ChatGPT Health is live in the US. HIPAA didn't come with it

ChatGPT Health is now open to every U.S. user on Free, Go, Plus, and Pro — web and iOS, 18 and up. Connect Apple Health, hospital records, One Medical, Function Health, and ChatGPT can reason over your medications, labs, recent visits, sleep, and activity. OpenAI announced the feature in January and spent six months rolling it out. It landed this week. The interesting part isn't the product. It's that a nationwide pipe now exists for moving regulated records out of the systems that regulate them.

What actually happened

Per OpenAI, connected medical records and Apple Health data — and the conversations that use them — are not used to train foundation models or to target ads. ChatGPT asks permission before pulling connected records into a response, unless you turn that off. Disconnect a source and the data is deleted within 30 days. Health lives in its own tab with separate memory.

Those are real commitments. They are also terms of service, not statute. HIPAA binds covered entities — providers, plans, clearinghouses — and their business associates. OpenAI is none of those. Bradley Malin, a biomedical informatics professor at Vanderbilt, framed it to Time as "buyer beware" when you hand data straight to a technology company that isn't delivering care. The Register noted the rollout arrived a day after a lawsuit alleging ChatGPT gave dangerous medical advice during an emergency.

Why this matters for your business

You probably don't run a clinic. You still handle at least one class of data whose legal protection is attached to where it sits, not to the bytes themselves — PHI if you're a med spa or dental office, cardholder data under PCI, student records under FERPA, or client financials your accountant holds under a professional duty.

The rule is the same in every case: the regulation follows the entity, not the file. Copy a protected record into a general-purpose tool and the wrapper falls off. No breach required. No malice. Someone pastes a lab result into a chat window to summarize it, and a HIPAA-covered document becomes a contract-governed document.

So write the boundary down before someone tests it. One page: which data classes exist in your business, which systems are allowed to hold each one, and which tools are explicitly out of scope. Then make the compliant path the fast path — if the sanctioned tool is slower than pasting into ChatGPT, your policy is decoration. Where the work genuinely needs AI on regulated data, run it through a provider that will sign a BAA and keep the audit trail.

Sources: OpenAI, The Register, Time.