ChatGPT Health: Trust Boundaries for Connected Medical Data

ChatGPT Health changes the risk model of consumer health AI. A one-off question exposes the text you type; a connected system can repeatedly draw on medical records, medications, labs, Apple Health data, and information from other wellness apps. The useful question is therefore not whether ChatGPT can summarize a lab result. It is whether every transition from source data to model inference, memory, disclosure, and deletion has a boundary you can inspect and control.

OpenAI launched the current connected experience on July 23, 2026 for eligible U.S. users aged 18 or older. It is a consumer information tool, not a diagnostic system or a replacement for professional care. This guide maps what OpenAI has documented, what those controls do not prove, and how to decide what to connect.

What the product can access

Eligible Free, Go, Plus, and Pro users can connect Apple Health, supported U.S. provider portals, One Medical, and Function Health. The feature works on web and iOS, while connecting Apple Health requires an iPhone. Voice mode and Codex do not currently support the connected Health plugin.

The connection is read-only. ChatGPT can use synced information to compare lab results, summarize changes, prepare questions for an appointment, or relate sleep and activity to a routine. It cannot update Apple Health or a provider's medical record.

Read-only access is a meaningful safety control because a mistaken summary cannot directly corrupt the source record. It does not make the answer clinically correct. An old medication, a missing unit, or a proprietary wearable score that did not transfer can still shape a plausible but wrong interpretation.

OpenAI explicitly warns that connected information may be incomplete or out of date. Users can mark conditions or medications as no longer current and add missing family history. That correction interface is part of the safety system, not optional housekeeping.

Five trust boundaries, not one privacy switch

Privacy discussions often collapse the system into a single question: Is the data encrypted? Encryption matters, but it covers only one boundary. A connected health assistant has at least five.

1. Source and provenance

The first boundary is between the original record and the copy ChatGPT receives. A trustworthy answer needs more than a value such as glucose 110. It needs the source organization, collection time, unit, reference range, record status, and any transformation performed by the connector.

FHIR Provenance provides a useful design baseline for recording who created or changed a resource, when it happened, and which activity produced it. OpenAI has not publicly documented complete, user-visible FHIR Provenance for ChatGPT Health, so it should be treated as an acceptance criterion rather than an implementation claim.

Before acting on an important answer, compare the cited value with the original portal or app. If the answer combines multiple records, ask which dates and sources support each conclusion.

2. Permission to invoke connected data

By default, ChatGPT asks before using connected medical records or Apple Health data in a conversation. A user can approve one request or choose always allow, which removes future prompts. Adding @Health explicitly asks ChatGPT to use that context.

This is an invocation boundary, not a storage boundary. The account may remain connected while a particular conversation is denied access. Conversely, always allow expands the number of ordinary conversations in which sensitive context may influence a response.

For occasional use, per-request permission is the safer default. Always allow is convenient for repeated health workflows, but it turns relevance judgment into an automated decision made inside a broad conversational environment.

3. Conversation and memory

The July experience allows connected Health information to inform conversations outside the dedicated Health tab. Conversations that use Health can create memories when memory is enabled, although OpenAI says memories are not created directly from the synced medical record or Apple Health data.

That wording creates an important distinction. A raw lab result may not directly become a memory, while a statement derived during the conversation, such as a sleep goal or dietary preference, can persist for future personalization.

Older Health Project chats retain project-only memory and do not automatically move into the new Health tab. Users who want stronger separation can still use a dedicated project, project-specific memory, Temporary Chat, or turn memory off.

Storage location, invocation scope, and memory scope are separate controls. Treating them as one setting makes deletion and disclosure difficult to reason about.

4. External disclosure and human access

OpenAI says connected medical records, Apple Health information, and conversations using them are not used to train foundation models or target advertising. The Health Privacy Notice also states that OpenAI does not sell this personal data.

Those commitments do not mean nobody can access or process the data. The notice says a limited number of authorized personnel and trusted service providers may access Health data for model safety unless the user opts out. It also permits processing for support, fraud prevention, security, legal obligations, cloud hosting, and related operations.

The product adds checks before another connected plugin takes an action that could disclose Health information, and some sensitive actions may require confirmation. OpenAI has not published a complete action taxonomy or false-positive and false-negative rates for those checks.

The practical rule is simple: review the destination as carefully as the source. A safe medical-record connection can still lead to an unintended disclosure if a later tool sends a derived plan, summary, or recommendation to another person or service.

