CPAP Data Privacy - How to Protect your CPAP Machine
Key Takeaways
- Connected CPAP machines transmit therapy metrics only: usage hours, leak rate, AHI, and pressure settings, not audio or location data
- If you use insurance, your compliance data is generally required to maintain coverage; blocking it with Airplane Mode can pause payment, though this is usually recoverable, not a permanent denial.
- HIPAA's "accounting of disclosures" right lets you request a log of certain disclosures of your health information, but disclosures made for payment purposes (like insurance compliance checks) are specifically excluded from that right.
- If you purchased your machine out-of-pocket, you're not required to register the companion app or share data with anyone.
- Airplane Mode (on the Resmed AirSense series, found in the "More" menu) disables cellular transmission entirely.
On This Page
Quick answer: Modern connected CPAP machines transmit therapy metrics only, usage hours, leak rate, AHI, and pressure settings, not audio or GPS location. If you're using insurance, that data is generally required to verify compliance, and blocking it (such as with Airplane Mode) can pause your coverage. If you paid out-of-pocket, you can decline app registration or use Airplane Mode with no coverage consequences.
What Data Is Actually Transmitted?
Your CPAP machine does not record audio or track your location. Data sent to cloud platforms like Resmed's AirView or Philips' Care Orchestrator is limited to therapy metrics:
-
Usage hours: how long the machine ran
-
Leak rate: how well your mask sealed
-
AHI (Apnea-Hypopnea Index): events per hour
-
Pressure settings: what pressure was delivered
Insurance and Compliance Data
If your machine was covered by insurance, you likely signed a data-release consent as part of that coverage. Medicare and most private insurers require documented compliance, typically at least 4 hours of use per night on 70% of nights within a 30-day window during the first 90 days, to continue covering the machine (CMS coverage criteria; general industry standard). Blocking that data stream can pause your coverage, though a missed compliance window is usually something you and your provider can address and recover from rather than a permanent denial.
Your HIPAA Rights, Accurately
HIPAA does give you the right to request an "accounting of disclosures," a log of certain disclosures of your protected health information, from a covered entity (HHS.gov). This right has existed since 2003, it isn't new. It's also narrower than it sounds: disclosures made for treatment, payment, or healthcare operations, which would generally include sharing your compliance data with your insurer, are excluded from what you can request an accounting for. In plain terms: this right gives you visibility into some data sharing, but not necessarily the insurance compliance monitoring most CPAP users are actually curious about.
Taking Control of Your Data
Your options depend on how you paid for your machine.
If you paid out-of-pocket: You're not required to share data with anyone. You can decline to register the companion app, and you can ask your equipment provider to disable clinical data upload before your machine ships.
Airplane Mode: Most modern machines, including the Resmed AirSense series, include an Airplane Mode, accessible from the "More" menu on the AirSense 11, which disables cellular transmission entirely. If you're on insurance, turning this on will block compliance verification and can affect your coverage. If you're a cash-pay customer, it's a straightforward way to keep your machine fully offline.
SD card only: You can disable wireless features entirely and use the SD card to manually share data with your doctor as needed, keeping your data in your physical possession between visits.
By engaging in a few simple practices, you can better protect your personal data linked to your CPAP device and better ensure CPAP Data Privacy. For more information, give our customer care team at The CPAP Shop a call at 866-414-9700.
Frequently Asked Questions
Does my CPAP machine record what I say or where I am?
No. Transmitted data is limited to therapy metrics (usage, leak rate, AHI, pressure), not audio or location.
Will turning off data sharing get my insurance claim denied?
It can pause your coverage if you're in a compliance-monitoring window, but this is typically recoverable by working with your provider, not an automatic permanent denial.
Can I request a log of who accessed my CPAP data?
You can request a HIPAA "accounting of disclosures," but it doesn't cover disclosures made for payment purposes, which is the category insurance compliance sharing usually falls under.
Disclaimer: This article is for general informational purposes only and is not legal, medical, or insurance advice. Insurance compliance requirements vary by plan, and HIPAA rights have specific exceptions, consult your insurance provider or a qualified professional for guidance on your specific situation.
This post was updated with the latest information in October 2026.
References:
-
U.S. Department of Health & Human Services. "Right to an Accounting of Disclosures." Available at: hhs.gov/hipaa
-
Resmed. "How Does the Patient Turn Airplane Mode On or Off?" Available at: ap.Resmed.com/knowledge
