Is It Illegal to Share Someone’s Medical Information?

Whether sharing someone’s medical information is illegal depends almost entirely on who is doing the sharing. In the United States, federal law restricts healthcare providers, health insurers, and their business partners from disclosing your health data without authorization. But if a friend, neighbor, or ex-partner reveals your diagnosis to someone else, federal health privacy law does not apply to them at all. The legal landscape around medical information is a patchwork of federal rules, state laws, and glaring gaps, and the protections are narrower than most people realize.

Who HIPAA Actually Covers

HIPAA, the Health Insurance Portability and Accountability Act, is the law most people think of when they hear “medical privacy.” Its Privacy Rule sets strict limits on who can see your health information and when. But HIPAA only applies to what the law calls “covered entities” and their “business associates.” Covered entities include doctors, hospitals, clinics, pharmacies, health insurance companies, and healthcare clearinghouses that process billing. Business associates are companies that handle health data on behalf of those covered entities, like a billing service, a cloud storage provider hosting patient records, or an IT contractor with access to medical files.

That list sounds broad, but it leaves out a lot of people and organizations. Your employer is not a covered entity under HIPAA, even if they have access to some of your health information. Your gym, your life insurance company, your school, and your coworker are not covered entities. Neither is a relative who overheard your diagnosis in a waiting room. If any of these people share your medical details, HIPAA is not the law they have broken, because HIPAA was never written to regulate them in the first place. This is the single most common misunderstanding about medical privacy law: people assume HIPAA protects all health information from everyone. It does not. It protects health information held by a specific set of organizations.

What Happens When a Covered Entity Violates HIPAA

When a healthcare provider, insurer, or business associate improperly discloses your protected health information, the consequences can be serious. The U.S. Department of Health and Human Services (HHS) enforces HIPAA through its Office for Civil Rights, and penalties fall into tiers based on the level of negligence involved. Civil penalties range from about $100 per violation for infractions the entity did not know about and could not reasonably have prevented, up to roughly $50,000 per violation for willful neglect. Annual caps can push total penalties into the millions for large-scale or repeated breaches.

Criminal penalties exist too, though they are rarer. An individual who knowingly obtains or discloses protected health information in violation of HIPAA can face fines and up to one year in prison. If the violation involves false pretenses, the maximum jumps to five years. If the purpose was personal gain or malicious harm, it can reach ten years. These criminal provisions are prosecuted by the Department of Justice, not HHS, and they apply to individuals within covered entities or their business associates, not to random members of the public.

One important limitation: HIPAA does not give you, as an individual patient, the right to sue a covered entity directly for a privacy violation. There is no private right of action under the statute. You can file a complaint with HHS, and the agency investigates, but you cannot walk into court and bring a HIPAA lawsuit. This surprises many people who assume a federal privacy law would let them seek damages directly.

When a Private Individual Shares Your Medical Information

If someone who is not a covered entity shares your health details without your permission, HIPAA cannot help you, but that does not mean you have no legal recourse. State laws fill some of the gap, though coverage varies widely by jurisdiction.

Many states recognize a tort called “public disclosure of private facts,” which is a form of invasion of privacy. To succeed with this kind of claim, you generally need to show that someone publicized private information about you, that the information would be highly offensive to a reasonable person, and that it was not a matter of legitimate public concern. Sharing that someone has HIV, a mental health diagnosis, or a substance use disorder could meet that threshold, depending on the state. Some states also allow claims for intentional infliction of emotional distress if the disclosure was extreme enough.

A handful of states have enacted laws that go beyond HIPAA’s scope and apply privacy obligations to a broader range of actors. California, for example, has its own Confidentiality of Medical Information Act, which covers employers and certain other entities not reached by HIPAA. But enforcement of patient rights remains uneven. Research into health data confidentiality across legal systems has found that the right to have medical information kept private often functions more as a principle on paper than a consistently enforced protection in practice, partly because of how difficult it is for individuals to detect and prove unauthorized disclosures.¹

Exceptions That Allow Sharing Without Your Consent

Even under HIPAA, your health information can be shared without your explicit authorization in a number of circumstances. These exceptions exist because lawmakers decided that certain societal interests outweigh individual privacy in specific situations.

• Public health activities: Healthcare providers can report diseases, injuries, and conditions to public health authorities for surveillance purposes. This is how infectious disease tracking works. Providers are required to report certain communicable diseases, cases of suspected abuse, and other conditions as mandated by state law.
• Law enforcement requests: HIPAA permits covered entities to disclose limited information to law enforcement under certain conditions, including in response to a court order, warrant, or subpoena. Even without those legal instruments, providers can sometimes share minimal information to help identify or locate a suspect or fugitive, or to report certain types of wounds or injuries where state law requires it.
• Imminent threat: If a provider believes disclosure is necessary to prevent or lessen a serious and imminent threat to someone’s health or safety, they can share relevant information with those who may be able to prevent the harm.
• Treatment, payment, and operations: Your information can flow between providers involved in your care, to your insurer for payment purposes, and within a healthcare organization for quality improvement and other operational activities, all without a separate authorization from you.

