If you are signing BAAs, you're probably a service provider for a covered entity and are contractually obligated to follow HIPAA. Which is different than what t

If you are signing BAAs, you're probably a service provider for a covered entity and are contractually obligated to follow HIPAA. Which is different than what the original question was. For example, what is Apple's exposure here? I doubt any... they keep your data private because it's good for business (and they can then advertise how privacy conscience they are and get people to buy more watches). They aren't doing it because they have to follow HIPAA regulations. A more interesting question is -- if the Apple watch was purchased as a medical device (maybe even with insurance or a prescription), does Apple's data processing need to change at all? What about if people got a watch as part of a medical study (not people that already had the watch). Would that be different?