The policy states that Hims & Hers is not a HIPAA covered entity, acknowledges it may in some cases function as a HIPAA business associate, and notes that HIPAA protections may not apply to user transactions depending on the specific service and entity involved.
This analysis describes what Hims & Hers's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that the full range of HIPAA protections does not apply to all user interactions with the Hims & Hers platform, and that the applicability of HIPAA depends on the specific transactional context, creating a variable protection landscape across the company's telehealth, pharmacy, and consumer wellness services.
Interpretive note: The specific transactions and service contexts in which Hims & Hers operates as a HIPAA business associate are not fully enumerated in the policy, and the practical scope of HIPAA protection for any given user interaction requires case-specific assessment.
The agreement states that HIPAA may not apply to transactions or communications with Hims & Hers, the Medical Groups, the Providers, the Labs, or the Pharmacies depending on context, and that information not qualifying as Protected Information under applicable law is governed by the Privacy Policy rather than HIPAA. The scope of HIPAA protection applicable to any specific user interaction depends on which entities and services are involved.
Cross-platform context
See how other platforms handle HIPAA Business Associate Status Disclosure and similar clauses.
Compare across platforms →"Hims & Hers is not a 'covered entity' under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and its related regulations and amendments from time to time (collectively, 'HIPAA'). One or more of the Labs, Pharmacies or Medical Groups (as defined in our Terms and Conditions) may or may not be a 'covered entity' or 'business associate' under HIPAA, and Hims & Hers may in some cases be a 'business associate' of a Pharmacy or Medical Group. It is important to note that HIPAA does not necessarily apply to an entity or person simply because there is health information involved, and HIPAA may not apply to your transactions or communications with Hims & Hers, the Medical Groups, the Providers, the Labs, or the Pharmacies.Excerpt from Hims & Hers's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that the full range of HIPAA protections does not apply to all user interactions with the Hims & Hers platform, and that the applicability of HIPAA depends on the specific transactional context, creating a variable protection landscape across the company's telehealth, pharmacy, and consumer wellness services.
The agreement states that HIPAA may not apply to transactions or communications with Hims & Hers, the Medical Groups, the Providers, the Labs, or the Pharmacies depending on context, and that information not qualifying as Protected Information under applicable law is governed by the Privacy Policy rather than HIPAA. The scope of HIPAA protection applicable to any specific user interaction …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Hims & Hers.