Ah, the wonders of HIPAA are, in part, laid bare by recent, apparently surprising , news that wellness apps are not providing or exchanging personally identifiable health information with their users, so almost anything goes with the unannounced circulation of information collected there. HIPAA's privacy rule targets personally identifiable health information, after all.
So, that app designed to help you lose weight by tracking inputs like activity level, weight at various intervals, food intake, etc. isn't really obligated to ask your consent to have your data accessed by those interested in advertising, marketing, as well as research. Of course, the greater fear is that such information will soon be of interest to insurers and employers. But it already is.
Missouri State of Mind 