Health, Fitness & Misc Services · Healthcare Booking · Data breach
ZocDoc
Headline
A healthcare appointment platform necessarily learns the two things people most want kept private together - which specialty you are seeing and when - and specialty alone is often diagnosis-adjacent.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
A healthcare appointment platform necessarily learns the two things people most want kept private together - which specialty you are seeing and when - and specialty alone is often diagnosis-adjacent. Booking an oncologist, a psychiatrist, a fertility clinic or an addiction medicine practice discloses substantially more than the appointment. The structural issue is that a booking platform is generally not itself a HIPAA covered entity in the way the doctor is (it may act as a HIPAA business associate for some provider functions; Zocdoc's status was not verified this pass), so the same fact can be protected health information in the physician's file and ordinary business data on the platform that scheduled it. Zocdoc has twice notified California regulators (2016 and 2021) that programming errors left some practice staff with access to patient booking data after it should have ended; beyond that, the regulatory-perimeter gap is the finding.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
As a healthcare-appointment booking platform, ZocDoc necessarily processes data revealing WHICH TYPE OF SPECIALIST a user is seeing (e.g., a psychiatrist, an OB-GYN, an oncologist) — information that can itself reveal sensitive health conditions even without accessing the medical record directly. Zocdoc filed breach notices with the California AG in May 2016 and May 2021, each describing programming errors that let some former or current practice staff keep access to its provider dashboard/portal after that access should have been removed, potentially exposing patient names, contact details, appointment history, insurance member IDs and medical history provided through Zocdoc (the 2021 notice also lists Social Security numbers). No named lawsuit was confirmed this pass, though the same general Meta-Pixel/health-data-sharing risk pattern documented for MyChart (this same tab), Kroger, and Costco (Consumer Apps/Online Retailers tabs) plausibly applies to any healthcare-adjacent website.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy zocdoc.com/about/privacy | Not fetched yet | NO (HTML only) |
| Terms of service zocdoc.com/about/terms | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.