Is My Wellness or Supplement Brand Subject to HIPAA?
Last updated: August 10, 2026 · By Jason Garrett, Founder, Coast Studio. Not legal advice. Full legal landscape: The State of HIPAA Tracking.
Usually not — and that is the wrong thing to feel relieved about. HIPAA binds covered entities: providers, health plans, clearinghouses, and their business associates. A DTC supplement or wellness brand that neither provides care nor bills insurance usually falls outside it. But three other regimes fill the gap, and they are the ones sending the demand letters.
Who actually binds you
- The FTC regulates your health-data sharing whether or not HIPAA applies. GoodRx and BetterHelp were not covered entities. See FTC reach beyond HIPAA.
- State laws like Washington's My Health My Data Act cover "consumer health data" from any business, with opt-in consent and a private right of action.
- Wiretapping statutes like California's CIPA reach your pixels directly.
The trap: "HIPAA doesn't apply, so we're fine"
Being outside HIPAA removes one rulebook and leaves three. A wellness brand that shares purchase and browsing behavior implying a health condition with Meta or Google faces the same exposure a clinic does — just under different statutes. The compliance work is nearly identical: keep health-inferring data out of ad platforms, gate tags behind consent, and make your privacy policy match your data flows.
The right question
Not "does HIPAA apply?" but "what health signal am I sending, to whom, with what consent?" Answer that and you satisfy HIPAA, the FTC, and the states at once.
FAQ
We sell a mental-wellness app. HIPAA or not?
Often not covered by HIPAA unless you provide care or bill insurance — but squarely within FTC and MHMDA scope. Behave as if the strict rules apply.
If HIPAA doesn't apply, can we use the Meta pixel freely?
No. The FTC and state laws still reach health-inferring data. The pixel exposure is nearly the same.
How do we know if we've crossed into being a covered entity?
Generally when you provide healthcare and transmit claims electronically, or act as a business associate. Confirm with counsel; the line matters for which duties attach.
Sorting out your exposure?
Coast Studio runs compliance-first paid media for regulated health brands — we map your legal exposure and build tracking that holds up. Not legal advice.
Book a Consultation