Consumer Tech

Health Records Change Law the Moment They Move

OpenAI's ChatGPT Health connects American medical records and Apple Health. US law protects the holder of a record; European law protects the record itself. That difference sets your obligations.

Consumer TechBy Servola Tech Desk2026-07-274 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Health Records Change Law the Moment They Move

Key takeaways

American health privacy law binds hospitals, insurers and their contractors rather than the data itself, so a record copied into a consumer product leaves that protection behind and is governed by the product's terms, while the same record in Europe stays special category data under Article 9 of the GDPR wherever it travels.
ChatGPT Health opened on 23 July to logged-in users aged 18 and over in the United States only, on web and iOS, and OpenAI has announced no launch date for Europe, which tells you the legal difference is a shipping constraint rather than a talking point.
If any tool your staff use can ingest health information, write an Article 9 condition and a data protection impact assessment before the tool arrives, because in Europe the duty attaches the moment the data is processed and not when a regulator asks.
Do not rely on employee consent as your lawful basis for anything health related at work, since the imbalance between employer and employee means that consent is rarely accepted as freely given.

A product that stops at the American border

On 23 July an ordinary ChatGPT user in the United States could, for the first time, put a hospital record and a fitness tracker into the same chat window. OpenAI began rolling out Health to logged-in users aged 18 and over on web and iOS, across the Free, Go, Plus and Pro tiers. The feature connects electronic medical records and Apple Health, along with services including Function, MyFitnessPal, Weight Watchers, AllTrails, Instacart and Peloton, and it can compare laboratory results over time, summarise what changed since an appointment, and identify patterns across sleep and activity.

Why it matters: the privacy terms are unusually explicit. Conversations are encrypted in transit and at rest, connected health information carries additional encryption, and OpenAI states that connected medical records, Apple Health data and the conversations that use them are not used to train its foundation models or to target advertising, regardless of the model training setting a user has chosen. By default the assistant asks permission before drawing on a connected record to personalise an answer.

None of that is the interesting part. The interesting part is the map. The feature is available in the United States and nowhere else, with no announced European date and no Android timetable. A company that ships to a hundred countries at once chose to launch this one in a single jurisdiction, which is a statement about law rather than about engineering.

Two systems that protect different things

The American statute that governs health confidentiality binds a defined list of actors: providers, health plans, clearing houses and the contractors working on their behalf. It is a rule about custodians. When a patient exercises their right to obtain a copy of their own record and moves that copy somewhere else, the copy travels outside the ring of regulated custodians, and the receiving company is bound by whatever it has promised in its own terms rather than by the statute. OpenAI is not a provider, an insurer or a business associate, so it sits outside that ring by construction.

The European position is structurally different. Data concerning health is special category data under Article 9 of the General Data Protection Regulation, and the prohibition on processing it follows the data rather than the organisation holding it. A processor in Dublin, a start-up in Lisbon and a hospital in Munich are all subject to the same starting rule, and each needs a specific condition before it may process at all. Protection in the American model is a property of the holder. Protection in the European model is a property of the record.

Yes, but: the European position is not automatically the safer one for an individual. A patient in Rotterdam who genuinely wants to pool their own data faces friction that an American user does not, and friction has its own costs in care and in convenience. The point is not that one regime is kinder. It is that they allocate the duty to different parties, and an owner needs to know which party they are.

What to settle before this reaches your staff

Decide now whether health information may enter any assistant your organisation licenses. Occupational health reports, sickness absence records, return to work assessments, insurance correspondence and wellbeing app exports are all health data in the European sense, and they reach ordinary business tools far more often than most policies admit. Name the tools that are permitted to receive them, and name the ones that are not, in language a line manager can apply without calling legal.

Record an Article 9 condition and complete an impact assessment before deployment rather than after an incident. Large scale processing of special category data is one of the cases where an assessment is expected, and writing it early is the cheapest version of the work. It also produces the document a supervisory authority will ask for first, which turns a stressful request into an administrative one.

Treat employee consent as unavailable. Data protection authorities across the bloc have taken a consistent line that an employee cannot freely refuse an employer, so consent is a weak basis for anything health related in the workplace. Build on a different condition, document why you chose it, and make the tool work within that choice. An owner who settles this before a product ships to Europe is choosing the terms. An owner who settles it afterwards is accepting someone else's.

Frequently asked questions

Is this feature coming to the European Union?

OpenAI has not announced a European launch date, a rollout beyond web and iOS, or an Android timetable. Treat any specific European date you hear as unconfirmed until the company states one. The absence of a date is itself useful information for planning, because it suggests the work involved is legal rather than technical.

Our staff use consumer AI tools on personal devices. Does that make health data our problem?

It can. If an employee is acting in the course of their work and processing information your organisation controls, the obligation can follow the activity rather than the hardware. The practical control is not a device rule but a data rule: state clearly which categories of information may never be pasted into an unapproved tool, and make that instruction short enough to be remembered.

We are in the United Kingdom rather than the European Union. Does the same analysis apply?

In substance, yes. The United Kingdom retained the special category framework and the associated conditions after leaving the bloc, so health data carries the same elevated status and the same requirement for a specific condition. The regimes are diverging slowly on other points, but on this one an owner should plan as though the standard is the same.

The launch map is the disclosure here. A company able to ship globally chose one jurisdiction for this feature, and the reason is that European law protects the record itself rather than the institution holding it. That distinction is not a technicality waiting to be smoothed away. It is the design of the system, and an owner who builds around it now will not be renegotiating policy in the quarter the product finally crosses the Atlantic.

OpenAIChatGPT HealthApple HealthGDPRspecial category dataHIPAAhealth data

Europe Will Not Call This Ring a Wellness Gadget

Vital Signals opened preorders for the $399 Signal Ring on 16 July 2026. No EU or UK launch is announced. For European owners, the real question is classification under the Medical Device Regulation, and what an employer takes on under GDPR Article 9 when a wearable enters a staff programme.

7 min read

Consumer Tech

Even Realities Hit a Billion Without a Camera

Even Realities raised 150 million dollars from Meituan and Tencent at a one billion dollar valuation on 6 July 2026 for smart glasses that carry no camera. In Britain and across Europe, where camera wearables collide with data-protection law, the no-camera bet is the form factor an employer can actually approve.

3 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.