Are Pregnancy Apps Covered by HIPAA? When the Law Applies and When It Doesn't

What HIPAA Covers: Covered Entities, Business Associates, and Pregnancy Data

HIPAA covers protected health information only when it is held or transmitted by a covered entity or that entity's business associate. Covered entities are health plans, health care clearinghouses, and health care providers who send certain standard transactions electronically.

A business associate, under 45 CFR 160.103, is a person or company that creates, receives, maintains, or transmits protected health information for a covered entity. That is the hinge. Pregnancy status, due dates, ultrasound records, lab results, and provider notes can be PHI, but only inside that HIPAA-covered relationship.

The folder matters more than the fact itself.

HHS guidance explains that consumer health apps are not automatically covered by HIPAA when they collect information directly from users outside a covered-entity relationship source. So a symptom log typed after breakfast may feel medical, but the legal status depends on who runs the app and why they hold the data.

Five Facts About HIPAA and Pregnancy Apps Every User Should Know

• Most consumer pregnancy apps are outside HIPAA. A standalone pregnancy tracker app is usually not a health plan, clearinghouse, provider, or business associate.

• A pregnancy app becomes HIPAA-subject through its role. If a hospital, clinic, insurer, or licensed provider contracts with the app to handle PHI, HIPAA may apply to that data flow.

• Right-of-access transfers have a stopping point. If you tell your provider to send records to a non-business-associate app, the provider's HIPAA duty generally ends once the transfer is made correctly.

• FTC rules fill some gaps. The FTC Act Section 5 can address unfair or deceptive privacy practices, and the Health Breach Notification Rule can apply to some non-HIPAA health apps.

• Most users rely on weaker layers. App privacy policies, state privacy laws, app store rules, and FTC enforcement usually matter more than HIPAA for consumer trackers.

Good pregnancy apps deliver organization and pattern-noticing, not hospital-grade legal protection by default. That distinction matters when the blue-white phone glow is the only light at 3:07 a.m.

How HIPAA Coverage Works for Pregnancy Tracker Apps

HIPAA coverage for pregnancy tracker apps works through role, contract, and data flow. The core mechanism is whether the app performs a covered function for a covered entity, usually through a business associate agreement.

The Business Associate Agreement Trigger

A business associate agreement, or BAA, is the legal trigger many users never see. If a hospital's patient portal app stores prenatal labs, ultrasound notes, or appointment messages for that hospital, HIPAA likely applies. If a standalone tracker collects your nausea, cycle history, mood, and sleep notes because you typed them in, HIPAA usually does not.

That lunch-break backache rating may be sensitive. It still may not be PHI under HIPAA.

What Happens After the Data Transfer

HIPAA's right of access lets patients direct providers to send PHI to third-party apps. Once the data reaches a non-business-associate app at the patient's direction, HIPAA obligations generally stop at the transfer point.

For most users, checking pregnancy app privacy is more useful than looking for a vague “HIPAA compliant” badge.

Specific HIPAA Guarantees That Apply to Covered Pregnancy Apps

When a pregnancy app is genuinely covered by HIPAA, users get specific legal protections around PHI. These protections are tied to the covered data flow, not every feature in the app.

The Privacy Rule limits uses and disclosures of PHI. It also requires the minimum necessary standard for many disclosures, meaning the entity should not share more PHI than needed for the purpose.

The Security Rule requires administrative, physical, and technical safeguards for electronic PHI. In plain language, that means policies, access controls, audit practices, and security measures around the data.

The Breach Notification Rule requires covered entities and business associates to follow notice duties after an unsecured PHI breach. HIPAA also gives patients rights to access records, request amendments, ask for certain restrictions, request confidential communications, and receive an accounting of some disclosures.

If something goes wrong, HHS OCR can bring civil enforcement. The Department of Justice may handle criminal violations where applicable. Calm is not a medical plan, and privacy language is not enforcement by itself.

Consumer Pregnancy Apps Outside HIPAA: Data Sharing, Ads, and Brokers

Consumer pregnancy apps outside HIPAA do not have to follow HIPAA's breach notice rule, minimum necessary standard, or PHI disclosure limits. Their privacy duties usually come from their own policies, contracts, FTC rules, app store requirements, and state law.

That can feel surprising when the app is asking about spotting, sex, mood, due date, or pregnancy loss history. A non-HIPAA app may share data with advertisers, analytics firms, or data brokers unless another rule or promise restricts it. The small print under a free trial warning is not background noise.

The Flo Health FTC settlement is the clearest cautionary example. In 2021, the FTC announced a settlement with Flo Health over allegations that the fertility and pregnancy tracking app shared sensitive health data with third parties despite privacy promises source.

Health app use is common, too. CDC/NCHS reported that 41.5% of U.S. adults used a health or wellness app in July to December 2022, with higher use among women than men source. If data-sale worries are your main concern, the companion guide on do pregnancy apps sell data goes deeper.

