The policy states that HIPAA governs identifiable member and patient information through a separate Notice of Privacy Practices, which supersedes this privacy policy in cases of conflict. Oscar also states that its HIPAA-regulated status exempts it from certain state privacy laws that provide carve-outs for HIPAA-covered entities or information.
This analysis describes what Oscar Health's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationally limits the scope of state consumer privacy rights, including CCPA access, correction, and deletion rights, for personal information that qualifies as Protected Health Information under HIPAA; members seeking to exercise state law privacy rights over health-related data held by Oscar may be directed to the HIPAA Notice of Privacy Practices process instead.
Interpretive note: The precise boundary between PHI and non-PHI personal information collected through Oscar's Sites is not defined in this policy, creating some ambiguity about which data categories are subject to the HIPAA carve-out.
Under this provision, state-law privacy rights such as deletion or access requests may not apply to identifiable health information Oscar holds as a HIPAA-covered entity; those rights are governed instead by the separate HIPAA Notice of Privacy Practices. This means the scope of actionable consumer privacy rights under state statutes may be narrower for members whose data is classified as PHI.
Cross-platform context
See how other platforms handle HIPAA Supersession of State Privacy Rights and similar clauses.
Compare across platforms →"Identifiable member and patient information we collect will be treated as Protected Health Information ('PHI') through the Services and the applicable Notice of Privacy Practices will apply and supersede this Notice in the event of any conflict... Note: Oscar is subject to federal privacy laws under HIPAA as described in our Notice of Privacy Practices, and it is therefore not subject to certain state privacy laws that exempt HIPAA-regulated organizations and/or HIPAA-covered information.Excerpt from Oscar Health's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly implicates HIPAA, enforced by HHS Office for Civil Rights, and the interaction between HIPAA's preemption framework and state consumer privacy statutes including CCPA, CPRA, and analogous laws in the …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision operationally limits the scope of state consumer privacy rights, including CCPA access, correction, and deletion rights, for personal information that qualifies as Protected Health Information under HIPAA; members seeking to exercise state law privacy rights over health-related data held by Oscar may be directed to the HIPAA Notice of Privacy Practices process instead.
Under this provision, state-law privacy rights such as deletion or access requests may not apply to identifiable health information Oscar holds as a HIPAA-covered entity; those rights are governed instead by the separate HIPAA Notice of Privacy Practices. This means the scope of actionable consumer privacy rights under state statutes may be narrower for members whose data is classified as …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oscar Health.