Are AI health coaches and wearables regulated?

FDA draws the line at disease

An instrument, machine or similar article intended to diagnose disease or other conditions, to cure, mitigate, treat or prevent disease, or to affect the structure or any function of the body is a medical device, unless it achieves its primary purpose through chemical action or depends on being metabolized (21 U.S.C. 321(h)). Software for "maintaining or encouraging a healthy lifestyle" that is unrelated to the diagnosis, cure, mitigation, prevention or treatment of disease is excluded (21 U.S.C. 360j(o)), and FDA's general wellness guidance says it does not intend to examine whether low-risk wellness products are devices (FDA). A separate FDA software policy says it does not intend to enforce device requirements for low-risk apps that "coach patients with conditions such as cardiovascular disease, hypertension, diabetes, or obesity" without specific treatment suggestions (FDA).

The Jan. 6, 2026, revision of the wellness guidance, replacing the 2019 version, adds that products using non-invasive sensing to estimate blood pressure, oxygen saturation, blood glucose or heart rate variability may qualify if intended solely for wellness (FDA; FDA, 2019). They do not qualify if their labeling, advertising, interface or functions refer to specific diseases or diagnostic thresholds, prompt specific clinical action, or claim "clinical accuracy" or "medical or clinical grade." FDA may still consider a product a wellness product if it says evaluation by a health care professional may be helpful when readings fall outside wellness ranges, provided the notice names no disease or clinical threshold, does not call the reading abnormal, offers no diagnosis or treatment recommendation, and does not provide ongoing alerts or monitoring to manage a disease (FDA).

FDA classified Apple's ECG app, which identifies atrial fibrillation, as a Class II device in 2018 (FDA) and cleared Apple's hypertension notification feature on Sept. 11, 2025 (FDA). In July 2025 it told WHOOP that its Blood Pressure Insights feature was a device lacking required approval, because blood pressure estimation is "inherently associated with the diagnosis of hypo- and hypertension" (FDA). On June 17, 2026, citing WHOOP's changes and the revised guidance, FDA closed the warning letter, saying it does not intend to enforce device requirements for the modified feature (FDA).

The FTC covers health data

The Federal Trade Commission's Health Breach Notification Rule requires vendors of personal health records and related entities not covered by HIPAA to notify individuals, the FTC and sometimes the media of breaches (Federal Register). Amendments that took effect July 29, 2024, clarified that it covers, in the FTC's words, "health apps and connected devices like fitness trackers," and that an unauthorized disclosure counts as a breach (Federal Register; FTC; eCFR). In its first case under the rule, in 2023, the FTC said GoodRx would pay a $1.5 million civil penalty for not reporting its unauthorized disclosure of users' health information to Facebook, Google and others (FTC). Outside the rule, it has also ordered the counseling service BetterHelp to pay $7.8 million and stop sharing health data for advertising (FTC), and required Flo Health, a fertility-tracking app maker, to get users' affirmative consent before sharing health data (FTC).

HIPAA usually does not apply

HIPAA covers health plans, most health care providers, health care clearinghouses and their business associates; HHS says that in most cases it does not protect data a person enters into an app for personal use unless one of them provides the app (HHS). A developer whose app a doctor merely recommends is not a business associate, but one a provider contracts with for patient management services is (HHS).

State health data laws

Washington's My Health My Data Act and a Nevada law require consent to collect consumer health data and separate consent to share it, unless needed for a service the consumer requested, and authorization to sell it; both have applied since March 31, 2024 (June 30, 2024, for Washington's small businesses) (Washington; Attorney General; Nevada). Washington's definition includes "bodily functions, vital signs, symptoms, or measurements" and inferences drawn by "algorithms or machine learning," and consumers there may sue (Washington; Attorney General). Connecticut has barred selling consumer health data without consent since July 1, 2023 (Connecticut). Each exempts information or entities covered by HIPAA (Washington; Nevada; Connecticut).

State chatbot and AI therapy laws

• Illinois, since Aug. 1, 2025: no one may offer therapy or psychotherapy, "including through the use of Internet-based artificial intelligence," unless a licensed professional conducts it (Illinois; LegiScan).
• Nevada, since July 1, 2025: AI providers may not offer a system specifically programmed to provide what would be professional mental or behavioral health care if a person provided it (Nevada).
• Utah, since May 7, 2025: generative AI "mental health chatbots" must disclose that they are AI and not human, and suppliers may not sell or share users' identifiable health information or input, with limited exceptions (Utah).
• California, since Jan. 1, 2026: companion chatbot operators must disclose that the chatbot is not human when a reasonable person would be misled to believe it is human, and refer users expressing suicidal ideation or self-harm to crisis services (SB 243; Sen. Padilla).
• New York, since Nov. 5, 2025: AI companion operators must refer users expressing suicidal ideation or self-harm to crisis services and remind them at the start and at least every three hours that they are not talking to a human (GBL 1701; GBL 1702; N.Y. governor).

What is still open

An FDA advisory committee discussed generative AI mental health devices on Nov. 6, 2025 (FDA), and FDA is taking comments until Oct. 19, 2026, on a discussion paper about regulating generative AI devices, which it says proposes no policy changes (FDA). The FTC's page for its 2025 study of AI companion chatbots listed no report as of Sept. 30, 2026 (FTC; FTC).

California's AB 1979 would treat businesses offering a "health care chatbot" to consumers as health care providers under the state's medical privacy law, and SB 903 would restrict AI in psychotherapy (AB 1979; SB 903). Neither had been signed or vetoed as of the morning of Sept. 30, 2026, the governor's deadline; such bills become law if not returned by then (LegiScan; LegiScan; California Constitution).