HIPAA Non-Covered-Entity Disclaimer

What it is

The agreement asserts that Hims & Hers as the direct platform operator is not a HIPAA covered entity, and acknowledges that affiliated Labs, Pharmacies, and Medical Groups may or may not be covered entities or business associates under HIPAA. This means health information provided to Hims & Hers directly may not receive HIPAA protections as applied to the platform operator.

Why it matters (compliance & governance perspective)

This provision establishes that health and medical information processed by Hims & Hers as the platform operator is not subject to HIPAA protections as applied directly to that entity, while acknowledging uncertainty about the HIPAA status of affiliated clinical partners. Legal and compliance teams should evaluate whether applicable state health data privacy laws and FTC health breach notification rules provide alternative protections for health data processed outside the HIPAA framework.

Consumer impact (what this means for users)

Under this clause, health information submitted to Hims & Hers through the platform is not protected by HIPAA as applied to Hims & Hers directly, and the agreement acknowledges that affiliated clinical partners may or may not be HIPAA-covered entities. The Privacy Policy governs how Hims & Hers collects, uses, and discloses personal and health information it processes as the platform operator.

Institutional analysis (regulatory & governance intelligence)

REGULATORY LANDSCAPE: This provision directly engages HIPAA and its implementing regulations, specifically the Privacy Rule and Security Rule administered by HHS Office for Civil Rights. The FTC Health Breach Notification Rule applies to vendors of personal health records and non-HIPAA-covered entities that handle health information, and may impose breach notification obligations on Hims & Hers regardless of its HIPAA status assertion. State health data privacy statutes, including Washington's My Health MY Data Act and analogous laws in Nevada, Connecticut, and other states, impose obligations on entities that collect consumer health data outside the HIPAA framework. GOVERNANCE EXPOSURE: High. The assertion that Hims & Hers is not a HIPAA covered entity while operating a platform that collects detailed health, mental health, and prescription information creates significant regulatory exposure if the assertion is incorrect or if state health data privacy laws impose comparable obligations that are not addressed in current disclosures. The document notes that the excerpt was truncated, introducing additional uncertainty about what disclosures follow the HIPAA disclaimer. JURISDICTION FLAGS: Washington state's My Health MY Data Act applies broadly to consumer health data collected outside the HIPAA framework and may impose consent, data mapping, and breach notification obligations. California's Confidentiality of Medical Information Act and CCPA sensitive data provisions create additional obligations for health data processed by non-HIPAA-covered entities. Illinois, Nevada, and Connecticut have enacted analogous health data protections. CONTRACT AND VENDOR IMPLICATIONS: The uncertainty about whether affiliated Labs, Pharmacies, and Medical Groups are HIPAA covered entities or business associates creates a vendor governance gap. Business associate agreement status between Hims & Hers and affiliated clinical partners should be evaluated to determine whether data sharing between the platform and clinical partners is governed by HIPAA business associate requirements or alternative contractual frameworks. COMPLIANCE CONSIDERATIONS: Legal teams should conduct a current HIPAA applicability analysis to assess whether Hims & Hers's direct operations meet the definition of a covered entity or business associate given the nature of health data processed and the relationships with affiliated clinical partners. FTC Health Breach Notification Rule applicability should be assessed independently of the HIPAA covered-entity question. Data mapping should identify all health data flows between Hims & Hers and affiliated Labs, Pharmacies, and Medical Groups to determine applicable regulatory obligations in each state of operation.

Applicable agencies

Provision details

Other risks in this policy

• Disclosure Required When Interacting With AI Chatbot medium
• Agreement Revisions Effective Upon Posting high
• Arbitration Opt-Out Within Thirty Days high
• Binding Arbitration Agreement All Disputes high
• Class Action Waiver Jury Trial Waiver high
• Disclaimer Of All Warranties Including Implied Warranties high