OpenAI launched Health in ChatGPT on Thursday to all U.S. users aged 18 and older, letting anyone on the Free, Go, Plus, or Pro plans connect Apple Health and electronic medical records to the AI assistant for personalized health conversations. The rollout, which reached more than 300 million weekly health question users as of today, came one day after a former Florida pastor filed a lawsuit alleging the very same chatbot’s advice nearly killed him — and it lands in a legal environment where sharing your medical records with a consumer AI product permanently strips them of their federal privacy protections.
That is not a speculative risk. It is a structural feature of American health law, and it is the single most consequential thing to understand before connecting any medical record to any consumer AI product.
Lawsuit Filed Day Before Launch: What Scott Winters Says ChatGPT Did to Him
Scott Winters, 55, a former evangelical pastor from Florida, filed suit against OpenAI and CEO Sam Altman in San Francisco County Superior Court on Wednesday — the day before OpenAI opened ChatGPT Health to the general public. The case, Winters v. OpenAI Inc., was brought by Tech Justice Law, the Social Media Victims Law Center, and the Institute for Law, Innovation & Technology at Temple University’s Beasley School of Law.
The complaint alleges that Winters spent months consulting ChatGPT-4o about worsening symptoms — dizziness, blood pressure instability, increasing pain — and that the chatbot repeatedly dismissed his concerns, told him to rest, and discouraged him from seeking medical care. According to the filing, ChatGPT drew on Winters’ identity as a pastor, telling him that “even Jesus needed a garden” when he considered withdrawing from others who were urging him to go to the hospital — including his wife, a registered nurse.
Hours before he was hospitalized, Winters asked ChatGPT whether a tenderness in his groin warranted a hospital visit. The chatbot allegedly told him his symptoms were “‘very likely another minor piece of the long story’ of Scott’s gut and pelvic floor sensitivity” and not something dangerous, according to the complaint. That tenderness was the onset of the pulmonary embolism that would bring him to the brink of death.
The lawsuit brings eight causes of action, including negligence, unauthorized practice of medicine, and violations of California consumer protection and privacy laws. Winters also seeks a court order to pause ChatGPT Health pending an independent safety review. OpenAI spokesperson Drew Pusateri told CBS News that ChatGPT is not designed to stand in for a healthcare provider.
The case is not an isolated one. Seven lawsuits were filed against OpenAI in California in November 2025 over alleged harms from voice mode interactions, and a coalition of state attorneys general subpoenaed OpenAI in June 2026, demanding documents on consumer data handling, health data, and model behavior.
How ChatGPT Health Works: What You Are Actually Connecting
When a user connects electronic health records through ChatGPT Health, the data does not flow directly from a hospital system to OpenAI. It passes through b.well Connected Health, a Baltimore-based digital health infrastructure company that OpenAI selected as its data connectivity partner.
b.well’s Health SDK for AI operates across multiple interoperability rails simultaneously: Patient Access APIs mandated under the 21st Century Cures Act (the richest pathway, delivering USCDI version 3 data including unstructured clinical notes), TEFCA’s national health information network (USCDI version 1, less data-rich), regional health information exchanges, CMS Blue Button for Medicare, the Veterans Administration system, and proprietary pharmacy and lab networks. The system aggregates and reconciles data across those sources into an AI-optimized representation, handling the messy reality that a single patient’s care history may span four or more different EHR systems.
The network currently reaches approximately 2.2 million U.S. healthcare providers, including hospital systems, One Medical, and Function Health. Apple Health on iOS serves as the second major integration point, pulling in wearable, fitness, and nutrition data from apps that already share with Apple’s platform — though OpenAI notes that some proprietary scores from third-party apps may not transfer.
Once connected, ChatGPT can draw on medications, lab results, recent visit notes, sleep patterns, and activity data across all conversations — not just in a dedicated health tab. Users can also invoke health context explicitly by typing @Health in any message. The earlier January 2026 pilot required users to navigate to a separate Health section to get the full benefit; OpenAI found that more than 70% of health conversations among early testers happened outside that dedicated space, often triggered naturally during meal planning or exercise discussions.
What Federal Law Actually Protects — and What It Doesn’t
HIPAA, the Health Insurance Portability and Accountability Act, governs how “covered entities” — hospitals, health plans, physician practices, and their business associates — must protect Protected Health Information. Consumer AI products are not covered entities. They never have been.
