When OpenAI introduced ChatGPT Health, the company described it as a way for people to get personalized health guidance by connecting medical records and wellness data to a conversational AI. The goal is to help users make sense of trends in their health information, prepare for doctor visits, and get clearer answers to everyday questions.
Many people already turn to ChatGPT for health information. According to OpenAI, millions of users ask health-related questions every day.
While ChatGPT Health may feel like a medical service, there is a privacy issue that many users may not fully understand. Many assume that the privacy protections in a doctor’s office automatically apply to this AI platform. They do not.
In the United States, medical information is protected under the Health Insurance Portability and Accountability Act, or HIPAA. HIPAA applies to covered entities, including doctors, hospitals, health systems, and insurance plans. It requires these organizations to keep sensitive health information private and secure.
Consumer technology platforms such as ChatGPT Health are not considered covered entities under HIPAA. This means that when users upload medical records or share detailed health information with the AI, those legal protections do not automatically follow. Once data leaves a regulated clinical system and enters a consumer product, it is governed by different rules.
The difference may be easy to miss. Many people assume that any health-related interaction involves the same privacy standards as a visit to a clinician. In reality, consumer health features on AI platforms operate under different rules, and the protections are defined by company policies rather than healthcare law.
Some experts are concerned that millions of users may not realize the risks of sharing private health information in this context. Frank Palermo, chief operating officer of NewRocket, a technology consultancy, has said that AI features such as ChatGPT Health may expose millions of users to privacy risks they do not realize they are taking. Palermo’s comments reflect a broader concern that as AI tools become more widely adopted, users often assume that familiar safeguards apply when they do not.
The regulatory gap exists because technology is advancing faster than healthcare law. HIPAA was written long before conversational AI became a common consumer tool. It focuses on traditional healthcare settings rather than general-purpose technology platforms that handle health-related information. Companies may use encryption, data isolation, and other privacy measures, but those practices are voluntary and not legally equivalent to HIPAA protections.
Other laws provide limited protection. For example, the Federal Trade Commission enforces rules against deceptive or unfair practices. Some breach notification laws require vendors of personal health records to inform users if data is exposed. These protections are different from HIPAA and do not cover all aspects of data storage, usage, or sharing.
The practical advice for users is to approach AI health tools with care. Before entering highly sensitive information, it is important to understand what protections apply. Privacy policies and user settings may offer guidance, but they are not a substitute for the legal protections provided in a healthcare setting.
OpenAI has said that ChatGPT Health will include data isolation controls and that health-specific conversations will not be used to train models. Even with these safeguards, the legal protections are not the same as those applied to medical providers, and users may not fully understand that difference.
ChatGPT Health may help many people better understand and manage health questions. Until regulatory frameworks are updated, however, a significant privacy gap remains. Users need to understand where medical privacy protections apply and where they do not before sharing personal health information with AI.