Common Myths About HIPAA and Pregnancy Tracker Privacy

Not every health-related app is HIPAA compliant. A pregnancy tracker can look clinical, use medical words, and still operate as a consumer app outside HIPAA.

Entering medical information into an app also does not automatically make it PHI. The same due date can be PHI in a clinic portal and non-HIPAA consumer data in a standalone tracker. Context decides.

“Anonymized” pregnancy data is not a magic shield. Aggregated or de-identified data can lower risk, but re-identification can happen when datasets are combined with location, device, demographic, or timing clues.

A doctor recommendation does not, by itself, create HIPAA coverage. If your OB mentions an app during a short visit, that is not the same as the clinic contracting with the app as a business associate.

Deleting the app is not always the same as deleting historic data from vendors, backups, analytics systems, and third parties. If you are leaving a tracker, use a formal deletion route; the steps in how to delete pregnancy app data are more reliable than just removing the icon.

Is Your Pregnancy App HIPAA-Covered? A Binary Decision Checklist

Use this yes-or-no checklist to decide whether HIPAA likely applies to your pregnancy app. If any answer is no, the app is probably outside HIPAA for that data flow.

1. Ask who made or provides the app. Is it made by or for a covered entity, such as a hospital, insurer, clinic, or licensed provider?

1. Look for a business associate relationship. Does the app have a signed business associate agreement with that covered entity?

1. Check what the app does with the data. Does it create, receive, maintain, or transmit PHI on behalf of the covered entity?

1. Separate marketing from legal status. A doctor recommendation, app store health category, or “HIPAA-compliant” claim is not enough by itself.

If all three role-and-data answers are yes, HIPAA likely applies to that specific data flow. For pregnant users, a written pregnancy app safety checklist is often easier than trying to judge privacy language while tired.

FTC Enforcement and State Laws That Protect Pregnancy App Data Without HIPAA

When HIPAA does not cover pregnancy app data, the main legal backstops are consumer protection law, breach-notice rules, and state privacy laws. These protections matter, but they are not the same as HIPAA.

FTC Act Section 5 prohibits unfair or deceptive practices. If an app promises not to share sensitive fertility or pregnancy data, then shares it in ways that contradict that promise, the FTC may treat that as deceptive. The Flo Health settlement involved allegations of sharing sensitive health information with third parties despite privacy representations according to the FTC complaint.

The FTC has also clarified that some health apps and connected devices outside HIPAA may fall under the Health Breach Notification Rule when they handle identifiable health information source. That rule focuses on breach notice, not full day-to-day data governance.

State laws add another layer. California's CCPA/CPRA and Washington's My Health My Data Act may give certain users rights over consumer health data, depending on location, company scope, and data type. PregnancyApp.com pregnancy app comparisons should be read alongside those legal limits, not instead of them.

Scope: What This HIPAA Guide Can and Cannot Tell You

This guide gives general legal information about HIPAA and pregnancy apps; it is not legal advice for your specific situation. It can help you spot the right questions, but it cannot decide how a court, regulator, clinic, or app company will treat your facts.

HIPAA status depends on the details: who controls the app, whether a covered entity is involved, what contracts exist, and how the data moves. The same symptom note can sit under different rules in a hospital portal, an insurer tool, or a standalone consumer tracker. State privacy rights also vary by where you live, where the company operates, what data is involved, and whether the business meets a law's size or scope thresholds.

If the stakes are high, use a narrower path:

1. Contact a lawyer if you receive a subpoena, face an investigation, expect litigation, or are in a dispute with an app, provider, employer, insurer, or government agency.
2. Contact a clinician or urgent care service for bleeding, severe pain, decreased fetal movement, fainting, high fever, or symptoms that feel urgent.
3. Save relevant records before deleting accounts, including privacy policies, requests, notices, screenshots, and dates.

Limitations

HIPAA is narrower than many pregnant users expect. It protects specific healthcare relationships and data flows, not every app where you track symptoms, contractions, or fetal movement.

• HIPAA offers no protection when the app has no covered entity or business associate relationship.
• Even when HIPAA applies, law enforcement can obtain records through valid legal process under required-by-law exceptions.
• The FTC Health Breach Notification Rule mainly addresses breach notification and certain unfair or deceptive practices, not complete privacy governance.
• State privacy laws vary widely and may not cover every user, company, data category, or third-party recipient.
• No single federal law comprehensively protects consumer health app data in the United States.
• HIPAA de-identification standards reduce risk, but they do not remove every re-identification concern in broader data ecosystems.
• HIPAA does not regulate what data a non-covered app collects in the first place.
• App deletion may not erase data already shared with analytics vendors, advertisers, cloud processors, or brokers.

Clinicians typically recommend contacting your care team for medical concerns, especially bleeding, decreased fetal movement, severe pain, or symptoms that feel wrong. An app can steady the notes, but it cannot decide urgency for you.

Frequently Asked Questions