OpenAI launched ChatGPT Health and quietly moved your medical records outside HIPAA

OpenAI launched ChatGPT Health on July 23, 2026, allowing U.S. users to connect Apple Health data and hospital records directly to the AI chatbot, The Record reported. The feature rolled out to all logged-in U.S. users aged 18 and older across Free through Pro tiers on web and iOS after a January pilot required a full relaunch. The product pulls records from systems including Epic, Oracle Health, One Medical and Function Health labs. OpenAI said the data is not used to train its models or serve ads. However, privacy experts warn that uploading medical records to ChatGPT removes their federal HIPAA protections permanently because OpenAI is not a covered entity under the law. Sara Geoghegan, senior counsel at the Electronic Privacy Information Center, told The Record that sharing records with ChatGPT Health "would remove the HIPAA protection from those records, which is dangerous." The data becomes governed by OpenAI's terms of service, which the company can update at any time. Unlike records held by providers, data shared with ChatGPT can potentially be subpoenaed in civil litigation with fewer procedural hurdles. The health data connectivity startup b.well powers ChatGPT Health's medical record pipeline, according to The Record, and also powers Google's health AI efforts and Perplexity Health. The U.S. has no comprehensive consumer privacy law to protect health data once it leaves a HIPAA-covered institution.