Health app compliance wizard: which rules apply to your app?

How the routing works

• HIPAA turns on relationships, not on the data: whether your company is a covered entity, and whether you build or run the app on behalf of one. The questions are the ones the FTC's Mobile Health Apps Interactive Tool asks.
• The FTC's breach rule is checked against the HIPAA answers, because the rule excludes covered entities and business-associate activity.
• GDPR, Washington's Act and the store rules are switched on by where your users are and where the app ships.
• Every status is one of four: likely applies, may apply, likely does not apply, or answer needed. The reason beside it is ours; the rule under it is the source's.

Every rule the wizard can show

HIPAA, as a covered entity: “Covered entity means: ( 1 ) A health plan. ( 2 ) A health care clearinghouse. ( 3 ) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.” (eCFR) “5. Do consumers need a prescription to access your app? Yes HIPAA: You may be a HIPAA covered health care provider and therefore subject to the HIPAA Rules .” (FTC)

HIPAA, as a business associate: “Are you developing, offering, or operating an app on behalf of a HIPAA covered entity (such as a hospital, doctor’s office, health insurer, or health plan’s wellness program)? Or are you acting as a subcontractor to another entity providing services to a covered entity?” (FTC) “You likely are a HIPAA business associate , and therefore subject to the HIPAA Security Rule and specific provisions of the HIPAA Privacy and Breach Notification Rules” (FTC) “developer that contracts with a covered entity to provide the health care app to the covered entity's patients” (HHS)

HIPAA (neither a covered entity nor a business associate): “If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules.” (HHS) “You likely are not covered by HIPAA. (Other laws, like the FTC Act, may also apply, but we’ll get to that.)” (FTC)

FTC Health Breach Notification Rule: “The FTC’s Health Breach Notification Rule applies to most health apps that aren’t covered by HIPAA because most developers of health apps are acting as “health care providers”” (FTC) “For example, if you develop a health app that collects information from consumers and can sync with a consumer’s fitness tracker, you’re probably a vendor of personal health records.” (FTC) “This part does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity.” (eCFR) “If your company is a HIPAA business associate that also offers personal health record services to the public, you may be subject to both the HHS and FTC Breach Notification Rules.” (FTC)

FTC Health Breach Notification Rule: sharing without consent: “A breach of security includes an unauthorized acquisition of unsecured PHR identifiable health information in a personal health record that occurs as a result of a data breach or an unauthorized disclosure.” (eCFR) “if you disclose consumers’ unsecured, individually identifiable health information without their consent, a breach has occurred.” (FTC)

FTC Act: what you claim about privacy: “don’t make false or misleading claims that you are “HIPAA Compliant,” “HIPAA Secure,” “HIPAA Certified” or the like.” (FTC)

GDPR, Article 9 (data concerning health): “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status” (legislation.gov.uk) “biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited” (legislation.gov.uk) “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes” (legislation.gov.uk)

GDPR for a gym or studio: controller and processor: “alone or jointly with others, determines the purposes and means of the processing of personal data” (legislation.gov.uk) “which processes personal data on behalf of the controller” (legislation.gov.uk)

Washington My Health My Data Act: “"Regulated entity" means any legal entity that: (a) Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington; and (b) alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data.” (Washington State Legislature) “"Consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.” (Washington State Legislature) “For example, while information about the purchase of toilet paper or deodorant is not consumer health data, an app that tracks someone’s digestion or perspiration is collecting consumer health data.” (Washington State Attorney General)

FDA: general wellness or medical device: “Section 520(o)(1)(B) of the FD&C Act, states that software that is intended "for maintaining or encouraging a healthy lifestyle and is unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition" is not a device under section 201(h) of the FD&C Act.” (FDA)

Apple App Review Guidelines: “Apps may not use or disclose to third parties data gathered in the health, fitness, and medical research context—including from the Clinical Health Records API, HealthKit API, Motion and Fitness, MovementDisorder APIs, or health-related human subject research—for advertising, marketing, or other use-based data mining purposes other than improving health management, or for the purpose of health research, and then only with permission.” (Apple)

Google Play Health apps and Health Connect policies: “All developers must complete the Health apps declaration form on the App content page” (Google Play) “Data accessed through Health Connect Permissions is regarded as personal and sensitive user data subject to the User Data policy” (Google Play)

Where the quotes come from

The HHS, FTC, eCFR, GDPR, Washington and FDA passages are the ones this site's compliance pages are written from, re-checked against the live sources every week; EUR-Lex could not be reached, so the GDPR text is the Regulation as adopted, on legislation.gov.uk. The store passages were read on November 5, 2026.

• eCFR, 45 CFR 160.103, Definitions
• FTC, Mobile Health Apps Interactive Tool
• HHS, Business Associates (archived copy)
• HHS, Covered Entities and Business Associates (archived copy)
• FTC, Complying with FTC's Health Breach Notification Rule
• eCFR, 16 CFR Part 318, Health Breach Notification Rule
• FTC, Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule
• legislation.gov.uk, Regulation (EU) 2016/679, Article 4 (as adopted)
• legislation.gov.uk, Regulation (EU) 2016/679, Article 9 (as adopted)
• Washington State Legislature, RCW 19.373, Washington My Health My Data Act
• Washington State Attorney General, Protecting Washingtonians' Personal Health Data and Privacy
• FDA, General Wellness: Policy for Low Risk Devices
• Apple, App Review Guidelines
• Google Play, Health Content and Services
• Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)

What the wizard does not cover

Other US state health-privacy laws: this site has sourced Washington's Act and not the others, so the wizard names only Washington. Countries outside the EU and the US. Contracts such as a Business Associate Agreement or a data processing agreement, which a result may point to but cannot draft.

For the questions behind the answers, start with whether your fitness app needs to be HIPAA compliant and whether fitness data is PHI. To turn a result into a plan with products and store items, use the build plan generator.

Next step

Turning this into a choice of API:

• Does My Fitness App Need to Be HIPAA Compliant? →
• The FTC Health Breach Notification Rule for Health and Fitness Apps →
• GDPR for Fitness Apps: What Developers Need to Know →