5. Disconnection and deletion

Disconnecting an account causes synced data from that source to be deleted from OpenAI's systems within 30 days. Information already included in ChatGPT conversation history remains until those conversations are deleted.

This means three actions have different effects:

A complete exit therefore requires checking accounts, conversations, and memories separately. Public documentation does not promise immediate deletion from every processor, backup, or derived system, so avoid interpreting disconnect as an instant universal erase command.

HIPAA is a product boundary

Consumer ChatGPT Health is not intended for clinical or covered-entity use, does not offer a Business Associate Agreement, and is not HIPAA-eligible. OpenAI points healthcare organizations toward its healthcare and clinician products.

The distinction matters because HIPAA protection follows relationships and roles, not the medical nature of a file. The U.S. Department of Health and Human Services explains that when a consumer directs a covered entity to transmit data to an app that is neither a covered entity nor its business associate, the app's handling of that data generally falls outside the HIPAA Rules.

Data coming from a hospital does not automatically carry hospital-grade legal protection into every consumer application. Other state consumer-health laws, Federal Trade Commission authority, contracts, and company policies may still apply, but they form a different control regime.

Why better context can amplify errors

Connected data reduces one source of error: missing context. It also creates a longer error path:

1. A provider record or wearable contains an old, mislabeled, or missing value.
2. The connector omits a field, unit, or proprietary metric.
3. The model combines several records and produces an inference.
4. The inference enters an ordinary conversation.
5. The conversation creates a memory or affects a non-health recommendation.
6. Another plugin uses or shares the derived result.

Each step can preserve confidence while losing provenance. More context raises the ceiling for useful answers and the cost of a silent mismatch.

This is also why confidence calibration matters in AI-assisted decisions: a fluent answer should not outrank the source record, uncertainty, or the cost of being wrong.

OpenAI's HealthBench is a serious response-level evaluation. It uses 5,000 conversations and tens of thousands of physician-written rubric criteria to assess accuracy, safety, communication, context awareness, completeness, and appropriate escalation. It does not by itself test end-to-end record extraction, identity matching, unit conversion, permission state, deletion consistency, long-term memory, or external actions.

That gap suggests the correct verification target: evaluate the connected system, not only the final answer.

A practical acceptance checklist

Before connecting a full record, decide which problem requires it. You can ask health questions without connecting any source.

Use the smallest useful access scope:

• Keep per-request permission unless repeated use clearly justifies always allow.
• Connect only the providers and Apple Health categories required for the task.
• Review active conditions, medications, units, and dates after sync.
• Use Temporary Chat or a project with project-specific memory for sensitive, bounded work.
• Ask the model to identify source, date, and uncertainty for each important claim.
• Compare consequential values with the original portal or app.
• Treat diagnosis, treatment, medication changes, and urgent symptoms as professional-care decisions.
• Before disconnecting, review Health accounts, related chats, and memories as three separate stores.

For product teams evaluating any connected health assistant, add system-level tests for lineage, stale data, unit mismatches, cross-patient identity, permission changes, memory creation, external disclosure, and deletion propagation. A high answer-quality score is one layer of evidence, not the whole trust case.

Frequently asked questions

Is ChatGPT Health HIPAA compliant?

The consumer Health feature is not intended for covered-entity clinical use, does not offer a BAA, and is not described as HIPAA-eligible. Healthcare organizations need a product and contract designed for their regulatory role.

Does OpenAI train models on connected medical records?

OpenAI says connected medical records, Apple Health data, and conversations using that data are not used to train foundation models or target ads. Its Health Privacy Notice separately describes limited access by authorized personnel and service providers for safety and operational purposes.

What happens when I disconnect an account?

OpenAI says synced source data is deleted from its systems within 30 days. Health information already present in chat history remains until those conversations are deleted, and memories require separate management.

Can ChatGPT change my medical record?

No. The documented consumer experience is read-only. It cannot write back to provider records or Apple Health.

Should I connect my entire medical history?

Start from the task and expose the minimum data needed. For important decisions, verify source records and involve a qualified professional. Connected context improves continuity, while broader exposure increases the consequences of stale data, inference errors, and disclosure.

References

• OpenAI: Launching Health in ChatGPT
• OpenAI Help Center: Health in ChatGPT
• OpenAI Health Privacy Notice
• OpenAI HealthBench
• HHS guidance on access rights, apps, APIs, and HIPAA
• HL7 FHIR Provenance

Connected health AI deserves a stricter standard than a persuasive answer. The system should make it cheap to see where data came from, when it was used, what the model inferred, where the result traveled, and what deletion actually removed.