Private AI for health questions: what HIPAA covers, and what it doesn't

The Morse teamPublished October 19, 20269 min read

The most private AI for health questions is one where no company keeps a readable copy of what you asked, because as of October 2026, the law that protects your medical records generally doesn't reach a consumer chatbot. HIPAA covers doctors, health plans, and the contractors they hire, so a question about a rash, a dose, or a test result typed into ChatGPT, Claude, or Gemini is protected by that company's own policy and a patchwork of state law, not by HIPAA.

This isn't medical advice. It's about who can read your health questions once you've asked them. We read the US Department of Health and Human Services (HHS) pages on who HIPAA covers, its health app scenarios, the Federal Trade Commission's Health Breach Notification Rule guidance, Washington's My Health My Data Act page, and the health pages of OpenAI, Anthropic, and Google, all on October 19, 2026. The companies deserve some credit. OpenAI and Anthropic both promise not to train on health data you connect, and both publish notices written for state health privacy laws.

Does HIPAA apply to ChatGPT?

Generally, no. HHS says "the HIPAA Rules apply to covered entities and business associates," and that "if an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules" (HHS). Covered entities are health care providers, health plans, and health care clearinghouses. A business associate is a company a covered entity hires to handle health information for it.

HHS's own scenarios for health apps show where the line falls. When a consumer downloads an app and fills it with her own readings, the developer is not a business associate, because she uses it "without any involvement of her health care providers." The answer stays no even when a doctor recommends the app and the patient uses it to send a report before an appointment: "The consumer's use of an app to transmit data to a covered entity does not by itself make the app developer a BA" (HHS, February 2016). The answer changes only when the provider or plan contracts with the developer.

OpenAI says so about its own product. Its help page asks "Is Health HIPAA-eligible?" and answers that Health in ChatGPT "is not intended for clinical or covered-entity use and does not offer a Business Associate Agreement" (OpenAI). Anthropic edited its healthcare announcement in February 2026 "to clarify that HIPAA-ready products are specific to healthcare providers and payers," not the Pro and Max plans people use at home (Anthropic).

What protects your health chats if HIPAA doesn't?

Three things, each narrower than HIPAA.

• The FTC's Health Breach Notification Rule. It covers "certain organizations (both businesses and nonprofits) not covered by HIPAA," and the FTC says its July 2024 amendments "make clear that makers of health apps, connected devices, and similar products must comply with the Rule." It counts more than hacks: if a company discloses "consumers' unsecured, individually identifiable health information without their consent," that's a breach, with civil penalties of up to $53,088 per violation (FTC). It's a notice rule. It tells you after something goes wrong, and whether a given chatbot falls under it is a legal question the FTC's page doesn't settle.
• State consumer health laws. Washington's My Health My Data Act protects health data that "falls outside the ambit of" HIPAA. Since March 31, 2024 it has limited collecting and sharing that data without consent, lets you have it deleted, including from backups, and is enforced by the Attorney General and through private lawsuits (Washington Attorney General).
• The company's own promises. For most people, this is the rule that decides what happens to a health question. The next section covers what each company promises.

Both companies' health notices are written for these state laws. OpenAI's Health Privacy Notice says some of what you share "may constitute 'Consumer Health Data'" under Washington's law and Nevada's (OpenAI), and Anthropic's Consumer Health Data Privacy Policy, effective January 12, 2026, is written for "residents of Washington or residents in states with similar" laws (Anthropic). Anthropic's policy doesn't mention HIPAA at all.

Is it safe to ask ChatGPT medical questions?

From a privacy standpoint, it depends on where in ChatGPT you ask. Health in ChatGPT is available to logged-in Free, Go, Plus, and Pro users in the US, and it lets you connect Apple Health, records from US hospital systems, One Medical, or Function Health (OpenAI). OpenAI says connected records and Apple Health data, "and conversations that use it, are not used to train our foundation models or target ads, regardless of the model-training setting you choose." It also says data connected in Health "receives additional encryption protections."

The protection is tied to the connected data. OpenAI's next sentence reads: "Conversations that do not use data connected in Health follow your standard ChatGPT model-training setting choices." A question about your symptoms typed into an ordinary chat, with nothing connected, is an ordinary chat. Its training setting is on unless you turn it off, as we cover in does ChatGPT train on your data. And when memory is on, OpenAI says conversations that use Health "can create memories to personalize future chats."