The law enforcement exception is especially nuanced. A study of emergency department practices in Canada found that even within a single country, the rules governing what physicians can share with police vary by province. Across Canadian provinces, physicians must disclose patient information when presented with a search warrant or court order. In the absence of those instruments or patient consent, only minimal information can typically be released, specifically the patient’s name, next of kin, and a general description of medical status. Certain provinces have mandatory reporting laws for specific injuries, such as gunshot wounds, which override the default confidentiality rules.² The U.S. follows a broadly similar structure, where legal process or specific statutory mandates are generally needed before detailed medical records can be turned over to police.

Your Employer and Medical Privacy

Workplace situations create some of the most common confusion about medical privacy. Your employer is not a HIPAA-covered entity, so HIPAA itself does not prevent your boss from sharing your health information within the company or elsewhere. However, other federal laws impose their own limits.

The Americans with Disabilities Act (ADA) requires employers to keep medical information about employees in separate, confidential files, apart from general personnel records. If you disclose a medical condition to request a workplace accommodation, or if an employer-mandated medical exam reveals health information, the ADA restricts who within the company can access it. Supervisors can be told what work restrictions or accommodations are necessary, but they are not supposed to learn the underlying diagnosis.

The Family and Medical Leave Act (FMLA) also imposes confidentiality requirements on medical certifications submitted to justify leave. And workers’ compensation programs typically limit the medical information an employer can access to what is relevant to the workplace injury or illness at issue.

Where things get murky is in everyday workplace interactions. If you tell a coworker about your health condition and they spread it around the office, no federal law was broken. If your manager mentions your cancer diagnosis at a staff meeting, that may violate the ADA’s confidentiality provisions if the manager learned about it through a protected channel, but it may not if you had shared the information openly. The legal protections depend heavily on how the information was obtained and by whom.

Health Apps and the Growing Privacy Gap

One of the largest and least understood gaps in medical privacy law involves health technology that consumers use every day. Fitness trackers, mental health apps, period-tracking apps, and direct-to-consumer health tools powered by artificial intelligence collect enormous amounts of health data. Most of these products are not provided by HIPAA-covered entities. If you download a meditation app, a symptom checker, or a genetic testing service’s companion app, the company behind it is probably not a hospital, insurer, or healthcare provider, and HIPAA does not apply.

A review of privacy protections for direct-to-consumer AI-powered health apps found that existing U.S. law leaves significant gaps. While HIPAA covers traditional healthcare relationships, these consumer apps fall outside its reach. The Federal Trade Commission (FTC) has stepped in to some degree, using its authority under the FTC Act and the Health Breach Notification Rule to take action against companies that mishandle health data or fail to notify consumers after a breach. California’s Consumer Privacy Act and the California Privacy Rights Act, along with similar laws in Virginia and Colorado, provide additional state-level protections. But the review concluded that much more work is needed to adequately protect consumer health data, and that even the FTC’s recent enforcement actions are not enough without broader consumer education and, ideally, a comprehensive federal privacy law similar to Europe’s General Data Protection Regulation.³

The practical upside of this for you: read the privacy policy before using a health app. Many of these apps share or sell data to third parties, including advertisers and data brokers, and they are legally permitted to do so unless a specific state law says otherwise. If privacy matters to you, look for apps that explicitly commit to not selling your data, and check whether the company has been subject to any FTC enforcement actions.

Medical Privacy for Minors

Medical privacy gets especially complicated when the patient is a teenager. In the U.S., state laws generally allow minors to consent to certain types of healthcare on their own, without parental involvement. The most common categories are reproductive health, sexually transmitted infection testing and treatment, mental health services, and substance use treatment. When a minor accesses care in one of these categories, the provider often has an obligation to keep that information confidential from the minor’s parents.

But HIPAA’s interaction with these state laws creates real tension. Under HIPAA, a parent is generally considered the “personal representative” of a minor child and has the right to access that child’s medical records. The regulation includes an exception: when state law allows a minor to consent to care without parental involvement, the parent’s right to access the related records can be restricted. In practice, whether a parent can see their teenager’s reproductive health visit or therapy notes depends on which state they live in and how that state’s consent laws are written. A review of legal issues surrounding adolescent healthcare noted that HIPAA regulations add a layer of complexity to an area already shaped by evolving court decisions and varying state statutes.⁴

For teenagers, the stakes are high. Research consistently shows that adolescents are less likely to seek care for sensitive health issues if they believe their parents will find out. Some states have moved to strengthen confidentiality protections for minors, while others have moved in the opposite direction. If you are a parent trying to understand what you can and cannot access, or a teenager trying to understand your rights, the answer is genuinely state-specific.

