HIPAA Was Written in 1996. The Internet Was Barely a Thing. We Are Still Using It to Govern AI, Wearables, and Data Brokers.
I want you to think about something for a moment.
The law that governs how your patient’s health information is protected was written the same year the Macarena was the number one song in America. Bill Clinton was in his first term. Most physicians were still faxing referrals. The concept of a smartphone did not exist.
That law is HIPAA. And we are still using it, word for word, to govern artificial intelligence, continuous biometric wearables, consumer health apps, and an entire industry of data brokers who buy and sell inferred health profiles on millions of Americans without ever needing a business associate agreement.
I work in this space every day, and I’ve been thinking about this stuff lately.
What HIPAA Was Actually Built to Do
When Congress passed the Health Insurance Portability and Accountability Act in 1996, the mental model was clean and logical. A patient sees a physician. The physician documents the visit. That documentation moves between a defined set of covered entities, the hospital, the insurer, the billing clearinghouse, for treatment, payment, and operations. Draw a boundary around that ecosystem. Set the rules. Done.
For 1996, that was genuinely thoughtful legislation. Health information stayed largely within that ecosystem. The entities handling it were identifiable. The data flow was relatively linear.
That world is gone, but the rulebook stayed.
What Is Happening Right Now
Before a patient ever walks through your door, their health information has already been generated, collected, inferred, and in many cases sold, by entities that HIPAA has never touched and was never designed to touch.
They searched their symptoms on Google last Tuesday. They have been wearing a device on their wrist for two years that has logged every elevated heart rate, every disrupted sleep pattern, every drop in activity. They downloaded a period tracking app. They joined a Facebook group for people managing their condition. They ordered something from a direct-to-consumer health platform.
None of that is covered by HIPAA. The companies involved, search platforms, wearable manufacturers, wellness apps, consumer health brands, are not covered entities. They carry none of the obligations your practice carries. They are not audited by the Office for Civil Rights. If they suffer a breach, they do not have the same notification obligations you do.
And yet the data they hold on your patient is often more detailed, more continuous, and more behavioral than anything sitting in your EHR.
I find that genuinely alarming. Not in an abstract, policy-paper kind of way. In a practical, this-is-happening-right-now kind of way.
The De-identification Fiction
Here is something that I want to bring your attention to.
HIPAA allows de-identified health information to flow freely. Strip the eighteen required identifiers and the data is legally no longer PHI. You can use it, share it, sell it, analyze it. The logic made sense in 1996, when the ability to re-identify individuals from stripped datasets was limited.
It is no longer limited. Researchers have demonstrated repeatedly that individuals can be re-identified from datasets that fully meet HIPAA’s de-identification standards, by cross-referencing with data that commercial brokers sell openly. Purchase history. Location data. Social media patterns. App usage. The data points exist. The computation is not complicated. And nobody is doing anything about it because the law was written before this was possible.
Get Health Billing US’s stories in your inbox
Join Medium for free to get updates from this writer.
Data brokers, yeah those companies whose entire business model is building health profiles on individuals using inferred data, what medications someone likely takes based on what they buy, what conditions they likely have based on what they search, operate almost entirely outside the HIPAA framework. No BAA required. No breach notification required. No audit. No accountability.
That is a multi-billion dollar industry operating in a regulatory vacuum right next to the most sensitive data category that exists.
Then AI Walked In
I have watched this next part happen in real time, and it is moving faster than the compliance infrastructure can follow.
Healthcare organizations want AI. The pressure is coming from every direction, cost reduction, efficiency, competitive positioning, and the tools are genuinely useful. So people are using them. Clinicians paste patient notes into general-purpose AI tools to generate summaries. Practices deploy chatbots that were not built for healthcare. Departments adopt CRM platforms that were never designed to handle PHI because they are affordable and easy and the vendor said it was fine.
Most commercial AI tools were not built for HIPAA. They do not carry a HIPAA-eligible infrastructure. They were not designed with BAAs in mind. Using them with identifiable patient data is a potential violation, and most of the people using them that way have no idea.
The gap between what the compliance framework requires and what is actually happening in practices and health systems across the country is wider than it has ever been. And it is growing every quarter.
What I Think Needs to Happen
I am not naive about how legislation moves. I watched prior authorization reform die in Congress despite having genuine bipartisan support. I know how slowly this machinery turns.
But some things are clear enough that they are worth saying plainly.
The definition of protected health information needs to reflect how health data is actually generated today. Inferred health information, data from which health conditions can be reasonably derived, deserves protection regardless of whether it originates in a clinical setting. The entity-based model of HIPAA, which protects data based on who holds it rather than what the data actually is, has outlived its usefulness.
Consumer health technology needs to be brought into a regulatory framework that matches its actual role in the health data ecosystem. Wearables, period tracking apps, and wellness platforms are not novelties. They are primary health data generators for millions of people, and they are operating without meaningful federal oversight of how they handle that data.
The data broker industry needs direct regulation. The ability to purchase inferred health profiles on millions of Americans with no consent requirement and no breach notification obligation is already a big gap, which is still compounding every year.
And the AI question needs an answer that is more specific than “follow existing HIPAA guidance.” The standards for what constitutes a HIPAA-compliant AI deployment need to be defined clearly, updated regularly, and enforced with the same seriousness that OCR brings to risk analysis failures.
Why This Matters Beyond Compliance
I want to be honest about why I care about this beyond the regulatory and operational dimensions.
Health information is the most intimate data a person generates. It touches on diagnoses people have not told their families about. Medications that carry stigma. Mental health struggles. Reproductive choices. Genetic information that has implications for employment and insurance. Behavioral patterns that reveal things about a person’s life that they have shared with no one.
When that data flows without protection, when it is sold by a data broker, when it leaks through a misconfigured AI tool, when it is re-identified from a dataset that was supposed to be anonymous, the harm is real and often permanent.
HIPAA was written by people who took patient privacy seriously. That intent was genuine. The problem is that the world the law was designed for no longer exists, and thirty years later, patients are being asked to trust a framework that was never built for the world they actually live in.
That gap needs to close. And the industry needs to start saying so loudly enough that someone listens.