Do Claude and Gemini treat health chats differently?

Both draw the same line between health data you connect and everything else.

Claude. In the US, "Claude Pro and Max plan subscribers can choose to give Claude secure access to their lab results and health records" through connectors such as HealthEx and Function, and Anthropic says, "We do not use users' health data to train models" (Anthropic). Ordinary Claude chats follow Anthropic's general rule: they're used to improve Claude if you allow it under "Model Improvement," or if a conversation is "flagged for safety review" (Anthropic). We cover Claude's retention periods in is Claude private.

Gemini and Google Health Coach. Google's Gemini privacy hub asks you not to "enter confidential information that you wouldn't want a reviewer to see," and says "reviewed chats are retained for up to three years" (Google). Google Health Coach, the coach in the Google Health app (formerly Fitbit), "uses Gemini models to build your plans, but it works differently than Gemini." If you opt into research, "your interactions with the Google Health Coach will be used to train the AI model," on de-identified data. If you send feedback, "trained reviewers may read, annotate, and process the specific conversation" (Google).

Who can see your health question? A side-by-side

Here is where a health question lands depending on who you tell, from each organization's own pages, read on October 19, 2026.

Only the first two rows are inside HIPAA. Everywhere else, the company's own policy is the rule.

How do you ask an AI a health question with less on record?

Ask the question without the identity. "What does a TSH of 6.2 usually mean?" gets the same answer as the same question with your name, date of birth, and clinic attached. Leave out record numbers, insurer details, and names of your doctors when the question works without them.

Connect records only when the answer needs them. Every service above protects connected data more than typed questions, but connecting still hands it a copy, and OpenAI says disconnecting leaves what's already in your conversations until you delete them. Don't rate a sensitive answer. OpenAI says a thumbs up or down means "the entire conversation associated with that feedback may be used to train OpenAI models" even after you opt out (OpenAI), Anthropic stores "the entire related conversation" with feedback for up to 5 years, and Google's reviewers may read a Health Coach chat you send feedback on. Keep personal health questions off a work account. For the rest of the threat model, from employers to courts, see our guide on how to use AI privately.

How Morse keeps your health questions private

Every row in the table outside HIPAA has the same weak point. Your question sits on the company's servers, tied to your account, and the only thing deciding what happens to it is a policy the company can change. Morse is built so your chats aren't sitting there.

• E2EE, for symptoms, diagnoses, medications, and anything no one should read. Your browser checks the secure enclave's cryptographic proof before anything leaves your device, then encrypts the message so only that enclave can read it. Morse's servers relay text they can't read, and the reply is decrypted only in your browser. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. Every E2EE reply has a lock you can open to see each check that passed.
• Private, for everyday health questions you'd rather no host keep. Private is the default for a new chat. It runs open-weight models like DeepSeek, Kimi, and GLM, plus xAI's Grok, and Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• Anonymous, to ask GPT, Claude, or Gemini without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees the message and may keep it for a limited time to check for abuse, under its own policy, so this is the mode where leaving out names and record numbers matters most.

Your chat history is stored in your browser, encrypted, not on Morse's servers. Unlocking it takes two keys, one that never leaves your device and one our server gives you when you sign in, so a copy of your browser data alone can't be read. Morse doesn't train AI on your chats, sell your data, or show ads. A lab report you attach is sent with the message and never stored by Morse. Because we don't store chats, we usually have very little to give authorities (privacy policy). Clearing your browser, losing the device, or deleting your account deletes your chats, and Morse can't recover them, so save a copy of anything you need, like the questions you want to bring to an appointment.

On paid plans, picking an unfiltered model gives straight medical answers that other apps refuse. A chatbot's answer is still no substitute for a clinician who can examine you.

• Asking about a test result or a prescription: start the chat in E2EE.
• A general question you'd ask a pharmacist: Private mode, the default.
• Wanting GPT, Claude, or Gemini specifically: Anonymous mode, with identifying details left out.
• Handing over your full medical record: consider whether the question needs it at all.

Try a chat from the Morse home page without an account, or start free. End-to-end encrypted chats come with Pro, at $19 a month.