NEW YORK, NY. (WOWO) — The blood pressure reading you take at home could reveal more than just your health status.

Depending on the device, app, privacy settings and companies involved, information from blood pressure monitors, glucose meters, smart scales and medication apps can be stored online or shared with third-party service providers. Some federal investigations have found that health-related information was disclosed to advertising and analytics companies.

A recent report from Fox News’ CyberGuy Kurt Knutsson warns consumers that health information collected through everyday apps and connected devices may not always receive the same legal protections as medical information held by a doctor’s office.

The issue largely comes down to who has the data and why they have it.

HIPAA protects certain health information maintained by covered health care providers, health plans and their business associates. But a consumer who downloads a health or fitness app independently cannot necessarily assume the same HIPAA protections apply.

Knutsson reports that some consumer health apps can instead fall under other federal and state privacy protections, including the Federal Trade Commission’s Health Breach Notification Rule and state consumer privacy laws.

That distinction can matter when information such as blood pressure readings, blood sugar levels, weight, medication schedules or other health-related details are collected by a commercial app.

Federal regulators have already taken action against several major health-related companies over alleged data-sharing practices.

GoodRx agreed to pay a $1.5 million civil penalty to settle Federal Trade Commission allegations involving the disclosure of health information to companies including Facebook and Google. The FTC alleged that information connected to consumers who purchased certain medications, including drugs for heart disease and high blood pressure, was used in connection with advertising.

BetterHelp agreed to pay $7.8 million following FTC allegations that the online counseling service shared information including email addresses, IP addresses and answers to personal health questions with advertising companies.

The FTC also took action involving Flo Health, the developer of a popular fertility and menstrual-tracking app. Regulators alleged the company shared sensitive health information from millions of users with Facebook, Google and other analytics providers.

In another case, the developer of the Premom fertility app agreed to pay $200,000 to resolve federal and state allegations concerning its privacy practices. The FTC alleged that sensitive health and location information was disclosed to Google and two China-based analytics companies.

Those cases do not mean every health app is selling or improperly sharing information. They do show, however, why consumers should not automatically assume that a health-related app operates under the same privacy rules as their doctor.

The concern extends beyond individual apps and into the data broker industry.

Knutsson’s report points to research involving Duke University in which a researcher contacted 37 data brokers while posing as a potential customer. Twenty-six brokers responded, and 11 indicated they were willing and able to sell mental health-related information.

Some of the information being marketed included details associated with conditions such as depression and anxiety, along with demographic information. The report said one broker advertised names and postal addresses associated with particular health conditions.

The prices varied, from hundreds of dollars for aggregated information to annual licensing arrangements costing tens of thousands of dollars.

Health-related data can extend well beyond mental health. Federal regulators have documented data-broker categories involving conditions and interests such as pregnancy, diabetes and high cholesterol.

California regulators also took action against a data broker in December 2025. The state’s privacy regulator fined Datamasters $45,000 for allegedly failing to register as a data broker.

According to the enforcement order cited by Knutsson, the company had purchased and resold contact lists connected to sensitive conditions. The lists included hundreds of thousands of addresses associated with Alzheimer’s disease and more than two million associated with blindness or visual impairment, among other categories.

That information can become particularly concerning when it is used by scammers.

A criminal does not necessarily need to break into someone’s phone or hack a medical account to make a scam sound convincing.

A caller who already knows that someone has diabetes or high blood pressure could use that information to make a fake Medicare, insurance, pharmacy or medical-supply pitch sound legitimate.

One common scheme involves a caller claiming to represent Medicare or a diabetes organization and offering free glucose meters or test strips. The caller may then ask for a Medicare number or other personal information to supposedly process the shipment.

Federal officials have warned about scammers impersonating Medicare, Social Security and health organizations in similar schemes.

Another tactic could involve a caller mentioning a person’s medical condition before trying to sell an insurance plan or another service.

Knowing a real detail about someone’s health does not prove that a caller represents Medicare, a doctor, an insurance company or any other legitimate organization.

Health information could also be used to make supplement or pharmaceutical-related scams appear more personalized.

The information does not necessarily have to come directly from a health app. Data brokers can combine information from multiple sources, including commercial records, online activity, public records and information obtained from other companies.

That means consumers may not realize how many pieces of information are being combined into a profile.

Connected health devices can add another layer.

For example, certain OMRON blood pressure monitors can send readings to the OMRON Connect app through Bluetooth, allowing users to store and manage their heart-health history.

Dexcom’s products and services can also involve different privacy protections depending on how the product or service is provided. Some products supplied through insurance and health-care channels can fall under HIPAA, while other websites, programs and services may operate outside that specific HIPAA-covered relationship.

Withings says it does not share health information with advertising partners, although some non-health personal information may be used for tailored advertising. Users can also authorize outside apps and services to connect with their information.

Fitbit health and wellness information is subject to Google’s stated separation from Google Ads, following commitments associated with Google’s acquisition of Fitbit.

Apple’s Health app provides another example of how privacy protections can differ by platform. Apple says Health information is encrypted, and users control which apps can access individual categories of Health data. Apple also prohibits apps from using HealthKit information for advertising.

Medication-management services can have their own considerations. Medisafe, for example, says information may be shared with partner pharmacies or coupon companies when users choose certain pharmacy or coupon features.

The common thread is that consumers need to understand the specific privacy policy and settings attached to the app or device they are using.

There are several steps people can take to reduce the amount of health information shared through their phones.

On an iPhone, users can go to Settings, Privacy & Security and Tracking to disable requests from apps seeking permission to track activity. Apple’s advertising settings also provide controls related to personalized advertising.

On Android devices, advertising privacy controls are available through Google’s settings, although the exact menu names can vary depending on the phone and operating system.

Consumers should also open the privacy and account settings for each health app they use and look for controls related to advertising, marketing, third-party sharing and connected services.

Unused apps and connected accounts should be disconnected when possible.

Consumers can also look for privacy options labeled “Do Not Sell or Share My Personal Information,” “Your Privacy Choices” or similar language. The rights available vary depending on the state and the company’s circumstances, and an opt-out does not necessarily remove information that has already been collected.

That’s an important distinction.

Changing privacy settings can limit some future collection or sharing, but it does not automatically erase information that may already have been distributed to other companies.

Consumers can submit removal requests to data brokers and people-search websites, although the process can be time-consuming and often has to be repeated if information reappears.

The bottom line is that a connected health device can be useful for tracking medical information, but convenience comes with another consideration: understanding where that information goes once it leaves the device.

Knutsson’s report recommends that consumers review privacy settings, limit unnecessary sharing and remain skeptical of unexpected calls or messages that reference personal medical information.

If an unsolicited caller already knows a person’s medical condition, that should not be treated as proof that the caller is legitimate.

Instead, consumers should independently contact their doctor, insurer, Medicare or another organization using a verified phone number before providing personal, financial or medical information.

The goal is not necessarily to stop using health technology. It is to understand that a blood pressure cuff may be collecting information that becomes part of a much larger digital profile — one that could potentially be seen by companies, advertisers or criminals far beyond the doctor’s office.