The Health Insurance Portability and Accountability Act (HIPAA) sets privacy and security standards for certain health care organizations, but it does not automatically cover every health, fitness, or AI app. Federal regulators have proposed stronger security requirements, including multi-factor authentication, encryption, testing, and monitoring, but those changes are not in effect yet.