Data Breaches and Notification Requirements

Sometimes medical information is shared not because someone chose to disclose it, but because a system was hacked or a database was improperly exposed. Healthcare data breaches have become alarmingly common, with hospitals, insurers, and third-party vendors reporting incidents that expose millions of patient records each year.

Under HIPAA, covered entities must notify affected individuals, HHS, and in some cases the media when a breach of unsecured protected health information occurs. The notification must happen within 60 days of discovering the breach. Beyond HIPAA, every U.S. state now has its own data breach notification law requiring certain organizations to disclose breaches to the people whose data was exposed.⁵ These state laws vary in their specifics, including which types of data trigger notification requirements, how quickly notice must be given, and what remedies are available.

Medical identity theft is a particular concern after a breach. Unlike a stolen credit card number, which can be cancelled and replaced, a medical record number tied to your health history is not something you can simply swap out. Fraudulent use of medical identity can result in incorrect information appearing in your medical records, which in the worst case could affect your treatment.

De-identification Does Not Always Mean Anonymous

Healthcare organizations, researchers, and data brokers frequently argue that they can share medical data safely by stripping out identifying information like names, addresses, and Social Security numbers. HIPAA itself permits the sharing of “de-identified” health information without restriction, on the theory that if data cannot be linked back to a specific person, there is no privacy risk.

The problem is that de-identification is not as foolproof as it sounds. Research into data privacy and identifiability has shown that seemingly anonymous medical records can be re-identified using publicly available information, without any need to hack into secure systems.⁶ A combination of a few data points, like zip code, date of birth, and gender, is often enough to narrow a “de-identified” record down to a single individual when cross-referenced with voter registration rolls or other public databases. As health datasets become larger and more detailed, the risk of re-identification grows, because more data points mean more potential paths back to a specific person.

This matters for anyone whose data ends up in a research database, an insurance analytics platform, or a dataset sold by a data broker. You may have been told your data was anonymized, and technically it was. But technical de-identification and practical anonymity are not the same thing, and the gap between them is one of the underappreciated risks in modern health data sharing.

How Europe’s Approach Differs

The European Union’s General Data Protection Regulation, which became binding law across EU member states in 2018, takes a fundamentally different approach from the U.S. patchwork. Rather than targeting specific industries like healthcare, the GDPR governs almost all personal data processing, including biomedical data, under a single regulatory framework.⁷ Health data is classified as a “special category” under the GDPR and receives heightened protections. Organizations that process health data generally need explicit consent or another lawful basis, and individuals have rights to access, correct, and in some cases delete their data.

The GDPR also applies to any organization that processes data of EU residents, regardless of where the organization is based. A U.S. health app used by European consumers must comply with GDPR requirements for those users. Violations can result in fines of up to 4% of global annual revenue, a figure that dwarfs typical HIPAA penalties for all but the most egregious cases.

The European model is not without its own problems. Researchers working across EU member states have found that despite the GDPR’s goal of harmonization, national-level exceptions and interpretations still create inconsistency, particularly around consent requirements for research use of health data. But the core difference remains: in the EU, health data privacy is part of a comprehensive, economy-wide data protection framework. In the U.S., it is a sector-specific patchwork with large holes that state laws only partially fill. Proposals for a U.S. federal privacy law modeled on the GDPR have been discussed for years but have not advanced through Congress.

Social Media and Casual Disclosure

Perhaps the most legally unregulated form of medical information sharing happens on social media and in everyday conversation. If someone posts about your health condition on Facebook, shares a screenshot of your pharmacy receipt on Instagram, or tells a group chat about your therapy sessions, they are almost certainly not violating HIPAA, because they are almost certainly not a covered entity. Whether they are violating any law at all depends on the state, the nature of the disclosure, and the relationship between the people involved.

Some specific scenarios do carry legal risk for private individuals. In states with revenge-porn statutes that have been broadly written, sharing intimate health details as a form of harassment might fall within their scope, though most of these laws target images rather than text. Sharing someone’s HIV status without their consent is specifically illegal in several states under HIV-specific privacy laws, which exist because of the long history of discrimination associated with that particular diagnosis. And in any state, if someone shares false medical information about you (claiming you have a disease you do not have, for instance), you may have a defamation claim rather than a privacy claim.

The honest reality is that for most casual disclosures of someone else’s medical information by a private individual, the legal remedies are thin. You might have a viable lawsuit if the disclosure was extreme enough, public enough, and damaging enough, but in many everyday situations, the law treats gossip about health conditions the same way it treats gossip about anything else. The strongest protections exist within the formal healthcare system, and they weaken considerably the further you move from it.