The Wellness App Outside the HIPAA Perimeter
Meridian Virtual Health is a Delaware professional corporation whose clinicians deliver telehealth in 40 states, and HIPAA clearly covers its clinical platform. In 2023 it launched Meridian Wellness, a direct-to-consumer app requiring no clinician relationship: users log mood scores, sleep, menstrual cycles, prescription names and self-reported PHQ-9 results, and may buy a $9.99 monthly coaching tier. The app has 210,000 users, about 38,000 of them in Washington. Product marketing shares 'hashed audience segments' built from mood and prescription data with an advertising partner to build lookalike audiences, and the partner also drops its own pixel. The app's privacy policy is the clinical Notice of Privacy Practices, unchanged except for one new paragraph. The CPO receives a complaint from a user who says she never agreed to ad targeting, and a board member asks whether HIPAA already covers all of this. There are no EU or UK users.
1. Which legal regimes govern the Wellness app data, and why does HIPAA's scope matter to the analysis?
Read the worked answer
HIPAA reaches only protected health information: individually identifiable health information created or received by a covered entity or business associate in the course of treatment, payment, or health care operations. Meridian's clinicians are covered, but a wellness app user is not a patient, no clinician is involved, and self-entered mood scores are not created in the course of treatment. The data sits outside HIPAA.
That conclusion drives the rest. HIPAA does not preempt more stringent state law, and the HIPAA exemption inside Washington's My Health My Data Act is limited to PHI. Once the data is not PHI, MHMDA applies in full, and CPRA's sensitive personal information rules apply to California users. The FTC Health Breach Notification Rule also reaches non-HIPAA health apps, so an incident here is not purely a state matter.
Practical consequence: the company cannot lean on its Notice of Privacy Practices, its HIPAA security program, or its HIPAA breach analysis. It needs a separate consumer health data notice, a separate consent architecture, and a data map that keeps clinical and wellness identifiers distinct, especially because a user who is also a patient could link the two.
2. What consents and notices must be in place before the ad-partner sharing continues, for Washington and California users?
Read the worked answer
For Washington users, MHMDA requires a separately displayed consumer health data privacy policy linked from the homepage and distinct from the general policy; affirmative, separate consent before collecting consumer health data and before sharing it; and a signed authorization before any sale of consumer health data, plus a workable withdrawal path. Because MHMDA treats an exchange for valuable consideration as a sale, feeding segments to the ad partner looks like a sale, not mere sharing. That requires authorization rather than consent.
For California users, health data is sensitive personal information: the right to limit use and disclosure must be offered, and sharing for cross-context behavioral advertising is 'sharing' that triggers an opt-out and requires honoring Global Privacy Control. The current bundled, buried consent fails both regimes' clarity standards.
The design answer is to gate the partner integration behind opt-in, keep it off by default, honor withdrawal within the statutory window, and extend the same controls to all users rather than only 38,000 Washington residents. State-by-state consent logic is defensible in theory but fails operationally when users move or travel.
3. How should the company treat the hashed identifiers and the advertising partner's pixel?
Read the worked answer
Hashing does not deidentify. Under MHMDA and CPRA, pseudonymous identifiers remain personal information and consumer health data where the company or the partner can link them back, and the partner can, because it is matching audiences. Describing them as 'hashed segments' in the data flow map is a documentation risk as much as a legal one.
The pixel is the sharper problem: it collects device and behavioral data directly from the app, including page context that reveals a user was reading about depression or a prescription. Even if Meridian never sends an identifier, the partner is collecting health-adjacent data on Meridian's behalf. Calling the partner a service provider will not hold if it uses the data for its own purposes, because a service provider is limited to business purposes and cannot build lookalike audiences for its own account.
Remediation: remove the pixel from health-context screens, terminate audience sharing, obtain authorization if any sale continues, and contractually bar retention or reuse. Document the change so the next data map reflects reality rather than the launch deck.