Are health records apps covered by HIPAA?

Often not. HIPAA mainly covers doctors, hospitals, health plans and their business partners. An app you download yourself is usually governed by its own privacy policy, so read it.

What does it mean if only my phone holds the key?

It means records are encrypted with a key kept on your device, so the company storing the data cannot read it.

Can I connect my parent’s hospital to an app?

Many US hospitals allow it through their patient portal. You or your parent sign in on the hospital’s own page and approve the connection.

What should I check before deleting a health app?

Export anything you want to keep, then use the app’s own delete option and check the policy for what is removed and when.

What to look for in a health records app for your family

November 6, 2026 · 5 min read · Vita Health Coach

The short answer

Before you put a parent’s records into any app, check how it handles privacy, whether data is encrypted, whether each person gets a separate file, how it connects to hospitals, how sharing works and whether you can delete everything. Read the privacy policy for two things in particular: whether health data is ever sold, and whether it is used for ads.

Why the choice matters

A health records app may hold your parent’s diagnoses, results, medicines and notes from many years. That is some of the most personal information a family has. It deserves the same care you would give a bank account.

Many consumer health apps are not covered by HIPAA, the federal health privacy law. HIPAA mainly covers doctors, hospitals, health plans and the companies that work for them. An app you choose and download yourself usually falls outside it. So the app’s own privacy policy is what protects your data, and it is worth reading.

Take ten minutes before you sign up. Read the privacy policy summary, look at the settings, and check how to delete the account. It is much easier to choose well at the start than to move years of records later.

Privacy and security: questions to ask

Encryption scrambles data so only someone with the right key can read it. Ask whether data is encrypted while it travels over the internet and while it is stored. Ask who holds the key. If only your device holds it, the company cannot read your records even if it wanted to.

Check for basic protections too: a passcode or face lock on the app, a way to sign out of lost devices, and notifications that do not show health details on the lock screen, where anyone nearby could read them.

Then read the privacy policy. You do not need to read every word. Look for clear answers to the questions below, and if the policy is vague on any of them, treat that as a warning sign.

Is health data ever sold or shared for advertising?
Does the app show ads, and does it use your data to target them?
Who inside the company can see your data, if anyone?
Is data shared with other companies, and for what purpose?
Is data encrypted in transit and when stored, and who holds the key?
Where is the data stored, and for how long?

A separate file for each person

Families rarely look after just one person. You might follow a parent, a partner, a child and your own health. An app that mixes everyone into one list makes mistakes easy, such as reading your father’s result as your own.

Look for a separate file for each person, each with its own records, medicines and history. Check that it is clear at all times whose file you are looking at.

Ask how the app handles permission when you add another adult, such as a parent. Their records belong to them, so it should be clear that they agreed to share them with you.

Hospital connections and paper records

Typing results in by hand is slow and error-prone. Many US hospitals let patients connect apps through their patient portal using federal standards for health data. Ask how many hospitals the app can connect to and whether your parent’s hospitals are on the list.

Check how you sign in. A safe connection sends you to the hospital’s own sign-in page, so the app never sees your parent’s portal password. Also check whether you can add paper records, such as a photo of a report, because not every clinic has a portal.

If your parent uses several hospitals, check that the app can connect more than one and keep them all in that person’s file. Records spread across places are one of the main reasons families lose track.

Sharing, export and deleting

At some point you will want to show a record to a doctor. Look for sharing you control: a link or code you send on purpose, that you can switch off later, rather than open access.

Before sharing, check what the other person will see: one record, a set of records or the whole file. Share the smallest set that answers the doctor’s question.

Check that you can get your data out, for example as files you can save or print. Finally, check that you can delete a person’s file, or your whole account, and that the policy says what happens to the data when you do.

Sharing you start and can switch off
A way to export or print records
Delete a single person’s file
Delete the whole account, with a clear statement of what is removed

Explanations, and their limits

Some apps explain results in plain words. That can help a stressed family member make sense of a report at night. Look for explanations that tell you how soon to act and that say clearly they do not replace a doctor.

No app should diagnose your parent or tell you to change a medicine. Decisions belong with the doctor. If a result or a symptom seems urgent, call the doctor, and for any emergency call 911.

Also check what the app does with an urgent result. A good design tells you clearly when to call a doctor soon, rather than burying it in a long text.

How Vita Health Coach helps

Vita Health Coach is an iPhone and iPad app by VitaMedas, Inc. that keeps a separate file for each person you look after. You can connect a US hospital through its patient portal, signing in on the hospital’s own page, from a list of about 96,000 US hospitals and clinics, or take a photo of a paper report. Records are sealed on the phone with a key only that phone holds, sharing with a doctor is through a code-protected link you can switch off, and there are no ads; health data is never sold. It explains health information and never diagnoses or prescribes, and it is free to try with paid plans in the App Store.

Questions people ask

Are health records apps covered by HIPAA?: Often not. HIPAA mainly covers doctors, hospitals, health plans and their business partners. An app you download yourself is usually governed by its own privacy policy, so read it.
What does it mean if only my phone holds the key?: It means records are encrypted with a key kept on your device, so the company storing the data cannot read it.
Can I connect my parent’s hospital to an app?: Many US hospitals allow it through their patient portal. You or your parent sign in on the hospital’s own page and approve the connection.
What should I check before deleting a health app?: Export anything you want to keep, then use the app’s own delete option and check the policy for what is removed and when.

Sources

Vita Health Coach is an iPhone app that keeps a parent’s hospital results in their own file and explains each new one in plain words. Free to try; paid plans in the App Store.

Vita Health Coach on the App Store

General health information, not medical advice. Vita Health Coach explains; it never diagnoses. In an emergency, call 911 or your local emergency number. Read the medical disclaimer.