history often fails.
What is the safest way to get a useful answer?
Describe the clinical picture rather than the person: age range and relevant history instead of name and date of birth, transcribed values instead of an uploaded lab PDF, photos with metadata stripped, other people left out. Start in temporary mode, never use a work device, and treat the answer as preparation for an appointment rather than a substitute for one. Using a service that reaches the models without your identity attached — Secret Chat AI — removes the association; keeping identifiers out of the text is still your part.

Conclusion

The privacy risk in asking an AI about your health is not that a stranger is reading over your shoulder. It is quieter and slower: a sensitive fact about you, written in unusually candid language, attached to an identity, held by a company under rules that turn out to be its own rather than the law's — and durable enough to still be there when your circumstances have changed.

Most of that is manageable. Describe instead of identify, transcribe instead of upload, decide about record-linking deliberately, and keep it off the work machine. But the last layer is not a habit you can adopt, because it is not a setting the apps offer: the conversation is attached to you by default, and nothing in the settings menu detaches it.

That is the part worth fixing structurally. Ask the question — the answers really are useful at one in the morning. Just ask it as a stranger.

Asking AI About Health Symptoms
Why Privacy Matters More Than You Think