Privacy
HIPAA does not cover your AI agent, and that matters
Once you upload an EOB, the platform's privacy policy protects it, not the federal law.
This is the most important thing to understand before you hand medical documents to a consumer AI assistant.
What HIPAA actually covers
HIPAA covers healthcare providers, health insurers, and their business partners. It governs what those organizations may do with your information.
It does not cover the company running your personal AI assistant. As far as we found, none of the consumer assistants marketed to individuals offers a consumer HIPAA agreement.
What that means practically
Once you upload an EOB or a bill, that copy is protected by that company's privacy policy and your account settings, not by federal health privacy law. That may be perfectly fine for you. The point is to choose knowingly.
Steps that reduce risk
- Turn off training on your data where the platform allows it.
- Use a dedicated bill email and a dedicated agent or bot just for bills.
- Give the least access that works: read-only email first, one folder, no payment tools.
- Leave out medical detail the agent does not need. Codes, dates, and amounts are usually enough.
- Delete case files you no longer need.
- Check whether your provider publishes a warning against using their tool with health information, and follow it.
And do not hand over your Social Security number
Providers can usually verify you with your date of birth, address, account number, and member ID. If one insists on SSN digits, handle that part yourself. Never put an SSN in a letter.
This is general information, not legal advice, and platform policies change constantly. Verify current terms yourself.