1. United States
2. Calif.
3. Letter

Extend HIPAA protections to cover AI health apps like ChatGPT Health and Claude for Healthcare. OpenAI says hundreds of millions of people already use ChatGPT for health questions, yet these companies are almost certainly not covered entities under HIPAA. That means they face no legal obligation to protect the sensitive medical data users share with them, no mandatory breach notifications, and no limits on selling that data to third parties or data brokers. When these companies claim their products are "HIPAA compliant" or "HIPAA ready," legal experts say those phrases often mean nothing more than a voluntary promise. Carter Groome of First Health Advisory called it "a comical level of how much they say they're going to protect your information." Sara Geoghegan of the Electronic Privacy Information Center put it plainly: companies say they're HIPAA compliant, but what they mean is they have no obligation. The 23andMe bankruptcy showed exactly what happens to sensitive health data when an unregulated company fails. People turn to these apps because care is expensive and hard to access. That's understandable. But convenience cannot be an excuse to leave health data unprotected. Close this gap in federal law and bring AI health products under the same enforceable standards that govern every hospital and doctor's office.