The way I see it, while the distinction you describe is correct, there's a reasonable desire that this distinction should not exist and if some app on your phon

The way I see it, while the distinction you describe is correct, there's a reasonable desire that this distinction should not exist and if some app on your phone collects private health data then that data should get the same protections as if your doctor collected it; and if the app developer wants to store and process that data then they'd better be able to comply with HIPAA-like requirements or stop handling sensitive data. It's not like it currently is, but we can try and get there.