What Happens to Personal Data After a Senior-Care Inquiry?

A family searching for care may fill out one short form and assume the information goes to one place.

But a senior-care inquiry can move through several organizations:

• the directory or referral service;
• one or more facilities;
• a call center;
• a technology vendor;
• analytics or communications providers; or
• another company identified in the privacy notice.

The exact path depends on the service.

Before submitting sensitive information, ask a basic question:

Who will receive this, what will they use it for, and what did I actually agree to?

Start with the information you are giving away

A care inquiry may ask for:

• name;
• phone number;
• email address;
• ZIP code or city;
• preferred care location;
• desired move date;
• budget or payment source;
• age;
• mobility or memory needs;
• diagnosis or health condition; or
• the identity of the person needing care.

Some of this is ordinary contact data. Some can be highly sensitive health or financial information.

Give the minimum information reasonably needed for the stage of the search. A family comparing basic availability usually does not need to upload a full medical record to every website it encounters.

HIPAA does not cover every senior-care website

This is one of the most important privacy distinctions.

HHS explains that the HIPAA Rules apply to covered entities—such as qualifying health plans, health care clearinghouses, and health care providers conducting certain electronic transactions—and to certain business associates performing services for covered entities.

If an organization is not a covered entity or business associate, HIPAA does not automatically apply to it.

That means a health-related website, consumer app, advertising platform, or independent directory can collect sensitive information without necessarily being a HIPAA-covered entity.

Other laws can still apply. The FTC enforces consumer-protection rules against deceptive or unfair data practices, and some states provide additional privacy rights.

Do not use “HIPAA compliant” as your only privacy question.

Read the privacy notice before the consent box

Look for answers to:

• What information is collected?
• Is it shared with facilities?
• Is it shared with “partners,” affiliates, advertisers, or service providers?
• Is it used for analytics or advertising?
• How long is it retained?
• Can the consumer request access, correction, deletion, or opt-out?
• What contact method handles privacy requests?
• Does the policy identify state-specific rights?

Vague language such as “we may share information with trusted partners” deserves a closer look. Ask what kind of partner and for what purpose.

Contact permission and data sharing are separate questions

A form can include several different permissions at once.

For example, a family might agree to:

• send the inquiry to a specific facility;
• receive a reply from that facility;
• receive calls or texts from the directory;
• receive marketing from multiple providers; or
• have data used for analytics.

Do not assume checking one box has only one effect.

Read the language next to the submit button and any linked terms. If you do not understand whether your information will be sent to one provider or many, ask before submitting.

Ask who becomes responsible after the referral is sent

Suppose a directory sends your inquiry to three assisted-living communities.

At that point, each recipient may have its own privacy obligations, retention practices, and communications process.

Ask:

• Which facilities received the inquiry?
• Did each receive the full form or only selected fields?
• Did any third party receive it too?
• Who should be contacted to correct an error?
• Who handles an opt-out from follow-up calls?
• If I withdraw the inquiry, does that stop future sharing or also delete previously shared copies?

A company cannot necessarily retrieve data already transmitted to an independent recipient merely because you later change your mind.

Be careful with medical records during an early search

A facility may eventually need clinical records to evaluate admission and care capability.

That is different from distributing a complete chart during the earliest browsing stage.

Before uploading records, confirm:

• the identity of the intended recipient;
• the secure submission method;
• what records are actually needed;
• whether the resident or authorized representative approved the disclosure; and
• whether the information is being sent directly to the facility or through an intermediary.

Nursing Home Placement already has a separate guide on keeping a care search moving without sending private records everywhere. The principle is simple: send sensitive clinical material purposefully, not reflexively.

“Delete my data” rights are not identical nationwide

Some state privacy laws give consumers rights involving access, correction, deletion, or opting out of certain data uses. Coverage, exceptions, verification procedures, and definitions vary.

So a general senior-care website should not promise that every U.S. consumer has the same deletion right.

Instead:

1. Read the service’s privacy policy.
2. Use its stated privacy-request process.
3. Check whether your state provides additional rights.
4. Contact downstream facilities separately when necessary.

If the organization is HIPAA-covered, HIPAA provides its own rights regarding protected health information, but those rights are not a universal substitute for consumer privacy laws governing unrelated websites.

What if the site promised privacy and then shared the data?

The FTC has brought enforcement actions when companies made privacy promises and then handled consumer information in ways inconsistent with those promises.

That does not mean every unexpected data use is automatically an FTC violation.

Preserve:

• the privacy policy in effect when you submitted the form;
• the consent language;
• confirmation emails;
• screenshots showing what was promised;
• the date of the inquiry; and
• evidence of the sharing or contact that concerns you.

Then use the company’s privacy process and, where appropriate, consumer-protection or state privacy channels.

A safer inquiry workflow

Before submitting:

Step 1 — Identify the operator.
Know whether you are dealing with a facility, independent directory, insurer, hospital, government program, or referral company.

Step 2 — Read the sharing language.
Find out whether the inquiry goes to one organization or several.

Step 3 — Minimize.
Provide only what is reasonably needed at this stage.

Step 4 — Keep a copy.
Save the form confirmation, privacy policy, and consent text.

Step 5 — Track recipients.
Write down which facilities or services contact you afterward.

Step 6 — Tighten later.
When the family chooses a serious candidate, move detailed clinical information through the correct secure channel.

Frequently asked questions

Is every senior-care inquiry protected by HIPAA?

No. HIPAA applies to covered entities and certain business associates, not every company that happens to collect health-related information.

Can a directory send my inquiry to a facility?

It may be able to if that sharing is consistent with the consent, privacy notice, and applicable law. The consumer should be told clearly enough to understand who may receive the information.

Can I ask a site to stop contacting me?

Yes, you can ask. The legal requirements for stopping particular calls, texts, emails, or data processing depend on the channel, consent, and applicable law. Use the site’s opt-out/privacy process and preserve confirmation.

Should I put a Social Security number in a general care-search form?

Do not provide highly sensitive identifiers unless you understand why they are necessary, who is receiving them, and how they will be protected. A general browsing inquiry ordinarily should be evaluated before sharing more data than needed.

The practical goal

A care inquiry should not be a mystery handoff.

Before clicking Submit, know who operates the form, who may receive the information, what contact you authorized, and how to limit or correct the information later.

Primary sources checked

• HHS — Covered Entities and Business Associates
• HHS — Who Must Comply With HIPAA Privacy Standards?
• FTC — When Companies Share Your Personal Information Without Permission
• FTC — Collecting, Using, or Sharing Consumer Health Information
• HHS — Protecting Health Information on Personal Phones and Tablets

Editorial/source review: October 16, 2026. General U.S. privacy education only. HIPAA status, state consumer-privacy rights, marketing-consent requirements, deletion rights, and breach duties depend on the organization, information, jurisdiction, and facts.

---

Next step for families: Browse senior-care communities to compare local options, or use the Care Finder to organize the care needs and your next questions. Always verify current services, staffing, clinical capability, costs, and availability directly with the provider.