For telehealth-adjacent services · Updated 2026
WMHMDA for Telehealth-Adjacent Services
Plenty of businesses sit next to telehealth without being a hospital, a clinic, or a HIPAA business associate: symptom checkers, care-navigation and provider-matching platforms, medication reminder apps, at-home lab-test ordering sites, and post-visit follow-up tools. Because these businesses often assume "we're basically healthcare, so HIPAA covers us," they skip WMHMDA analysis entirely — and that's usually the wrong call.
In short: Being "telehealth-adjacent" doesn't mean HIPAA-exempt from WMHMDA. Most symptom checkers, provider-matching apps, and follow-up tools are not HIPAA covered entities, so WMHMDA applies on its own terms. Generate your documents below.
Read the full guide for telehealth-adjacent services
Why "telehealth-adjacent" usually means "not exempt"
WMHMDA's exemption for HIPAA-regulated data is narrower than most founders expect: it applies to information handled by an actual HIPAA covered entity or business associate, within the scope of HIPAA. A platform that routes patients to providers, collects intake symptoms before a visit, or stores health information independent of any covered entity's systems is typically not covered by that exemption — meaning WMHMDA applies on its own terms to everything your business collects.
Example: a symptom-checker and provider-matching app
Consider an app where a user describes symptoms, receives a triage suggestion, and is matched to a nearby provider. Every symptom entered is consumer health data the moment it's typed — regardless of whether a licensed clinician ever reviews it. The app needs: a privacy policy disclosing that symptom and triage data is collected and how it's used to generate matches; opt-in consent before that data is collected; a specific, separate authorization if provider-matching data is ever shared with the matched provider's business systems or with advertising partners; and a process for consumers to request deletion of their symptom history.
Where the HIPAA exemption actually does apply
If your business is itself a covered entity (e.g., a licensed telehealth practice) or a signed business associate processing data strictly within that clinical relationship, that specific data may fall under the HIPAA carve-out. But most adjacent products — booking tools, reminder apps, content platforms, marketplaces — are not covered entities themselves, so the carve-out doesn't reach their own collection and use of the data.
Get the right documents for a telehealth-adjacent product
The WMHMDA Compliance Pack builds a privacy policy, consent form, sale authorization, retention schedule, and rights form based on your actual data flows — not a generic healthcare template. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99Legal limitations
Whether your specific data flows fall inside or outside the HIPAA exemption depends on your exact relationship with covered entities and business associates. This is a fact-specific legal question — have an attorney confirm your HIPAA/WMHMDA boundary before relying on any generated document, especially if your platform exchanges data directly with clinical systems.
FAQ
If we're not a HIPAA covered entity, are we automatically exempt from WMHMDA?
No — the WMHMDA exemption is narrow and applies to data handled by an actual covered entity or business associate within HIPAA's scope. Most adjacent apps are not exempt.
Does a symptom-checker or triage chatbot collect consumer health data?
Yes — symptoms, self-reported conditions, and triage output all qualify as consumer health data.
What if our platform only connects patients with licensed providers?
The provider's HIPAA obligations don't extend to your platform automatically — if you independently collect or store health information, WMHMDA likely still applies to your business.
Does wmhmda or mhmda apply to medication reminder or post-visit follow-up apps?
Generally yes, if the app collects information revealing a consumer's health status and the business isn't itself a HIPAA covered entity acting within HIPAA's scope.