CCPA Compliance for Healthcare and Digital Health
The data HIPAA doesn't cover — wellness apps, marketing, and consumer health tech
HIPAA covers PHI held by covered entities — not the wellness app data, website analytics, marketing lists, and employee records that surround it. For digital health companies outside HIPAA entirely, the CCPA is the primary privacy law, and California treats consumer health data as maximally sensitive. TruePrivacy governs the non-HIPAA estate.
What CCPA requires of healthcare
The HIPAA exemption has edges
PHI under HIPAA is exempt, but marketing databases, non-covered app data, and website tracking on health pages are fully in scope.
Health data as sensitive PI
Health information outside HIPAA — symptoms logged in apps, condition-based segments, purchase signals — triggers the right to limit use.
Tracking on health properties
Pixels on symptom checkers, condition pages, and patient portals have driven enforcement and litigation — sharing health-adjacent browsing is high-risk.
Consumer rights on non-PHI data
Know, delete, and correct requests apply to the marketing, analytics, and wellness estate — with medical-records exceptions only where HIPAA actually applies.
Employee and applicant health data
Occupational health, leave, and accommodation records in HR systems carry consumer rights with employment-specific exceptions.
Vendor chains around care
Analytics, engagement, and advertising vendors touching health-adjacent data need service-provider contracts — or the disclosure is a sale.
How TruePrivacy helps
HIPAA boundary mapping
Every data store tagged PHI-exempt or CCPA-in-scope with the covered-entity analysis documented — the foundation of a defensible dual posture.
Sensitive health-data controls
Non-HIPAA health signals classified as sensitive PI with use-limitation enforcement and the Limit link deployed where required.
Health-property tag governance
Continuous scanning of portals, symptom pages, and apps for tags transmitting health-adjacent data — the exposure behind recent enforcement.
Rights automation with split responses
Requests fulfilled across marketing and wellness systems, with HIPAA-governed records routed to your existing HIPAA processes and the split explained.
Service-provider contract enforcement
Vendor classifications and CCPA-required terms tracked across your engagement stack, so no disclosure quietly becomes a sale.
“The pixel litigation wave hit two of our competitors before we found TruePrivacy. Their scanner caught an analytics tag on our appointment-booking flow the same week we deployed it — that single catch justified the platform. Our HIPAA and CCPA estates finally have a documented boundary.”
Frequently asked questions
We're HIPAA-compliant. Doesn't that cover CCPA?
No — HIPAA exempts PHI held as a covered entity or business associate, and nothing else. Your marketing lists, wellness app data, website analytics, and employee records are CCPA territory. TruePrivacy maps the boundary and runs the CCPA programme on the non-exempt side.
Is our wellness app data 'sensitive personal information'?
Health data collected outside HIPAA — symptoms, cycles, medications, mental-health logs — is sensitive PI under the CPRA, triggering use limitation and heightened scrutiny. TruePrivacy classifies it, enforces the limits, and deploys the required consumer controls.
Can we run advertising pixels on our patient portal?
Transmitting health-adjacent browsing to ad platforms has produced regulatory action and a wave of wiretapping litigation — treat it as presumptively prohibited without airtight service-provider terms and consent. TruePrivacy's tag governance detects these transmissions before plaintiffs' counsel does.
How do deletion requests work across the HIPAA boundary?
CCPA deletion applies to in-scope data; HIPAA-governed records follow HIPAA's own rules and are exempt from CCPA deletion. TruePrivacy splits each request automatically, deletes the marketing and wellness estate with evidence, and explains the medical-record boundary to the consumer.
Get CCPA-ready
Book a 30-minute demo and see how TruePrivacy handles CCPA compliance for healthcare.
Free 14-day trial · No credit card required · Setup in minutes