Healthcare Law Blog

Beyond HIPAA: Legal Risks of Consumer Health Apps and Wearables for Kentucky Healthcare Providers

Patients are increasingly generating their own health data through wearables and apps, transforming how providers engage with them. However, much of this data falls outside HIPAA’s protections, creating legal gaps. With Kentucky’s Consumer Data Protection Act (KCDPA) taking effect in January 2026, these gaps will become even more complex for providers to navigate.

The HIPAA Gap: When “Health Data” Isn’t Protected Health Information

HIPAA only applies to covered entities and their business associates, regulating how they handle protected health information (PHI). But data from consumer health apps and wearables, unless tied to a covered entity, is not considered PHI and falls outside HIPAA’s protections.

That means a patient’s health data could be:

• Collected by a wearable device vendor;
• Stored on a cloud platform owned by a non-covered company; and
• Shared with advertisers, analytics firms, or other partners, all without HIPAA’s restrictions.

If a patient shares that data with a healthcare provider and it enters the patient’s electronic health record (EHR) or is used to inform diagnosis or treatment, it transforms into PHI and becomes subject to HIPAA. But by then, the information may already have traveled through non-compliant hands.

Beyond HIPAA: Other Legal Frameworks at Play

Even where HIPAA stops, other laws begin. Providers and their vendors must be aware of a patchwork of state privacy and consumer-protection statutes that regulate health-related data collected outside the healthcare setting.

The Federal Trade Commission (FTC), for example, has used its authority under Section 5 of the FTC Act to pursue app developers for deceptive or unfair data practices involving health information. The FTC has also begun enforcing the Health Breach Notification Rule, which applies to non-HIPAA entities that handle personal health records.

Additionally, many states, including Kentucky, are enacting their own privacy laws that regulate “personal data” or “sensitive data,” terms that often encompass health and biometric information.

Kentucky’s Upcoming Data-Privacy Law

From a healthcare perspective, the KCDPA is particularly significant because it extends privacy obligations beyond HIPAA-covered entities. Under the Act, businesses that process personal data of Kentucky residents—meeting certain revenue or volume thresholds—must:

• Provide clear privacy notices describing categories of data collected and purposes of processing;
• Offer consumers rights to access, correct, delete, and obtain copies of their personal data;
• Implement reasonable data-security measures; and
• Obtain consent before processing “sensitive data,” which may include health-related information.

While HIPAA-regulated PHI is exempt, hybrid scenarios can arise where consumer-app data isn’t PHI but still constitutes “personal data” under the KCDPA. Providers integrating such technologies must evaluate whether their vendors qualify as “controllers” or “processors” under the Act—and ensure contracts address these roles.

Proactive alignment with the KCDPA now will position providers to avoid last-minute compliance crises when the law takes effect in 2026. To navigate overlapping privacy laws, Kentucky providers should:

• Map data flows to identify where HIPAA or KCDPA applies.
• Review vendor contracts for compliance with both federal and state requirements.
• Update policies and notices to reflect integration of wearable/app data.
• Educate staff and patients on how this data is used and protected.
• Conduct risk assessments that include new technologies.
• Prepare for KCDPA by aligning practices and contracts ahead of 2026.

Compliance Risks

Failing to stay ahead of evolving privacy laws like the KCDPA exposes Kentucky healthcare providers to significant legal and financial risks. These include regulatory investigations by state and federal agencies, fines for noncompliance, breach notification obligations, and potential lawsuits from patients whose data is mishandled. Even if HIPAA doesn’t apply, providers may still be liable under state consumer protection laws or FTC enforcement actions. Furthermore, reputational damage from a data incident involving consumer health apps can erode patient trust and impact clinical relationships. Overlooking these risks is not just a compliance issue, it’s a business and legal liability.

Conclusion

The boundaries of healthcare data privacy are rapidly expanding. HIPAA remains a foundational safeguard, but it was never designed for a world where consumers generate and share vast quantities of health data through commercial technologies. As healthcare continues to merge with consumer technology, compliance vigilance is no longer optional, but is a strategic requirement. Contact a McBrayer Healthcare attorney today to ensure your organization stays ahead of evolving regulations and protects patient trust in this new era of data-driven care.

Valerie Michael is an Associate in McBrayer's Lexington office. Ms. Michael focuses her area of practice on healthcare law, handling a wide variety of matters, such as healthcare professional licensure defense and compliance and regulatory issues. She also handles civil and criminal Medicare and Medicaid fraud cases, facility licensing, and certification. Ms. Michael can be reached at vmichael@mcbrayerfirm.com. 

Services may be performed by others. This article does not constitute legal advice.