Why HIPAA Compliance Matters
The press is warning consumers about AI health tools. Here's what the experts are saying, and why Hale is different.
What the Experts Are Saying
Leading publications and healthcare experts are raising serious concerns about AI health tools that aren't HIPAA compliant.
January 23, 2026
"230M Users Trust ChatGPT With Health Data Without HIPAA"
"OpenAI just revealed that over 230 million people every week are asking ChatGPT for health advice—sharing diagnoses, medications, and lab results with a chatbot that isn't bound by the same privacy laws as your doctor."
"Unlike healthcare providers bound by HIPAA, consumer AI tools rely on privacy policies that companies can change - legal experts say users have 'very limited protection' beyond OpenAI's word."
"Even if OpenAI voluntarily complies with HIPAA-like practices for its consumer product, that doesn't carry the force of law."
"OpenAI launched two similar-sounding products: ChatGPT Health (consumer) and ChatGPT for Healthcare (enterprise with HIPAA compliance), creating confusion about which has stronger safeguards."
"The regulatory gap means ChatGPT Health avoids FDA oversight by stating it's not intended for diagnosis, even as OpenAI promotes its medical capabilities and 230M users seek health guidance."
"We trust doctors with our private information because the medical profession has spent centuries earning that trust—through ethical codes, legal accountability, and institutional oversight. The tech industry's mantra has long been 'move fast and break things.' The question now is whether an industry built on that philosophy has earned the right to hold our most sensitive secrets, protected only by a promise that could vanish with the next privacy policy update."Read full article →
January 23, 2026
"Giving your healthcare info to a chatbot is, unsurprisingly, a terrible idea"
"There's very limited protection. Some of it is their word, but they could always go back and change their privacy practices."
— Carmel Shachar, Assistant Clinical Professor of Law, Harvard Law School
"You are not protected by law, and it is allowed to change terms of use over time."
— Hannah van Kolfschooten, Researcher in Digital Health Law, University of Basel
"Voluntarily complying isn't the same as being bound. The value of HIPAA is that if you mess up, there's enforcement."
— Carmel Shachar, Harvard Law School
Read full article →January 25, 2026
"ChatGPT Health: A Bridge Over The EMR Divide — Or Another Island In The Archipelago?"
"ChatGPT Health is explicitly not HIPAA-compliant — and it does not need to be, since it is a consumer tool."
— Sahar Hashmi, M.D., Ph.D.
Read full article →January 11, 2026
"What does Epic's Chief Medical Officer Think About ChatGPT Health?"
"I haven't seen that they've successfully done the same certification that an EHR-first company has to do to become a HIPAA-covered entity, and so I think that still remains to be seen. It is also free too. And so I'm always curious when I'm putting information of my own medical care into something that's free, what's happening to it and what the business model is there."
— Dr. Jackie Gerhart, Chief Medical Officer, Epic Systems
Read full article →January 16, 2026 | Parmy Olson
"AI Healthcare Push Has a Fatal Flaw"
"Doctor Bot will see you now. Let's hope it doesn't hallucinate."Read full article →
January 2026
"OpenAI Launches ChatGPT Health, a Dedicated Tab for Medical Inquiries"
"HIPAA only protects data held by certain people like health care providers and insurance companies. The recent announcement by OpenAI introducing ChatGPT Health means that a number of companies not bound by HIPAA's privacy protections will be collecting, sharing and using people's health data...inadequate data protections and policies can put sensitive health information in real danger."
— Andrew Crawford, Center for Democracy and Technology
Read full article →January 15, 2026
"Experts Warn Sharing Medical Information With ChatGPT Health Is Dangerous"
"Even if they say they're going to follow the strictest security and privacy standards, if there's not something that's enforcing that on them [like the federal government], then it's possible that they could change their tune in the future."
"You're still at risk when it comes to data breaches."
— Rob D'Ovidio, Cybersecurity Expert
Read full article →January 9, 2026 | Eric Hal Schwartz
"ChatGPT Health sounds promising — but I don't trust it with my medical data"
"OpenAI is not a healthcare provider. HIPAA and its strict legal obligations and safeguards for your medical information don't apply."Read full article →
January 2026
"ChatGPT Health draws concern from privacy critics"
"Individuals sharing their electronic medical records with ChatGPT Health would remove the HIPAA protection from those records, which is dangerous."
— Sara Geoghegan, Senior Counsel, Electronic Privacy Information Center
Read full article →January 2026
"Is Giving ChatGPT Health Your Medical Records a Good Idea?"
"The most conservative approach is to assume that any information you upload into these tools will no longer be private."
— Dr. Danielle Bitterman, Radiation Oncologist & Clinical Lead for Data Science and AI, Mass General Brigham Digital
Read full article →January 16, 2026
"Expert take on AI's role in modern medicine"
"Health data shared with ChatGPT is not protected by HIPAA. Unlike conversations with physicians or therapists, there is no legal privilege."
"The biggest misunderstanding is that AI-generated information is equivalent to a second opinion from a clinician."
— Dr. David Liebovitz, AI Healthcare Expert, Northwestern University
Read full article →January 2026
"Doctors think AI has a place in healthcare — but maybe not as a chatbot"
"All of a sudden there's medical data transferring from HIPAA-compliant organizations to non-HIPAA-compliant vendors."
— Itai Schwartz, Co-founder, MIND
Read full article →January 2026
"ChatGPT Health Raises Security, Safety Concerns"
"We would like to underline that in health-related contexts, sometimes consent may not always be sufficient to protect data in complex webs of data sharing."
— Franco Giandana Gigena, Policy Analyst, Access Now
Read full article →Built by Someone Who Needs It
I take 21 medications after two open heart surgeries. My wife has Multiple Sclerosis. My son is autistic. Between the three of us, we see a dozen doctors and have constant health questions.
I built Hale because we needed it, and because I knew our health data deserved real legal protection, not just marketing promises about "enhanced privacy."
— Jason Camp, Founder
No credit card required