Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that HIPAA governs identifiable member and patient information through a separate Notice of Privacy Practices, which supersedes this privacy policy in cases of conflict. Oscar also states that its HIPAA-regulated status exempts it from certain state privacy laws that provide carve-outs for HIPAA-covered entities or information.
This analysis describes what Oscar Health's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationally limits the scope of state consumer privacy rights, including CCPA access, correction, and deletion rights, for personal information that qualifies as Protected Health Information under HIPAA; members seeking to exercise state law privacy rights over health-related data held by Oscar may be directed to the HIPAA Notice of Privacy Practices process instead.
Interpretive note: The precise boundary between PHI and non-PHI personal information collected through Oscar's Sites is not defined in this policy, creating some ambiguity about which data categories are subject to the HIPAA carve-out.
Under this provision, state-law privacy rights such as deletion or access requests may not apply to identifiable health information Oscar holds as a HIPAA-covered entity; those rights are governed instead by the separate HIPAA Notice of Privacy Practices. This means the scope of actionable consumer privacy rights under state statutes may be narrower for members whose data is classified as PHI.
Cross-platform context
See how other platforms handle HIPAA Supersession of State Privacy Rights and similar clauses.
Compare across platforms →Monitoring
Oscar Health has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Identifiable member and patient information we collect will be treated as Protected Health Information ('PHI') through the Services and the applicable Notice of Privacy Practices will apply and supersede this Notice in the event of any conflict... Note: Oscar is subject to federal privacy laws under HIPAA as described in our Notice of Privacy Practices, and it is therefore not subject to certain state privacy laws that exempt HIPAA-regulated organizations and/or HIPAA-covered information.Excerpt from Oscar Health's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly implicates HIPAA, enforced by HHS Office for Civil Rights, and the interaction between HIPAA's preemption framework and state consumer privacy statutes including CCPA, CPRA, and analogous laws in the approximately eighteen additional states named in the policy. Many state privacy statutes explicitly exempt HIPAA-covered entities or HIPAA-regulated data from their requirements; the policy relies on this exemption. HHS OCR is the primary enforcement authority for HIPAA privacy obligations. 2) GOVERNANCE EXPOSURE: High. The HIPAA carve-out has significant operational implications for how Oscar processes and responds to state-law consumer privacy requests. If data classification as PHI versus non-PHI personal information is not clearly defined and consistently applied, members may receive inconsistent or legally insufficient responses to privacy rights requests. The boundary between PHI and non-PHI personal information collected through the Sites is not fully defined in this policy. 3) JURISDICTION FLAGS: California's CPRA exempts HIPAA-covered information from CCPA requirements, as do the privacy statutes in most of the other named states. However, the precise scope of the exemption may vary by state, and compliance teams should verify that the HIPAA carve-out is applied consistently with the specific exemption language in each named state's statute. 4) CONTRACT AND VENDOR IMPLICATIONS: Business associates handling PHI must operate under HIPAA Business Associate Agreements; compliance teams should verify that all vendors receiving health-adjacent data from Oscar's Sites are appropriately classified and that BAAs are in place where required. Vendors receiving non-PHI personal information under this policy are governed by its general service provider contractual protection requirement. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain a clear data classification matrix distinguishing PHI from non-PHI personal information collected through Oscar's Sites to ensure that privacy rights requests are routed to the correct framework and response process. The policy's acknowledgment that it provides 'certain access, correction and opt-out services' beyond HIPAA requirements should be documented to confirm which rights apply to which data categories. HHS OCR complaint processes should be communicated to members whose health data requests are denied.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision operationally limits the scope of state consumer privacy rights, including CCPA access, correction, and deletion rights, for personal information that qualifies as Protected Health Information under HIPAA; members seeking to exercise state law privacy rights over health-related data held by Oscar may be directed to the HIPAA Notice of Privacy Practices process instead.
Under this provision, state-law privacy rights such as deletion or access requests may not apply to identifiable health information Oscar holds as a HIPAA-covered entity; those rights are governed instead by the separate HIPAA Notice of Privacy Practices. This means the scope of actionable consumer privacy rights under state statutes may be narrower for members whose data is classified as …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oscar Health.