About a third of US adults asked an AI chatbot for health information in the past year, and 13% of all adults uploaded test results or doctors’ notes, according to KFF. Once that data leaves a clinic’s systems, HIPAA usually stops applying to it. Confidential computing, which keeps data encrypted even while a model works on it, narrows the risk, but it has limits of its own.
People already tell chatbots their health data
KFF’s March 2026 poll of 1,343 US adults found that 32% had used an AI chatbot for health information in the past year. Among those users, 41% had uploaded personal medical information such as test results or doctors’ notes. That is 13% of the whole public. Yet 77% of adults said they were concerned about the privacy of medical information given to AI tools, including 65% of the people who had shared it.
The products are following that behaviour. In January 2026 OpenAI launched ChatGPT Health, a section of ChatGPT where users can upload medical records and connect apps such as Apple Health. OpenAI says more than 40 million people ask ChatGPT health questions every day, Time reported.
The pull is easy to understand. An assistant is more useful the more it knows about you, and it is also more costly to lose.
| What the assistant is given | What it can do | What a leak exposes |
|---|---|---|
| Nothing personal | General advice | Nothing |
| Lab results and doctors’ notes | Explain results, prepare for appointments | Diagnoses and medications |
| Connected records and wearable data over time | Track trends against your history | A long-running health profile |
What happens to that data today
Three questions matter: is it used for training, can someone compel it, and which law protects it.
Training. A Stanford study published in October 2025 reviewed the privacy policies of six US developers: Amazon, Anthropic, Google, Meta, Microsoft and OpenAI. All six use chat data to train their models by default, and some keep it indefinitely. Health-specific products can differ. OpenAI says ChatGPT Health data is stored separately, protected with purpose-built encryption and not used to train its foundation models, as reported by Healthcare Dive.
Compulsion. In July 2025, OpenAI chief executive Sam Altman said on a podcast that no legal privilege covers ChatGPT conversations the way it covers talks with a doctor, lawyer or therapist, and that OpenAI could be required to produce them in a lawsuit.
Law. HIPAA applies to health plans, health care providers that conduct standard transactions electronically, and clearinghouses, plus the business associates that handle data for them. A person who uploads their own records to a chatbot they chose is usually outside that perimeter. Bradley Malin, a biomedical informatics professor at Vanderbilt, told Time that at that point the arrangement is a contract between the individual and the company. A hospital tool run by a business associate is a different case.
| Where your health data sits | Main protection |
|---|---|
| A clinic, hospital or insurer, and their business associates | HIPAA |
| A health app or chatbot you chose to use | The company’s terms, the FTC Act, the FTC Health Breach Notification Rule for covered apps, some state laws |
| A chat history in a lawsuit | No doctor-style privilege, according to Altman |
The FTC is the backstop, and it is narrow
The FTC Act reaches companies that handle health information outside HIPAA. The Health Breach Notification Rule is narrower: it covers vendors of personal health records, related entities and their service providers that HIPAA does not cover. The FTC’s April 2024 update made clear that health apps are included, and that a breach covers unauthorised disclosure, not only a hack.
The enforcement record is about advertising. In February 2023 the FTC took its first action under the rule, against GoodRx, with a $1.5 million civil penalty. It alleged GoodRx shared prescription and health-condition data with Facebook, Google and others after promising it would not. In March 2023 BetterHelp agreed to $7.8 million in consumer refunds over sharing email addresses, IP addresses and health questionnaire answers with Facebook, Snapchat, Criteo and Pinterest.
Blockleaders found no FTC action under the rule against a general-purpose chatbot maker. States are filling some of the gap. Washington’s My Health My Data Act covers health data outside HIPAA, requires valid authorisation before it is sold, and allows private lawsuits.
Every one of these remedies arrives after the data has moved. That is why the technical question matters. Part two of this series looked at what that looks like for genetic data.
Encryption in use
Data has three states, and ordinary tools protect only two.
| State of data | Typical protection | Who can read it |
|---|---|---|
| At rest | Disk or database encryption | Whoever holds the keys |
| In transit | TLS | The two endpoints |
| In use, standard server | None; decrypted in memory to compute | Software running on that server |
| In use, in a trusted execution environment (TEE) | Hardware isolation plus attestation | Designed to exclude the operator |
The Confidential Computing Consortium defines confidential computing as protecting data in use by doing the computation inside a hardware-based, attested TEE. Attestation lets the hardware prove to a user what code is running before any data is sent in.
It is already used with health data. Edgeless Systems says its confidential computing software supports Germany’s electronic patient record for up to 50 million insured people, where gematik, which sets the system’s standards, requires that the infrastructure operator verifiably has no access to the health data. In consumer AI, Apple extended its Private Cloud Compute to Google Cloud in June 2026 on NVIDIA confidential computing, Intel TDX and Google’s Titan chip, with stated aims of stateless computation, no privileged runtime access and verifiable transparency.
Where enclaves fall short
An enclave moves trust from the service provider to the chip maker and the attestation chain. Researchers have broken that chain before.
- Foreshadow (2018) was a software attack that could read the memory of Intel SGX enclaves and extract the attestation keys that vouch for them.
