Why Security Experts Are Sounding the Alarm on OpenAI's New Medical Records Feature
ChatGPT Health bypasses federal privacy protections that safeguard patient data at hospitals and clinics, creating what cybersecurity researchers call a dangerous new target for hackers.
OpenAI's latest product launch is drawing sharp criticism from cybersecurity professionals who warn that uploading sensitive medical information to the company's new ChatGPT Health service could expose users to significant privacy and data breach risks. Unlike traditional healthcare providers, the AI-powered platform operates outside the regulatory framework that protects patient data in clinical settings, leaving users with minimal legal recourse if their information is compromised.
A Privacy Protection Gap
ChatGPT Health encourages users to upload medical records, test results, and connect fitness tracking devices to receive personalized health recommendations. However, the service is not classified as a healthcare provider and therefore falls outside the scope of HIPAA—the Health Insurance Portability and Accountability Act that establishes strict privacy standards for patient data at hospitals, clinics, and covered healthcare entities.
"Once you share that data, you can't get it back," warns Cori Faklaris, Assistant Professor at the University of North Carolina at Charlotte's College of Computing and Informatics. The absence of HIPAA protections means users have limited guarantees about how their sensitive health information will be handled, stored, or protected from unauthorized access.
The service partners with b.well, described as an "AI-powered digital health platform," creating what experts characterize as an additional potential vulnerability. Robert D'Ovidio, Associate Professor of Criminology and Justice Studies at Drexel University, notes that concentrating health data in these platforms creates "a larger target" for cyberattacks.
Financial Pressures and Regulatory Divides
The timing of ChatGPT Health's launch has raised additional concerns among security experts. Nathan Evans, Faculty Director of Cybersecurity at the University of Denver, points out that OpenAI is not currently profitable and is "hemorrhaging money to try to build bigger." This financial pressure could influence future decisions about data monetization or privacy policies, experts suggest.
Notably, ChatGPT Health is not launching in the European Union, which operates under GDPR—the General Data Protection Regulation, considered one of the world's most stringent privacy frameworks. The EU exclusion suggests potential regulatory obstacles that don't exist in the United States, where health data uploaded to non-HIPAA-covered services receives minimal federal protection.
The collapse of genetic testing company 23andMe, which filed for bankruptcy in early 2024, serves as a cautionary example of what can happen to user health data when companies face financial difficulties.
Industry Competition Intensifies
Days after OpenAI's announcement, competitor Anthropic launched Claude for Healthcare, signaling rapid expansion by AI companies into the health sector. Both platforms state that user health data will not be used for AI model training, and OpenAI claims the service employs "purpose-built encryption and isolation" with data segmentation to separate health information from general ChatGPT usage.
Despite these assurances, cybersecurity experts remain skeptical. The fundamental concern is that users uploading medical records to ChatGPT Health are creating a parallel healthcare information ecosystem that exists outside traditional regulatory protections, with uncertain long-term implications for data security and patient privacy.
Sources
Companies in this article
Reporting & accountability
How we maintain accuracy
Health AI Central separates reported facts, analysis, and public-source data. Readers can review our standards, request a correction, or consult the relevant research methodology before relying on a claim.