Health Data Privacy

State of play.

• The FTC has filed its most direct health-data enforcement action against a major DTC telehealth brand. The FTC, joined by California and Utah, sued Hims & Hers in U.S. District Court for the Northern District of California, alleging the company shared sensitive health information with Meta and Snap via embedded tracking technologies while marketing itself as private, and charged customers for prescriptions before any provider consultation occurred (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices, FTC, California, and Utah Sue Hims & Hers Over Health Data and Billing Practices, FTC, Utah, and California Sue Hims & Hers Over Health Data Sharing).
• A 15-state coalition has challenged HHS's grant of unrestricted Medicaid data access to DHS and ICE, seeking an immediate injunction in N.D. Cal. and framing the action as a structural limit on federal agency-to-agency health data transfers for immigration enforcement (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS).
• The 23andMe genetic data breach has reached final resolution through a dual-track structure: a $46.75 million bankruptcy court-approved individual settlement and a separate 42-state AG recovery, establishing a concrete template for mass genetic data breach enforcement through bankruptcy proceedings .
• Law firms are now a named enforcement target for health data exposure. Blank Rome faces two federal class actions over a May 2026 social-engineering breach that exposed medical records and government identification for 57,554 clients, with the one-month notification delay as a focal point for statutory notice claims (→ Blank Rome Sued Over May 2026 Data Breach Exposing 57K Clients' Data).
• For counsel advising telehealth companies, DTC health platforms, law firms, or healthcare AI developers, the practical baseline is that health data exposure now triggers simultaneous FTC enforcement, multistate AG coordination, and class-action litigation — and the Hims complaint is the clearest roadmap yet of what the FTC treats as a per se violation when health data flows to ad-tech platforms.

Where things stand.

• FTC enforcement against health-data-to-ad-tech transfers is now an active litigation posture, not a theoretical risk. The Hims complaint — following a nearly three-year investigation — alleges that embedded tracking technologies on the company's website transmitted sensitive health information to Meta and Snap, and that this occurred while the company made explicit privacy commitments to consumers (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices, FTC, California, and Utah Sue Hims & Hers Over Health Data and Billing Practices, FTC, Utah, and California Sue Hims & Hers Over Health Data Sharing).
• Federal agency-to-agency health data sharing for immigration enforcement is now judicially contested. The 15-state coalition's N.D. Cal. suit against HHS and DHS tests whether states can enjoin federal data transfers of Medicaid beneficiary information — a question with no settled precedent and broad implications for how social services data flows between federal agencies (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS).
• Genetic data breach enforcement through bankruptcy has a confirmed dual-track template. The 23andMe resolution — $46.75 million individual settlement plus separate state AG recoveries — demonstrates that state AGs can pursue independent enforcement against a bankrupt entity's successor while individual class claims proceed in parallel .
• Law firm social-engineering vulnerability is generating class-action exposure on health data grounds. The Blank Rome litigation alleges HIPAA, FTC Act, and California consumer protection violations arising from a single attorney's manipulation by an impersonator — with the notification delay, not the breach mechanics, as the primary damages theory (→ Blank Rome Sued Over May 2026 Data Breach Exposing 57K Clients' Data).
• Consumer AI use of PHI is outpacing institutional controls. Patients are uploading lab results and clinical notes to general-purpose chatbots outside any HIPAA-covered relationship; health systems are responding with competing institutional AI tools, but the liability question for patient harm from AI misinterpretation remains unsettled .
• Healthcare AI developers face compounding HIPAA, FDA, and patent obligations that must be coordinated at the product-design stage. HIPAA restricts PHI use for AI training and monitoring; FDA requires auditable, traceable training data for AI/ML submissions; patent law requires documented human inventorship — and these obligations create structural friction that cannot be resolved sequentially after product architecture is locked .
• Genetic data de-identification is a contested legal proposition, not a compliance safe harbor. Litigation in the genetic data space has advanced the theory that genetic information is inherently re-identifiable regardless of field stripping — a theory that, if accepted, eliminates de-identification as a shield under state genetic privacy statutes including Illinois GIPA .
• Standing doctrine for health data claims bifurcates on data sensitivity. The Tash ruling established that disclosure of sensitive health-related data constitutes concrete injury without proof of financial loss; non-sensitive identifier linkage alone does not — a pleading standard that shapes how pixel-tracking and ad-tech disclosure claims are framed .
• The state privacy patchwork now covers a substantial share of the U.S. population, with explicit consent requirements for health data and biometrics across more than 20 state regimes — and California's January 2027 automated decision-making opt-out deadline as the next major compliance checkpoint .

Latest developments.

