Are Pregnancy Apps Covered by HIPAA? When the Law Applies and When It Doesn't

Are Pregnancy Apps Covered By Hipaa

The answer to “are pregnancy apps covered by HIPAA” is usually no. Most pregnancy apps operate as standalone consumer products, not covered entities or business associates under federal law. A pregnancy app is covered by HIPAA only when it creates, receives, maintains, or transmits protected health information on behalf of a covered entity such as a hospital, health plan, or licensed provider.

Definition: HIPAA, the Health Insurance Portability and Accountability Act, is a federal law that protects individually identifiable health information held or transmitted by covered entities, including health plans, health care clearinghouses, certain health care providers, and their contracted business associates.

TL;DR

  • HIPAA only protects pregnancy app data when the app operates as a business associate of a covered entity like a hospital, clinic, provider, or health plan.
  • Most consumer pregnancy trackers downloaded from app stores fall outside HIPAA; their data practices are mainly governed by the app’s privacy policy, FTC rules, app store rules, and state laws.
  • A doctor recommendation, app store “health” category, or “HIPAA compliant” marketing claim does not automatically make a pregnancy app covered by HIPAA.
  • The FTC Health Breach Notification Rule and enforcement actions, including the Flo Health settlement, partially fill the gap but do not provide the same day-to-day protections as HIPAA.

What HIPAA Covers: Covered Entities, Business Associates, and Pregnancy Data

HIPAA covers protected health information only when it is held or transmitted by a covered entity or that entity’s business associate. Covered entities are health plans, health care clearinghouses, and health care providers who send certain standard transactions electronically.

A business associate, under 45 CFR 160.103, is a person or company that creates, receives, maintains, or transmits protected health information for a covered entity. That role is the key distinction. Pregnancy status, due dates, ultrasound records, lab results, and provider notes can be PHI, but only inside a HIPAA-covered relationship.

HHS guidance explains that consumer health apps are not automatically covered by HIPAA when they collect information directly from users outside a covered-entity relationship source. The legal status depends on who runs the app, whether a covered entity is involved, and why the app holds the data.

  • Most consumer pregnancy apps are outside HIPAA. A standalone pregnancy tracker is usually not a health plan, clearinghouse, provider, or business associate.
  • A pregnancy app becomes HIPAA-subject through its role. If a hospital, clinic, insurer, or licensed provider contracts with the app to handle PHI, HIPAA may apply to that data flow.
  • Right-of-access transfers have a stopping point. If you tell your provider to send records to a non-business-associate app, the provider’s HIPAA duty generally ends once the transfer is made correctly.
  • FTC rules fill some gaps. The FTC Act Section 5 can address unfair or deceptive privacy practices, and the Health Breach Notification Rule can apply to some non-HIPAA health apps.
  • Most users rely on weaker privacy layers. App privacy policies, state privacy laws, app store rules, and FTC enforcement usually matter more than HIPAA for consumer trackers.

When HIPAA Applies to Pregnancy Tracker Apps

HIPAA coverage for pregnancy tracker apps depends on role, contract, and data flow. The core question is whether the app performs a covered function for a covered entity, usually through a business associate agreement.

The Business Associate Agreement Trigger

A business associate agreement, or BAA, is the legal trigger many users never see. If a hospital’s patient portal app stores prenatal labs, ultrasound notes, appointment messages, or provider communications for that hospital, HIPAA likely applies to that covered data flow. If a standalone tracker collects your nausea, cycle history, mood, sleep notes, symptoms, or due date because you typed them in, HIPAA usually does not apply.

What Happens After a Provider Sends Data to an App

HIPAA’s right of access lets patients direct providers to send PHI to third-party apps. Once the data reaches a non-business-associate app at the patient’s direction, HIPAA obligations generally stop at the transfer point.

For most users, reading the app’s policy and settings is more useful than relying on a vague “HIPAA compliant” badge. The guide to pregnancy app privacy explains what to check before entering sensitive information.

What HIPAA Guarantees When It Really Applies

When a pregnancy app is genuinely covered by HIPAA, users get specific legal protections around PHI. These protections attach to the covered data flow, not necessarily every feature in the app.

  • Privacy Rule: limits uses and disclosures of PHI and applies the minimum necessary standard for many disclosures.
  • Security Rule: requires administrative, physical, and technical safeguards for electronic PHI, including policies, access controls, audit practices, and security measures.
  • Breach Notification Rule: requires covered entities and business associates to follow notice duties after an unsecured PHI breach.
  • Patient rights: can include rights to access records, request amendments, request certain restrictions, request confidential communications, and receive an accounting of some disclosures.
  • Enforcement: HHS OCR can bring civil enforcement, and the Department of Justice may handle criminal violations where applicable.

Consumer Pregnancy Apps Outside HIPAA: Data Sharing, Ads, and Brokers

Consumer pregnancy apps outside HIPAA do not have to follow HIPAA’s breach notice rule, minimum necessary standard, or PHI disclosure limits. Their privacy duties usually come from their own policies, contracts, FTC rules, app store requirements, and state law.

That can surprise users because pregnancy apps may ask about spotting, sex, mood, due date, pregnancy loss history, contractions, medications, or symptoms. A non-HIPAA app may share data with advertisers, analytics firms, cloud processors, or data brokers unless another rule, contract, state law, or privacy promise restricts it.

The Flo Health FTC settlement is a key cautionary example. In 2021, the FTC announced a settlement with Flo Health over allegations that the fertility and pregnancy tracking app shared sensitive health data with third parties despite privacy promises source.

Health app use is also common. CDC/NCHS reported that 41.5% of U.S. adults used a health or wellness app in July to December 2022, with higher use among women than men source. If data-sale worries are your main concern, the companion guide on do pregnancy apps sell data goes deeper.