- WireTap (2025), presented at the ACM CCS conference, needed physical access to a server and under $1,000 of equipment. It extracted an SGX attestation signing key, which let the researchers forge enclave reports and pass as genuine hardware.
Physical access is a high bar for a hospital’s own data centre. It matters more on networks where many independent operators run the servers.
An enclave also does not settle the rest of the problem. It protects data while a model reads it. It does not decide who may ask, what is kept afterwards, or what the answer is used for. Those are consent questions.
One example: Secret Network and DEPH Network
One project built around this idea is DEPH Network, a health-data platform that uses Secret Network, a blockchain that runs smart-contract code inside Intel SGX enclaves. On Blockleaders’ Cognitio show, Lisa Loud, who introduced herself on the show as CEO of DEPH Network and of Secret³, said the raw data does not go on the blockchain. A gate sits in front of each person’s DNA and epigenetic data instead, and “every person will have an encrypted vault with their data in it.” Access runs through Secret Network with a viewing key, she said.
That is a design claim, and the episode did not test it. Secret Network was one of the SGX-based networks named in the WireTap research. In September 2025 Secret said the researchers had targeted only its testnet, that no mainnet data was extracted, and that its version 1.22 upgrade added mitigations including a trusted-node allowlist and seed rotation.
Questions to ask any health AI
| Question | Why it matters |
|---|---|
| Is my data used for training, and can I switch that off? | Training on chat data is the default at six major developers |
| Who can read my data while the model runs? | Ask whether it runs in an attested TEE, on which hardware, and who audits it |
| What law covers it? | HIPAA only applies through a covered entity or business associate; otherwise it is FTC and state law |
| How long is it kept, and how do I delete it? | Retention varies, and some developers keep chat data indefinitely |
| Can I say no to each new use? | Consent should be specific, as Washington’s law requires for sales |
The practical rule is simple. Treat anything you paste into a general chatbot as outside HIPAA. Ask for both the legal answer and the technical one. Treat an enclave claim as a design to be audited, not a guarantee.
This is part three of a series. Part one covered sex-specific epigenetic clocks.
This article is part of Blockleaders’ coverage of Cognitio, the Blockleaders show hosted by Justin Roberti, from the episode “The AI Secret to Better Health: DEPH Network on Secret3” with Lisa Loud, Sam Thompson and Ian Spiegel. Watch the full episode.
Sources
All opened during research on 2026-10-01. Where a primary page blocked access, the secondary source used is named. Quotes from the show come from the local Whisper transcript (10:30 to 10:35).
- KFF, “Poll: 1 in 3 Adults Are Turning to AI Chatbots for Health Information”, 25 March 2026. https://www.kff.org/health-information-trust/poll-1-in-3-adults-are-turning-to-ai-chatbots-for-health-information-equaling-the-share-who-use-social-media-for-health/
- Time, “Is Giving ChatGPT Health Your Medical Records a Good Idea?”, 9 January 2026. https://time.com/7344997/chatgpt-health-medical-records-privacy-open-ai/
- Healthcare Dive, “OpenAI launches health-specific ChatGPT”, January 2026. https://www.healthcaredive.com/news/openai-launches-chatgpt-health/809094/
- Stanford HAI, “Be Careful What You Tell Your AI Chatbot”, 15 October 2025. https://hai.stanford.edu/news/be-careful-what-you-tell-your-ai-chatbot
- Cointelegraph, “ChatGPT Chats Could Be Used Against Users In Court” (Sam Altman on the Theo Von podcast), July 2025. https://cointelegraph.com/news/dont-share-everything-with-chatgpt-sam-altman
- FTC, “Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule”. https://www.ftc.gov/business-guidance/resources/collecting-using-or-sharing-consumer-health-information-look-hipaa-ftc-act-health-breach
- FTC, “FTC Finalizes Changes to the Health Breach Notification Rule”, April 2024. https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-finalizes-changes-health-breach-notification-rule
- FTC, “FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising”, February 2023. https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising
- FTC, “FTC to Ban BetterHelp from Revealing Consumers’ Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising”, March 2023. https://www.ftc.gov/news-events/news/press-releases/2023/03/ftc-ban-betterhelp-revealing-consumers-data-including-sensitive-mental-health-information-facebook
- Washington State Attorney General, My Health My Data Act. https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy
- Confidential Computing Consortium, governance scoping document (definition of confidential computing). https://github.com/confidential-computing/governance/blob/main/scoping.md
- Edgeless Systems, “Edgeless Systems software protects the data of millions of insured individuals in electronic patient record system”. https://www.edgeless.systems/resource-library/epa
- Apple Security Research, “Expanding Private Cloud Compute”, 8 June 2026. https://security.apple.com/blog/expanding-pcc/
- Foreshadow attack research site. https://foreshadowattack.eu/
- WireTap: Breaking Server SGX via DRAM Bus Interposition (ACM CCS 2025). https://wiretap.fail/
- Secret Network, “Security Update: Intel SGX Vulnerability Response”, 30 September 2025. https://scrt.network/blog/secret-network-security-update-intel-sgx-vulnerability-response
- Cognitio episode “The AI Secret to Better Health: DEPH Network on Secret3”, recorded 22 September 2026. https://www.youtube.com/live/NBCuJ0IgM9Q