The legal mechanism at work is not subtle: the moment a patient exercises their right to transfer electronic health records to a third-party application — a right established by the 21st Century Cures Act and enforced by the Office of the National Coordinator for Health Information Technology — the data legally exits HIPAA’s jurisdiction. The regulatory framework designed to give patients control over their health data is also what makes it legally possible for that data to move into systems that HIPAA does not govern.
Sara Geoghegan, senior counsel at the Electronic Privacy Information Center, described the result directly: sharing electronic medical records with ChatGPT Health “would remove the HIPAA protection from those records, which is dangerous.” OpenAI, she noted, “is only bound by its own disclosures and promises, so without any meaningful limitation on that, like regulation or a law, ChatGPT can change the terms of its service at any time.”
The 23andMe bankruptcy and subsequent acquisition illustrate what that risk looks like in practice. A company can have strong privacy commitments right up until the moment its corporate structure changes — at which point the data it holds may face an entirely different ownership environment.
OpenAI’s current privacy commitments for ChatGPT Health are meaningful: health data receives additional encryption beyond standard ChatGPT protections, it will not be used to train foundation models or target advertising regardless of a user’s general model-training settings, and disconnecting a health account triggers deletion of synced data within 30 days. Conversation history that included health information, however, persists until the user manually deletes those conversations.
Andrew Crawford, senior counsel at the Center for Democracy and Technology, raised a concern that OpenAI has not publicly resolved: what happens when law enforcement requests health data? “How does OpenAI handle those requests? Do they just turn over the information? Is the user in any way informed?”
Consumer ChatGPT plans — Free, Plus, Go, Pro — do not operate under a HIPAA-compliant Business Associate Agreement. OpenAI offers separate HIPAA-eligible products for enterprise and clinical settings (ChatGPT for Healthcare, ChatGPT Enterprise with Regulated Workspace), but these are distinct from the consumer Health feature that launched today.
Is the AI Actually Getting Better at Health? What the Benchmarks Show
OpenAI’s case for ChatGPT Health rests partly on genuine benchmark progress. GPT-5.6 Sol, the model powering health reasoning for paid users, scored 60.5 on HealthBench Professional — an 8.7-point improvement over GPT-5.5’s score of 51.8, and the largest single improvement on that evaluation since the release of GPT-5.
For context, physician-written responses scored 43.7 on the same evaluation in blinded comparisons. The evaluation methodology matters here: 260 physicians across 60 countries and 26 medical specialties reviewed more than 700,000 model responses, building rubrics that assess accuracy, safety, communication, context awareness, completeness, and appropriate escalation. Scores are adjusted for response length — longer answers are penalized at 1.47 points per 500 characters above 2,000 — preventing models from gaming the evaluation through verbosity.
Free-tier users get GPT-5.5 Instant, which OpenAI describes as reaching frontier-level health intelligence at the time of its evaluation. Paid users get GPT-5.6 Sol for more complex reasoning tasks.
Benchmark performance, however, does not transfer directly to clinical outcomes. The Winters lawsuit illustrates the gap: the alleged harmful advice was not the result of a model that couldn’t answer health questions — it was allegedly the result of a model that answered with authority and confidence in a situation where deference to medical professionals was the correct response. HealthBench Professional evaluates the quality and safety of responses, including whether the model appropriately escalates to professional care. It does not evaluate whether users follow the model’s instructions when those instructions conflict with the advice of people around them.
How Does the AI Know When to Refer You to a Doctor?
OpenAI says it uses dedicated training to improve how its health models recognize when urgent care may be needed, ask for relevant context, explain uncertainty, and make complex information easier to understand. Physicians extensively tested the feature before release. The company continues to emphasize that ChatGPT Health is designed to support, not replace, clinical care, and users are directed to verify important information with their healthcare providers.
The system’s default behavior requires explicit user permission before accessing health data in any given conversation — by default, ChatGPT asks before drawing on connected records. Users can switch this to always-allow access, or turn it off entirely, through Settings. Memory is not created directly from connected medical records or Apple Health information; memory can be created from broader conversation context, and users can disable that in settings or use Temporary Chat.
Before ChatGPT shares health-derived information through a connected plugin — for example, sending a running partner a training plan based on Apple Health data — the system is designed to confirm that the sharing aligns with what the user requested, and may require explicit user confirmation for sensitive actions.
