ChatGPT Health encourages users to upload health data such as medical records and test results, and connect smart devices and fitness apps to the platform so users can have all of their health data in one place. Users also purportedly get personalized health recommendations and advice (not diagnoses or treatments, an OpenAI press release stresses) from the AI service.<\/p>\n
Naturally, cybersecurity experts have concerns about the mass upload of health records and personal wellness data. Here\u2019s what to know:<\/p>\n
ChatGPT Health and other AI health providers won\u2019t have to follow the HIPAA privacy regulations that medical providers do.<\/p>\n
\u201cThe thing that struck me the most, and the thing that concerns me the most, is the fact that OpenAI and ChatGPT<\/a>, they\u2019re not a bona fide health care provider,\u201d said Robert D\u2019Ovidio<\/a>, an associate professor of criminology and justice studies at Drexel University in Philadelphia.<\/p>\n \u201cSo, what does that mean to you and I? That means that they\u2019re not covered under HIPAA,\u201d D\u2019Ovidio said, referring to the federal law<\/a> that protects your health data and requires health providers to follow strict privacy and security rules. \u201cThe same protections that we get when we go to our doctor\u2019s offices, when we go to an urgent care, when we go to the hospital, they\u2019re not there in terms of when we\u2019re dealing with ChatGPT,\u201d he added.<\/p>\n An OpenAI spokesperson told HuffPost that the company takes privacy seriously, especially when it concerns health information, and that ChatGPT Health users can delete their data at any time.<\/p>\n ChatGPT, like your doctor, may know that you\u2019re struggling with depression or have a heart disease diagnosis. However, unlike your doctor, the online tool would be under no federal obligation to secure that information, said Nathan Evans<\/a>, the faculty director of the cybersecurity program and co-chair of computer science at the University of Denver.<\/p>\n \u201cSo, that\u2019s sort of my number one biggest question mark there,\u201d Evans said.<\/p>\n \u201cAnd even if they say they\u2019re going to follow the strictest security and privacy standards, if there\u2019s not something that\u2019s enforcing that on them [like the federal government], then it\u2019s possible that they could change their tune in the future.\u201d<\/p>\n Collecting health information may make ChatGPT data a \u2018larger target\u2019 in terms of cybersecurity attacks.<\/p>\n One good thing? ChatGPT Health states it\u2019s using data isolation and data segmentation so your health-related data and medical uploads aren\u2019t mixed in with what you\u2019re searching and doing on the non-health side of ChatGPT, according to D\u2019Ovidio.<\/p>\n But even with promises of data segmentation and isolation, \u201cYou\u2019re still at risk when it comes to data breaches,\u201d D\u2019Ovidio added.<\/p>\n An OpenAI spokesperson said because of the sensitive nature of the data uploaded to ChatGPT Health, the tool uses \u201cpurpose-built encryption and isolation\u201d to protect and compartmentalize health conversations and information.<\/p>\n But, \u201cone has to question whether them offering this type of service puts a larger target on their back, knowing how useful such information is, especially when it comes to the sensitivity of such data,\u201d D\u2019Ovidio said. \u201cTo me, as a criminologist who studies this, this says, \u2018Well, yeah, they\u2019re painting a much larger target on their back by doing this.\u2019\u201d<\/p>\n ChatGPT Health is partnering with a company called b.well<\/a>, an \u201cAI-powered digital health platform,\u201d according to its website. <\/p>\n \u201cThat certainly adds another complexity to the equation,\u201d D\u2019Ovido said, because users\u2019 information is with ChatGPT and OpenAI, but people \u201calso have to be concerned about what\u2019s going on at b.well because b.well is now part of the equation.\u201d<\/p>\n This is another potential target in regard to data breaches and privacy issues, he said.<\/p>\n ChatGPT Health isn\u2019t the only AI company entering health care. Anthropic announced Claude for Healthcare<\/a> just days after the announcement of ChatGPT Health. This should be a \u201ccall to action\u201d for our elected officials in Washington, according to D\u2019Ovidio.<\/p>\n \u201cMaybe it\u2019s time to rethink HIPAA in the sense of where the boundaries are, who is defined as a health care provider,\u201d he added. \u201cWe don\u2019t want to be in a situation where we have every state adopting its own regulation because that just creates chaos.\u201d<\/p>\n Andriy Onufriyenko via Getty Images<\/p>\n ChatGPT Health encourages users to upload their medical records, which cybersecurity experts say is risky.<\/p>\n Sharing your health information with any company that isn\u2019t your doctor\u2019s office puts your sensitive health data at risk.<\/p>\n Early last year, the online genetic testing company 23andMe filed for bankruptcy<\/a>, which put in question the health and ancestral data it has from millions of users. <\/p>\n While this isn\u2019t a current concern for OpenAI, there is no way to actually predict the future and what potential company changes could mean for your sensitive health data, experts say.<\/p>\n \u201cWe don\u2019t anticipate that OpenAI is going to run out of money or go out of business, but they are not a profitable company. They\u2019re hemorrhaging money<\/a> to try to build bigger,\u201d said Evans.<\/p>\n With most of the data ChatGPT collects, the goal is to use it to train and build bigger and better models, according to Evans. ChatGPT (and Claude) have both said users\u2019 health data won\u2019t be used for training.<\/p>\n \u201cThere haven\u2019t been huge breaches, but that doesn\u2019t mean that there\u2019s not a possibility that it\u2019s going to happen in the future,\u201d Evans said, adding that stolen data and internal mess-ups are fears for data security, too.<\/p>\n![\"ChatGPT](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/01\/6966c0081700005a37aacabe.jpeg\")
<\/p>\n