Skip to main content
CPAP Clarity
Become a supporter
Published11 min read
By Brian C., CPAP user since 2023Editorial standards

Must You Accept ResMed's HIPAA Authorization?

ResMed labels the myAir HIPAA authorization optional. What it covers, how to decline or revoke your consent, and who to ask.

ResMed says no. Its own release notes for the US myAir app label the HIPAA authorization optional and say the app asks you to accept or decline it, and its NightOwl FAQ says patients using its NightOwl home sleep test can do either. You can change your mind later. The same notes point to a Consent management screen in the app settings, and the federal HIPAA rule lets you revoke an authorization at any time in writing, though revoking does not undo sharing that already happened.

What the Prompt Is

In the United States, ResMed added a HIPAA authorization step to the myAir app in version 5.3. ResMed's release notes for that version list it under "What's new" with the heading "(Optional) HIPAA consent for optimized myAir experience". New users see it when they create a myAir account. Current users see it the next time they sign in again.

The notes also say where to find it afterwards. For more about the authorization, they point to App settings, then myAir support, then Account, then HIPAA authorization. To accept or decline later, they point to App settings, then Consent management. Those are the paths ResMed published for version 5.3. Later versions of the app may move them, so if you cannot find them, ask myAir support.

ResMed's NightOwl FAQ, written for clinics that use its NightOwl home sleep test, says ResMed may offer a HIPAA Authorization to NightOwl patients, and that a patient "has the option to accept or decline the HIPAA Authorization in the myAir app". It does not say whether that is the same authorization CPAP users see in version 5.3.

What a HIPAA Authorization Is

HIPAA's Privacy Rule sets limits on how covered entities, such as health plans and most health care providers, use and share your health information. The Department of Health and Human Services (HHS) explains that an authorization is a detailed document that gives permission to use or disclose your health information for specified purposes. Those purposes are generally something other than treatment, payment or health care operations.

That last point matters. HHS says your doctors and other providers can already share your health information with each other for treatment without your authorization. An authorization is for the uses HIPAA does not otherwise allow.

The federal rule, 45 CFR 164.508, says what every valid authorization must contain. It must, among other things, describe the information in a specific and meaningful way, name or identify who may share it and who may receive it, describe each purpose, give an expiration date or event, and carry your signature and the date. It must also tell you three things in writing. That you can revoke it in writing, and how. Whether your treatment, payment or benefits can depend on signing. And that information shared under it may be passed on by whoever receives it and may then no longer be protected by HIPAA. The rule also requires it to be written in plain language.

What ResMed Says It Covers

ResMed's myAir privacy notice (effective July 2025) describes the authorization in one sentence. It says that if you have completed a HIPAA authorization voluntarily authorizing ResMed to collect, use and disclose Protected Health Information, ResMed will handle your information according to that authorization and the privacy notice.

We could not find the full authorization text on a public ResMed page. Copies have been posted online by readers, but we could not check any of them against a ResMed original, so this article does not summarize them. The full text appears in the app before you choose. Reading it there, rather than a copy, is the only way to know exactly what the version in front of you says.

When you read it, the federal rule above tells you what to look for. The list of information it covers, who it lets share that information with ResMed, each purpose, when it ends, and how to revoke it should all be written out on the form itself.

Is It Optional?

ResMed's own words say yes. The version 5.3 release notes put "(Optional)" in the heading for this feature, and the NightOwl FAQ, for patients using its NightOwl home sleep test, calls it an option to accept or decline.

The federal rule adds a general limit for covered entities, such as your providers and health plan. HHS says that with limited exceptions, they may not make your treatment, payment, enrollment or benefits depend on whether you sign. ResMed's privacy notice describes ResMed as a business associate of your provider when you use a prescribed diagnostic device, and the documents we found do not say how the rule applies to the myAir prompt. The exceptions in 164.508 cover cases like research treatment and some health plan enrollment.

What declining changes inside myAir is less clear. ResMed does not publish a list of features that need the authorization. The only effect we found in its documents is a known problem listed in the 5.3 release notes. After declining, you may get an error when saving your machine information, and ResMed's fix is to sign out and sign in again.

Can You Undo It?

HIPAA's rule gives you that right, with limits. HHS says the Privacy Rule gives you the right to revoke an authorization at any time. HHS also sets out how that works.

