OpenAI Launches ChatGPT Health, Linking Medical Records to the Chatbot

On 7 January 2026 OpenAI introduced ChatGPT Health, a dedicated experience inside ChatGPT for health and wellness conversations. The company said that more than 230 million people worldwide already ask ChatGPT health-related questions each week, and that the new space is designed to make those conversations more personal by letting users connect their own data. In the United States, users can link medical records through b.well, a health-data aggregator; on iOS they can connect Apple Health, alongside consumer apps such as Function, MyFitnessPal, Weight Watchers, AllTrails, Instacart and Peloton.

OpenAI framed the launch around privacy engineering. Health conversations run in an isolated space with what the company describes as purpose-built encryption; they are not used to train OpenAI's foundation models; data does not flow back into ordinary ChatGPT chats; and users can add multi-factor authentication. The company published a separate health privacy notice. The feature opened as a waitlist for Free, Go, Plus and Pro users outside the European Economic Area, Switzerland and the United Kingdom, with full record connectivity limited to the US.

OpenAI was careful to state that the product is meant to support, not replace, medical care and is "not intended for diagnosis or treatment." That disclaimer will be tested in practice: users who upload lab results and ask what they mean are, functionally, seeking interpretation.

The launch is notable for what it signals rather than for any new model capability. A general-purpose assistant is being positioned as a consumer health interface at population scale, with direct access to regulated data categories. That places it in the orbit of HIPAA in the US, of GDPR Article 9 special-category rules in Europe (which explains the EEA exclusion), and of medical-device law wherever outputs drift from wellness advice toward clinical interpretation. It also arrived the same month Anthropic announced a HIPAA-oriented healthcare offering, indicating that frontier labs now see health as a primary vertical rather than an edge case.

For health systems and insurers, the more immediate question is indirect: patients will arrive with AI-generated summaries of their own records, and employees may paste protected data into consumer tools that sit outside enterprise controls.

What it means for leaders

• Update acceptable-use and data-handling policies now. Consumer health features blur the line between personal and workplace use; make explicit which tools may touch patient or employee health data.
• Map the regulatory perimeter before piloting. Under the EU AI Act, systems used in healthcare contexts can fall into high-risk categories or into medical-device rules; document a classification decision rather than assuming "wellness" status.
• Treat vendor privacy claims as controls to verify. Isolation, encryption and no-training commitments should appear in contracts and be evidenced in audits, consistent with ISO/IEC 42001 supplier requirements.
• Prepare clinicians and support staff for AI-informed patients. Guidance on how to handle AI-generated interpretations reduces both clinical and liability risk.
• Watch the diagnosis boundary. The line between explaining a result and interpreting it is where liability and device regulation attach; log and review use cases accordingly.