• FTC, California, and Utah file federal complaint against Hims & Hers alleging health data sharing with Meta and Snap via tracking technologies and deceptive subscription billing practices; case pending in N.D. Cal. (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices, FTC, California, and Utah Sue Hims & Hers Over Health Data and Billing Practices, FTC, Utah, and California Sue Hims & Hers Over Health Data Sharing)
• 15-state coalition led by Washington AG sues HHS and DHS in N.D. Cal. seeking injunction against Medicaid beneficiary data transfers to ICE for immigration enforcement (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS)
• Bankruptcy court approves $46.75 million individual settlement for 23andMe 2023 genetic data breach; 42-state AG coalition announces separate multistate recovery
• Blank Rome faces two federal class actions in E.D. Pa. over May 2026 social-engineering breach exposing medical records and government identification for 57,554 clients; one-month notification delay is focal point for statutory notice claims (→ Blank Rome Sued Over May 2026 Data Breach Exposing 57K Clients' Data)
• Patients uploading lab results and clinical notes to consumer AI chatbots outside HIPAA-covered relationships; health systems deploying competing institutional AI tools; liability for patient harm from AI misinterpretation unsettled
• Analysis documents structural friction for healthcare AI developers across HIPAA training-data restrictions, FDA data provenance requirements, and human-inventorship patent obligations — requiring coordinated pre-product-launch strategy

Active questions and open splits.

• What tracking technologies trigger FTC health-data liability? The Hims complaint alleges that standard ad-tech pixels embedded on a health company's website constitute unlawful health data sharing — but the precise doctrinal boundary between permissible analytics and prohibited disclosure under the FTC Act and ROSCA is not yet defined by any court ruling.
• Can states enjoin federal agency-to-agency health data transfers? The 15-state HHS/DHS suit tests whether state AGs have standing and a viable cause of action to block federal data sharing between executive agencies — a structural question with no settled precedent that could reshape how Medicaid and social services data flows across the federal government (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS).
• Does the 23andMe dual-track settlement structure apply to future genetic data breaches? The parallel individual-class and state-AG recovery through bankruptcy proceedings may become the template for mass genetic data breach litigation — but whether courts will consistently allow state AG claims to proceed independently against successor entities in bankruptcy is unresolved .
• What notification timeline satisfies statutory requirements when a firm identifies but does not fully scope a breach? Blank Rome identified the breach within hours but did not notify for a month; the litigation will test whether partial containment justifies delayed notification or whether the clock runs from first discovery regardless of scope uncertainty (→ Blank Rome Sued Over May 2026 Data Breach Exposing 57K Clients' Data).
• Who bears liability when a patient uploads PHI to a consumer AI chatbot and receives harmful misinformation? The interaction sits outside HIPAA's covered-entity framework; state privacy statutes and FTC authority are beginning to address the gap, but no court has assigned liability to a chatbot provider, health system, or ordering physician for AI-generated misinterpretation of clinical data .
• How do FDA data provenance requirements interact with HIPAA authorization gaps in healthcare AI development? The FDA's AI/ML framework demands auditable training data, but PHI used for model training and post-market monitoring frequently lacks explicit patient authorization for AI purposes — a compliance gap that neither HIPAA nor FDA rules cleanly resolve .
• Sensitive vs. non-sensitive data as the standing threshold in AI-inference contexts. The Tash bifurcation was developed for direct disclosure claims; where AI systems derive sensitive health conclusions from ostensibly innocuous inputs, the boundary between sensitive and non-sensitive — and thus between cognizable and non-cognizable injury — is not yet defined.

What to watch.

• Early motions practice in the Hims & Hers case — specifically whether the court accepts the FTC's theory that embedded tracking pixels constitute unlawful health data disclosure, which would set a binding standard for the DTC telehealth sector (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices, FTC, Utah, and California Sue Hims & Hers Over Health Data Sharing).
• Preliminary injunction ruling in the 15-state HHS/DHS Medicaid data suit — a grant would immediately halt federal data transfers and signal judicial receptivity to state-AG structural challenges to federal agency data-sharing arrangements (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS).
• Whether the Blank Rome litigation produces a judicial ruling on the notification-delay question — any ruling on what triggers the statutory clock will directly affect law firm breach response protocols industry-wide (→ Blank Rome Sued Over May 2026 Data Breach Exposing 57K Clients' Data).
• Whether the FTC or state AGs issue guidance or enforcement actions targeting consumer AI platforms that receive PHI uploads outside HIPAA-covered relationships — the Hims enforcement posture suggests the FTC is prepared to move on health-data-to-platform flows generally .
• California's January 2027 automated decision-making opt-out deadline — the first major compliance checkpoint under the 2026 transparency regime, likely to generate enforcement guidance before year-end.
• FDA formal guidance on data provenance standards for AI/ML submissions — any published standard will harden the due diligence checklist for healthcare AI transactions and licensing deals .