Apple Health Records (Apple Inc.)

The Health Records feature on iPhone and iPad lets you download your records directly from participating hospitals and clinics onto your phone. Apple says the records are stored encrypted, protected by your passcode, and encrypted in transit and at rest when synced through iCloud. The legal point consumers miss is that once your provider sends records to an app you chose, HHS says the records are 'no longer subject to the protections of the HIPAA Rules,' and your provider isn't liable for what happens to them next. On your phone, Apple's privacy policy and general consumer-protection law (FTC, state law) govern instead of HIPAA. This pass found no breach or enforcement action involving Health Records. The bigger risk is what happens when you later share those records with third-party apps that aren't covered by HIPAA.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-15

Primary source. www.hhs.gov/hipaa/for-professionals/privacy/guidance/access-right-health-apps-apis/index.html — Unverified - heuristic first draft.

Arbitration

No arbitration clause or class-action waiver in the iOS and iPadOS 26 Software License Agreement; governed by California law (s.11). Apple Media Services and iCloud terms not reviewed.

Data sharing

Records come straight from the provider to the device and are stored encrypted. Health data synced through iCloud is encrypted in transit and at rest. Once on the device, HIPAA doesn't apply (HHS). Any sharing onward to third-party apps the user authorizes leaves Apple's ecosystem as well. Not detailed in the Apple pages reviewed.

Contacts

Privacy contact. apple.com/legal/privacy/contact; California: 1-800-275-2273

Legal notice. Apple Inc., One Apple Park Way, Cupertino, CA 95014 (business address of record on SEC EDGAR; incorporated in California). For service of process, confirm the registered agent via the California Secretary of State business search.

Mailing address. Not recorded.