Your Watch is Watching. Who Else Is?
Take a moment and look at your wrist.
There's a very good chance you are wearing a device that is, at this exact second, counting your heartbeats, tracking your movement, and maybe even measuring the oxygen saturation of your blood.
Millions of us have invited these tiny, powerful computers; our smartwatches, Fitbit (now part of Google), ŌURA rings, and WHOOP bands, into the most intimate spaces of our lives. We’ve embraced the dashboards, the sleep scores, and the gamified satisfaction of "closing our rings." This technology is empowering. It makes the invisible visible and nudges us toward better habits.
The clinical potential is undeniably revolutionary. An Apple Watch can detect an irregular heart rhythm (Atrial Fibrillation) and alert a user to a life-threatening condition (not new news, but a good reminder!). A continuous glucose monitor (CGM), once a niche device for Type 1 diabetes, can now give anyone real-time feedback on how a single piece of toast sends their blood sugar soaring, transforming our approach to metabolic health.
This is the promise of the health tech revolution: personalized, preventative, and predictive medicine in real-time.
But this flood of data, streaming from our bodies 24/7, flows in two directions. It flows to us, empowering our daily decisions. And it flows away from us, into a complex and opaque ecosystem of corporate servers, third-party apps, and data brokers.
This brings us to the critical, and often uncomfortable, questions we must start asking. My colleague, Meredith Challender framed these questions perfectly in a recent post about our upcoming panel. They get to the very heart of this new digital-health equation.
From Wellness Data to a Digital Profile
Meredith asks: Ever wonder what information your device is gathering? Do they know more about your health than you know about it yourself?
The answer is almost certainly, yes. We see the surface level: steps, sleep duration, and calories. But the real value is in the data beneath the data. These devices are gathering:
- Biometric Signatures: Your resting heart rate, and more importantly, your Heart Rate Variability (HRV), a powerful proxy for your body's stress, recovery, and autonomic nervous system function.
- Physiological Patterns: Detailed sleep staging (REM, Deep, Light), respiratory rate, skin temperature, and blood oxygen (SpO2).
- Metabolic Response: With CGMs, this is a minute-by-minute log of your body's reaction to every single thing you eat, drink, or do.
Algorithms synthesize this. They find patterns you can't. A wearable may detect signs of an impending illness like COVID-19 or the flu days before you ever feel a symptom by noticing a subtle rise in your resting heart rate or skin temperature.
The promise is an early warning. The risk? This data lacks context. An algorithm doesn't know you had a stressful deadline and two cups of coffee; it just sees a "high stress" score. This can create a new, digital-age anxiety without the guidance of a clinician to interpret it. As a mom of four, an exec, and and and....I live on coffee and cortisol!
The Great HIPAA Black Hole
This leads to the next, and perhaps most critical, set of questions: Who are they sharing this with? Health (and maybe even life?) insurers? Are they appropriately securing that information?
This is the multi-trillion-dollar problem.
When I, as your physician, take your blood pressure, that reading is Protected Health Information (PHI). It is shielded by the federal law HIPAA (the Health Insurance Portability and Accountability Act). It cannot be shared without your explicit consent. But when your smartwatch or health app takes that same reading, it is most likely not protected by HIPAA. It's considered "consumer data," governed by a company's privacy policy (that 40-page document you scroll past and click "Agree" on).
This creates a "HIPAA black hole" where your most sensitive personal data can flow. The Federal Trade Commission (FTC) has been issuing stark warnings to health app makers about this very issue.
So, where does your data go?
- Data Brokers: It's often "anonymized" (a very fuzzy term) and sold or shared with data brokers, marketers, and research firms.
- Your Employer: Many corporate wellness programs offer insurance discounts if you "voluntarily" share your activity data, creating a direct pipeline to your employer or their partners.
- Insurers: This is the big one. In the health insurance world, the (ACA) and GINA (Genetic Information Nondiscrimination Act) prevent insurers from using this data to set your premiums (we still deal with preexisting conditions!). But what about life insurance? Or disability and long-term care insurance? The rules are far grayer. It's not hard to imagine a future where a life insurer requests your last five years of "wellness data" to set your rates.
And as for security? Health data is one of the most valuable assets on the dark web. The IBM Cost of a Data Breach Report consistently finds that healthcare data breaches are the most expensive, precisely because the data is so personal and permanent. We are trusting tech companies to secure our data with the same diligence as a hospital or a bank, and the track record across the industry is... mixed.
What This Means: From Data to Trust
These aren't hypothetical fears; they are the most urgent, practical, and high-stakes challenges at the intersection of technology, insurance, and medicine. And that is exactly what I'll be discussing at the Inaugural Emerging Technologies Insurance ExecuSummit in a few weeks.
I'm honored to be part of a panel assembled by Meredith Challender to tackle these issues head-on. I'll be joining a brilliant group of experts, including @David Standish, Afik Gal, MD,MBA and Kevin Mekler to debate the true benefits and risks of these devices. We'll be moving past the marketing hype and digging into the insurance, liability, and clinical realities of this data-driven world.
The genie is not going back into the bottle. We will not stop using these devices; they are too good, and their potential for improving health is too great. But the next frontier isn't just a better sensor. It's building a system of data governance and trust. We must move from a model of passive data collection to one of active patient consent, true data ownership, and transparent, secure sharing.
If you're attending the ExecuSummit, I look forward to seeing you there.
Stay healthy (and data-aware),
Dr. Matt




