Journal of the American Medical Association Article

Co-authored with colleagues at IIT Chicago-Kent College of Law, this Journal of the American Medical Association (JAMA) study examined the privacy policies and data-sharing practices of Android diabetes apps. We found that most had no privacy policies and that sensitive health data — including insulin and blood glucose levels — was routinely shared with third parties. Because HIPAA does not cover medical apps, patients have no federal protections against this data sharing, often without their knowledge. The study sparked national media coverage and broader conversation about privacy, digital health, and the gaps in existing health law.

The study received international attention with at least forty-nine media appearances in the month following publication, including Reuters, CBS News, STAT, PBS Newshour, Politico, El Pais (Spain), The Times of London, HolaDoctor (in Spanish), and MedicalOnline.hu (Hungary). As first author, numerous media outlets interviewed me.