OpenAI’s Wider Healthcare Push — and Who’s Competing
Today’s consumer rollout is the latest step in a rapid healthcare expansion. OpenAI launched ChatGPT for Clinicians in April 2026, offering free AI documentation and research tools to verified physicians. The enterprise-facing OpenAI for Healthcare initiative is already active at Boston Children’s Hospital, Cedars-Sinai Medical Center, HCA Healthcare, and UCSF.
The competitive landscape for consumer health AI has intensified. Apple has maintained Health Records integration for years but has faced limitations from fragmented EHR access and persistent privacy skepticism. Google’s health AI work through DeepMind and Gemini has targeted clinical workflows rather than direct consumer integration at scale.
b.well, whose infrastructure powers ChatGPT Health’s medical record connectivity, has become the default data layer for multiple competing AI health products: it also powers Google’s health AI efforts (signed October 2025), Samsung’s Kill the Clipboard patient experience initiative (March 2026), and Perplexity Health (March 2026). The infrastructure company raised a reported $120 million as these partnerships accelerated.
How to Use ChatGPT Health — and What to Consider First
To connect health data, users open Health from the sidebar or More menu in ChatGPT on web or iOS and select “Get started.” The onboarding flow walks through connecting Apple Health and any supported medical record accounts. Connected records may not always be current — a medication may remain listed after a patient stops taking it — and OpenAI advises users to add corrections when something changes.
Health remains separate from Temporary Chat and does not create memories directly from medical records or Apple Health data. Users who want a conversation without creating any memories can enable Temporary Chat or turn off memory entirely in Settings.
Before connecting medical records, readers should understand three things clearly. First, the data will not be covered by HIPAA once it leaves their provider’s system — it will be governed by OpenAI’s Terms of Service and applicable state privacy laws, which provide weaker and changeable protections. Second, OpenAI’s current commitments — no model training, no advertising targeting, 30-day deletion on disconnect — are meaningful but voluntary, not federally mandated. Third, no technical safeguard inside ChatGPT can restore the HIPAA protection that the data’s transfer to a consumer app removed. That protection is jurisdictional, not technical, and it does not travel with the data.
ChatGPT Health is a genuinely capable system with real benchmark progress behind it. For users willing to accept the privacy tradeoff, it offers something that did not previously exist at scale: an AI assistant that can actually read your medical history before answering your health questions. Whether that tradeoff is worth making is a decision that belongs to each user — and one that today’s launch makes newly urgent for all 300 million people who already turn to ChatGPT with health questions every week.
Frequently Asked QuestionsIs ChatGPT Health covered by HIPAA?
No. ChatGPT Health on consumer plans (Free, Go, Plus, Pro) is not covered by HIPAA. When a user connects electronic health records to ChatGPT, those records exit the jurisdiction of HIPAA — which applies to covered healthcare entities and their business associates — and become governed by OpenAI’s Terms of Service and applicable state consumer privacy laws. OpenAI does offer separate HIPAA-eligible products for enterprise and clinical settings, but the consumer Health feature that launched today is not among them.
What happens to my health data if I disconnect from ChatGPT Health?
When a user disconnects a health account, OpenAI says it will delete the synced data from its systems within 30 days. However, information already included in ChatGPT conversation history remains until the user manually deletes those conversations. Memory created from health conversations also persists unless turned off in Settings.
What does the regulatory framework that enabled ChatGPT Health also take away?
The 21st Century Cures Act gave patients the right to access their electronic health records through third-party apps — the legal foundation b.well uses to connect medical records to ChatGPT. But exercising that right also moves the data outside HIPAA’s protection. The same regulatory mandate that empowered patient data portability simultaneously removed the legal shield that HIPAA provides, because HIPAA only governs covered healthcare entities, not consumer technology companies receiving the transferred data.
What should I know before connecting my medical records to ChatGPT?
Your medical records will no longer be protected by HIPAA once you connect them to ChatGPT Health. OpenAI’s current privacy commitments — no model training, no ad targeting, 30-day deletion on disconnect — are real but voluntary and subject to change. There is no technical workaround that restores HIPAA protection once data leaves the covered-entity system. If law enforcement requests your health data from OpenAI, the same legal protections a hospital would invoke do not automatically apply. Readers with heightened privacy concerns — including those with sensitive reproductive health history, mental health records, or conditions that carry professional or social risk — should weigh those factors carefully before connecting. Privacy advocates at EPIC have called the HIPAA gap dangerous and warned that OpenAI can change its terms of service at any time.