GLP-1 Telehealth Privacy: Before You Share Your Data

Before sending a GLP-1 questionnaire, prescription photo or payment information, identify who receives it and where to ask for help. The storefront name alone does not answer which privacy notice covers each step.¹

Identify the company, practice and pharmacy

HIPAA protection depends on the organization and its role. HHS says its rules apply to covered entities, including most healthcare providers and health plans, and their business associates. In most cases, information entered into a personal-use app is outside HIPAA unless the app is provided by a covered entity or its business associate. A health-related purpose does not settle coverage.¹

Find the notice for the information

Look for both the website or app privacy policy and the treating practice’s Notice of Privacy Practices. HHS explains that the latter describes permitted uses and disclosures, privacy duties, patient rights and a contact for questions or complaints. Acknowledging receipt of that notice is not the same as authorizing special uses of your records. Keep those documents separate when reviewing a consent screen.²

Use this short list while choosing a provider. These are questions to resolve, not assumptions about how a particular company operates.²

Outside HIPAA does not mean unprotected

The FTC says companies outside HIPAA can still face legal obligations. Section 5 of the FTC Act prohibits deceptive or unfair practices. Its Health Breach Notification Rule applies to certain personal-health-record businesses and related service providers outside HIPAA; it does not cover every app merely because it discusses health. The FTC’s guidance discusses July 2024 amendments, not a new blanket privacy guarantee for online treatment.³

For covered businesses, a reportable breach can involve unauthorized disclosures, not only hacking. Ask how the operator handles a suspected disclosure and whom to contact. Neither an unexplained advertisement nor a missing HIPAA label, by itself, establishes that a particular company broke the law.³

Separate advertising choices from care information

FTC guidance explains that cookies, pixels and device identifiers can help companies track activity and personalize advertising. Review the site’s cookie choices and the app’s permissions before uploading anything. Consider whether access to contacts, location or an entire photo library is necessary. If a permission seems broader than the task, ask whether a narrower setting or another upload method is available.⁴

Private browsing is not a complete shield: the FTC says it does not stop websites from seeing your online activity. Likewise, an advertising opt-out does not explain the separate handling of an intake or medical record. Read each applicable policy rather than treating one browser setting as the answer to every privacy question.⁴

Ask what account deletion actually removes

Before closing an account, ask separately about the login, stored uploads and clinical records: what is deleted, what remains, who retains it and how you can request a copy later. HHS says HIPAA itself does not set medical-record retention periods; state laws generally govern them. Covered entities must safeguard protected information while retaining it and through disposal. Do not assume removing an app erases records held by a practice.⁵

A useful written request identifies the information you mean, rather than simply saying “delete everything.” Ask the organization to explain any retention requirement and the applicable request process. Save its response so that losing portal access does not leave you unsure who still holds the record.⁵

Request corrections from the record holder

For records held by providers and plans covered by the Privacy Rule, HHS describes access rights with exceptions, and a right to request amendments to incorrect medical or billing information. If the organization disagrees with an amendment request, you can submit a statement of disagreement for the record. A correction request is different from deleting an account or changing a marketing preference.⁶

Explain the specific entry and the correction sought. Ask the practice which process to use instead of putting medical details into a public review. If you are moving care, our provider-switching guide covers the separate records-transfer task. Our pharmacy verification guide helps identify the dispensing organization before directing questions there.⁶

Protect the visit and the upload

HHS recommends a private place for telehealth, a personal device where possible, security updates and strong, unique passwords. Enable multifactor authentication when available. If you need help using it or require an accessible alternative, contact the provider. Keep other people from seeing your screen or hearing the conversation; headphones can help when privacy is limited.⁷

If an unexpected message asks for a prescription photo or payment details, confirm the link through a contact route you already trust before proceeding. HHS advises checking doubtful links directly with the provider. These precautions reduce avoidable exposure; they do not certify the service’s security or replace the need to understand its information-handling policies.⁷

Keep a clear route for concerns

Start with the privacy contact named in the relevant notice. For a suspected HIPAA violation, HHS explains how to file with its Office for Civil Rights. The complaint must identify the entity and describe what happened. Its guidance says to file within 180 days of when you knew of the event; OCR may extend that period for good cause. Eligibility for an investigation depends on the entity and alleged conduct.⁸

Keep the policy version, date, company or practice name and a concise account of the problem. Share sensitive evidence through the appropriate complaint process rather than posting it publicly. This guide does not determine a merchant’s compliance or provide a complete account of state privacy law; the practical goal is to know whom you are dealing with before sharing more information.⁸