What “HIPAA-Compliant” and “Encrypted” Mean for a Family

The HIPAA rules apply to covered entities: health plans, health care clearinghouses, and health care providers who transmit health information electronically for billing and similar transactions, together with the business associates who handle that information for them.¹ A daughter keeping her mother's medication list is not a covered entity. Neither is a family's group chat, a shared spreadsheet, or most apps a family downloads on its own.

That is why the FTC tells consumers plainly that, unlike your doctor, a health app may not be covered by health privacy laws like HIPAA, and that the app's privacy notice is what you have to go on.⁵ It is also why the FTC's Health Breach Notification Rule exists: since 2024 it requires apps that handle health information and are not covered by HIPAA to notify people when that information is breached or disclosed without authorization.²

No government agency certifies an app as HIPAA-compliant. When a company says it, it is describing its own practices: that it handles information the way the rules would require of a covered entity, and often that it will sign a business associate agreement if a provider uses it. Both are good things. Neither is an inspection. CareCoordinate says HIPAA-aligned for this reason: the practices are the ones the rules describe, and the word is an honest one.

So treat the label as the start of a conversation. The useful follow-up is: what, specifically, do you do? The next section is the checklist.

HIPAA's security standards for electronic health information name the safeguards in plain terms: access control so only the people granted access can see information, audit controls that record and examine activity, authentication to verify a person is who they claim, and transmission security to guard information moving over a network.³ Encryption appears twice in that list, for stored information and for information in transit, each marked addressable, which means an organization must implement it or document why an equivalent measure is reasonable.³

For a family the translation is this. Ask whether information is encrypted where it is stored, not only on the way to the server. Ask whether the app keeps a record of who looked at and changed what, so a question months later has an answer. Ask how a person proves who they are, and whether access can be removed the day a caregiver leaves the circle. A company that does these things will say so in a sentence.

Is my family's information encrypted at rest and in transit? Who at your company can read it, and under what rules? Is anything shared with or sold to other companies, including for advertising? Is there an audit record of access and changes? Can I remove a person's access immediately? Can I export everything and delete the account, and how long until the data is gone? What happens, and who is told, if there is a breach? The privacy notice should answer most of these; the FTC's advice is to read it for what is collected, how it is used and whether it is shared, and to check the settings for what you control.⁵

The rule that binds your parent's doctors also helps you. A provider may share information relevant to a family member's involvement in the patient's care when the patient agrees, is given the chance to object and does not, or, when the patient cannot decide, when the provider judges it in the patient's best interest.⁴ That is the provision behind a doctor speaking with a daughter in the exam room, and the one to point to when an office says HIPAA forbids it. For the paperwork that makes it routine, see our guide on the documents every family caregiver should ask about.