Gusto collects your health insurance enrollment details and other medical benefit information when you use its platform to manage employee benefits.
This analysis describes what Gusto's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Health and benefits data is among the most sensitive personal information category, and its collection by a payroll platform creates potential obligations under HIPAA and heightened risks if exposed.
Interpretive note: Whether Gusto qualifies as a HIPAA business associate for benefits data processing depends on contractual and operational facts not fully determinable from the privacy notice alone.
The updated Privacy Policy now explicitly states it covers retirement account management (401k, SEP IRA, IRA accounts) and adds Stripe alongside Plaid as a third-party service provider that collects financial institution data. The policy restructures how it describes Gusto's role in different contexts: when Gusto acts as a service provider processing payroll or other data on behalf of employers, when it acts as an employer itself, or when it operates as a co-employer under a professional organization (PEO) arrangement, with separate privacy notices applying in each case. The policy introduces a new commitment that de-identified data will not be re-identified except to verify compliance with applicable law. If you connect a bank account through Stripe, that data will be treated under Stripe's Privacy Policy, which you should review separately.
View change record →The updated terms make explicit that using Gusto's background check service constitutes a binding agreement. Previously, the terms of the service relationship may have been less clearly stated. Now, the agreement clarifies that an authorized signatory represents they have authority to bind the organization, and that three actions trigger binding acceptance: checking a box, initiating a background check, or accessing the service. This means employers should ensure the person clicking through has actual authority to commit the organization to the full Background Check Customer Agreement before proceeding.
View change record →The updated terms now explicitly state that employers accept mandatory individual arbitration and waive the right to participate in class-action lawsuits or pursue relief in court with a jury trial. This significantly limits employers' ability to challenge Gusto's practices collectively or seek resolution through the court system. Any disputes employers have with Gusto must be resolved individually through arbitration, which typically involves private, binding proceedings with limited appeal options and discovery rights compared to court litigation.
View change record →Previous version had empty excerpt; current version now specifies the types of health information collected (health insurance enrollment, FSA information, health benefits).
View full change record →Your health plan enrollment, FSA elections, and related medical benefits information is collected and processed by Gusto, a payroll company, which means your health-related data is held outside of a traditional healthcare provider relationship and may have different legal protections depending on Gusto's HIPAA status.
How other platforms handle this
If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.
With your permission, we may also receive data from your mobile device's health app (like Apple HealthKit or Google Health Connect), including hours of sleep and sleep goals. However, we do not infer any health-related characteristics from this information and only process it consistent with the pur...
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
Monitoring
Gusto has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We collect health plan and medical information you provide when enrolling in or managing benefits through the Gusto Platform, including health insurance enrollment information, flexible spending account information, and information related to other health benefits offered through Gusto.— Excerpt from Gusto's Gusto Privacy Policy
1) REGULATORY LANDSCAPE: The collection of health insurance enrollment and FSA information may implicate HIPAA if Gusto acts as a business associate for a covered entity (such as a health insurance plan administrator). If Gusto is not itself a covered entity or business associate, health data collected on its platform may fall outside HIPAA protections and be governed instead by CCPA/CPRA's sensitive personal information framework, FTC Act, and applicable state health privacy laws. HHS Office for Civil Rights enforces HIPAA; the CPPA enforces CPRA sensitive data rights. 2) GOVERNANCE EXPOSURE: High. The ambiguity in Gusto's HIPAA status for benefits data creates material compliance uncertainty. If Gusto processes Protected Health Information as a business associate without an executed BAA, both Gusto and the employer-covered entity face significant regulatory exposure. Employers should confirm BAA status before enabling benefits administration features. 3) JURISDICTION FLAGS: California CPRA classifies health data as sensitive personal information subject to enhanced rights including the right to limit use and disclosure. Several states including Washington (My Health MY Data Act) and Nevada have enacted health-specific privacy laws that may apply to benefits data processed outside of HIPAA. Illinois and New York also have state health data protections applicable to employment contexts. 4) CONTRACT AND VENDOR IMPLICATIONS: Employers who use Gusto for benefits administration should confirm whether a Business Associate Agreement is in place if any PHI flows through the platform. The absence of a BAA where one is legally required could expose both Gusto and the employer to HHS OCR enforcement. Procurement teams should verify BAA status as part of vendor onboarding. 5) COMPLIANCE CONSIDERATIONS: Legal and compliance teams should conduct a HIPAA applicability analysis for each benefits administration feature used through Gusto. Where BAAs are required, they should be executed before data flows begin. CPRA sensitive data rights obligations should be documented and operationalized for California employees' health benefits data regardless of HIPAA applicability.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Health and benefits data is among the most sensitive personal information category, and its collection by a payroll platform creates potential obligations under HIPAA and heightened risks if exposed.
Your health plan enrollment, FSA elections, and related medical benefits information is collected and processed by Gusto, a payroll company, which means your health-related data is held outside of a traditional healthcare provider relationship and may have different legal protections depending on Gusto's HIPAA status.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Gusto.