Common Myths About HIPAA and Pregnancy Tracker Privacy

Pregnancy app privacy is often misunderstood because medical-sounding data does not always receive medical-record-level legal protection.

  • Myth: Every health-related app is HIPAA compliant. A pregnancy tracker can look clinical, use medical language, and still operate as a consumer app outside HIPAA.
  • Myth: Entering medical information automatically makes it PHI. The same due date can be PHI in a clinic portal and non-HIPAA consumer data in a standalone tracker. Context decides.
  • Myth: “Anonymized” pregnancy data is always safe. Aggregated or de-identified data can lower risk, but re-identification can happen when datasets are combined with location, device, demographic, or timing clues.
  • Myth: A doctor recommendation creates HIPAA coverage. If your OB mentions an app, that is not the same as the clinic contracting with the app as a business associate.
  • Myth: Deleting the app deletes all past data. Removing the icon may not erase historic data from backups, analytics systems, vendors, or third parties. If you are leaving a tracker, use a formal deletion route; the steps in how to delete pregnancy app data are more reliable than uninstalling alone.

Is Your Pregnancy App HIPAA-Covered? A Yes-or-No Checklist

Use this checklist to decide whether HIPAA likely applies to your pregnancy app. If any answer is no, the app is probably outside HIPAA for that data flow.

  1. Who provides the app? Is it made by or for a covered entity, such as a hospital, insurer, clinic, or licensed provider?
  2. Is there a business associate relationship? Does the app have a signed business associate agreement with that covered entity?
  3. What does the app do with the data? Does it create, receive, maintain, or transmit PHI on behalf of the covered entity?
  4. Is the claim more than marketing? A doctor recommendation, app store health category, or “HIPAA-compliant” label is not enough by itself.

If the role, contract, and data-flow answers are yes, HIPAA likely applies to that specific data flow. For everyday app selection, a written pregnancy app safety checklist is often easier than trying to evaluate legal language while tired or stressed.

FTC Enforcement and State Laws That Protect Pregnancy App Data Without HIPAA

When HIPAA does not cover pregnancy app data, the main legal backstops are consumer protection law, breach-notice rules, and state privacy laws. These protections matter, but they are not the same as HIPAA.

FTC Act Section 5 prohibits unfair or deceptive practices. If an app promises not to share sensitive fertility or pregnancy data, then shares it in ways that contradict that promise, the FTC may treat the conduct as deceptive. The Flo Health settlement involved allegations of sharing sensitive health information with third parties despite privacy representations according to the FTC complaint.

The FTC has also clarified that some health apps and connected devices outside HIPAA may fall under the Health Breach Notification Rule when they handle identifiable health information source. That rule focuses on breach notice, not complete day-to-day privacy governance.

State laws add another layer. California’s CCPA/CPRA and Washington’s My Health My Data Act may give certain users rights over consumer health data, depending on location, company scope, and data type. Pregnancy app comparisons should be read alongside those legal limits, not instead of them.

Frequently Asked Questions

Does HIPAA apply to pregnancy?

Yes, HIPAA can apply to pregnancy-related information when it is held by a covered entity or its business associate. It does not apply just because the information is about pregnancy.

Are health apps protected by HIPAA?

Most consumer health apps are not protected by HIPAA. Provider apps, patient portals, and apps working under a business associate agreement may be covered.

Is Flo a HIPAA-covered app?

Flo operates as a consumer fertility and pregnancy app, not as a HIPAA-covered provider portal. Its major U.S. privacy case involved FTC enforcement, not HIPAA enforcement.

What makes an app HIPAA compliant?

An app generally needs to operate as or for a covered entity, often through a business associate agreement. It must also follow HIPAA Privacy Rule, Security Rule, and breach-notification duties for PHI.

Can pregnancy apps sell my data?

Non-HIPAA pregnancy apps may share or sell data unless restricted by their privacy policy, contracts, FTC rules, or state laws. The exact answer depends on the app’s policy and your location.

Does a doctor’s recommendation make a pregnancy app covered by HIPAA?

No. A doctor’s recommendation alone does not create a covered entity or business associate relationship.

What law protects pregnancy app data if HIPAA does not apply?

The main alternatives are the FTC Act, the FTC Health Breach Notification Rule, and state privacy laws such as CCPA/CPRA or Washington’s My Health My Data Act. Coverage varies by company, data type, and location.

Is anonymized pregnancy data truly safe?

Anonymized, aggregated, or de-identified pregnancy data can reduce privacy risk. It is not risk-free because re-identification may be possible when data is combined with other datasets.

Can law enforcement access pregnancy app data?

Yes. Non-HIPAA apps may respond to subpoenas, warrants, or other valid legal requests under their policies and applicable law. HIPAA-covered entities also have required-by-law exceptions.

Limitations & Safety

  • This guide gives general information about HIPAA and pregnancy apps; it is not legal advice. HIPAA status depends on who controls the app, whether a covered entity is involved, what contracts exist, and how the data moves.
  • HIPAA does not protect every pregnancy app, does not regulate what a non-covered app collects in the first place, and may not prevent disclosure when valid legal process or required-by-law exceptions apply.
  • FTC rules and state privacy laws can help, but they vary by company, location, data type, and legal threshold; no single federal law comprehensively protects all consumer health app data in the United States.
  • Before deleting accounts, save relevant records if there may be a dispute, including privacy policies, requests, notices, screenshots, and dates; app deletion may not erase data already shared with vendors or third parties.
  • For medical concerns such as bleeding, severe pain, decreased fetal movement, fainting, high fever, or symptoms that feel urgent, contact your clinician, urgent care, or emergency services. An app cannot decide medical urgency for you.