  • It must be in writing. The authorization must tell you how to revoke it, either on the form itself or by pointing to the covered entity's privacy notice that does.
  • It starts when the right party receives it. A revocation is not effective until the covered entity that was allowed to share your information receives it. HHS warns that forms run by a third party should not imply otherwise.
  • It does not reach backwards. Revoking does not cover anything already done in reliance on the authorization while it was in place.

ResMed's release notes say you can accept or decline your consent from the Consent management screen. ResMed does not say, in anything we found, whether declining there counts as the written revocation HIPAA describes, whether it reaches every party the authorization covers, or what happens to information already shared. The authorization in the app should spell out its own revocation steps, since the federal rule requires that. If it is unclear, ask ResMed in writing where your revocation must be sent, and keep a copy.

How This Differs From Your Care Team Seeing Your Data

Many ResMed machines send therapy data over the air. ResMed's myAir terms say that outside Europe, the Middle East and Africa, the machine is already activated and transmits its data to ResMed's cloud.

Your doctor or equipment supplier usually sees that data through AirView, which ResMed describes as a secure, cloud-based system that lets providers access patient data and change some settings, such as ramp and humidification, remotely. That is a care relationship. HHS says providers can share health information for treatment without an authorization.

The myAir authorization is a separate question. ResMed's myAir privacy notice says it may disclose personal information to healthcare or home medical equipment providers, and that their use of it is limited to flagging whether the machines they monitor are registered with the myAir service, unless you consent to share more. ResMed's documents describe AirView and the myAir authorization separately, and none we found says declining the authorization changes what your care team sees in AirView. If that matters to you, ask your supplier.

The privacy notice also states that ResMed does not sell or share sensitive personal information, and that it may use and share aggregate, de-identified, pseudonymized or anonymized information with third parties for quality control, analytics, research, development and other purposes. Those are ResMed's own statements about the myAir service. For a wider look at how cloud tools and local tools handle CPAP data, see CPAP data privacy.

Who to Ask

This article explains what the documents say. It is not legal advice.

  • About the authorization itself, ask ResMed. Its myAir terms list myairsupport@resmed.com for users outside Europe, the Middle East and Africa, and its privacy notice lists privacy@resmed.com.
  • About what your care team receives, ask your sleep doctor or equipment supplier. They can tell you what they see in AirView and whether anything depends on myAir.
  • About your rights in a specific situation, ask a lawyer who handles health privacy.

Whatever you decide about the prompt, keep using your machine as prescribed. If something about your therapy changes, talk to your sleep doctor.

What CPAP Clarity Does

CPAP Clarity reads your machine's SD card in your browser, and your SD card files are never uploaded to a server. It does not connect to myAir or your ResMed account. If you want to look at your own nights in more detail than the app shows, import your SD card or read what you can see beyond myAir. For what the app's own number means, see how the myAir score works.

Frequently Asked Questions

Do I have to accept the HIPAA authorization in myAir?

ResMed says no. Its release notes for the US myAir app, version 5.3, label it optional, and its NightOwl FAQ says patients using its NightOwl home sleep test can accept or decline it. The federal HIPAA rule says covered entities, such as your providers and health plan, generally cannot make your treatment or coverage depend on signing an authorization. ResMed's documents do not say how that applies to myAir.

Will myAir stop working if I decline?

ResMed does not publish a list of features that need the authorization. The only effect in its documents is a known problem in version 5.3, where declining may cause an error when you save your machine information. ResMed's fix is to sign out and sign in again.

How do I change my answer later?

ResMed's version 5.3 release notes say you can accept or decline from App settings, then Consent management, in the app. Under HIPAA, a revocation must be in writing and takes effect once the party that was allowed to share your information receives it. The authorization should explain its own revocation steps.

Does revoking delete what was already shared?

HHS says a revocation does not apply to anything already done in reliance on the authorization while it was in place. ResMed does not say, in anything we found, what happens to information it already received. Ask ResMed in writing.

Is this the same as my doctor seeing my data in AirView?

No. AirView is the system ResMed provides to doctors and equipment suppliers, and HHS says providers can share health information for treatment without an authorization. ResMed's documents describe the two separately. Ask your supplier if you want to know whether anything they see depends on myAir.

Primary Sources

Was this article helpful?

Related Guides

CPAP Data Privacy: How We Protect Your Data

12 min read

Beyond myAir: What Your ResMed Really Records

15 min read

myAir Score: 70 of the 100 Points Are Hours

8 min read

See what your SD card reveals

Drop in your SD card data. ResMed, Philips, BMC, Löwenstein, Luna, Yuwell, and more. No account, no uploads, no cost.

Analyze your data