Does a Fertility Tracking App Need a BAA?

A fertility tracking app needs a business associate agreement (BAA) when its developer handles protected health information (PHI) on behalf of a HIPAA-covered health care provider, health plan, or another business associate. A direct-to-consumer app does not need a BAA merely because it collects sensitive fertility information or users enter that information themselves.

The key question is not whether the app tracks periods, ovulation, pregnancy, or fertility treatments. It is whether the app developer creates, receives, maintains, or transmits PHI on behalf of a covered entity. HHS guidance on apps and BAAs explains this distinction.

When does a fertility tracking app need a BAA?

A fertility app developer generally acts as a HIPAA business associate when a covered entity engages it to perform a service involving PHI on the covered entity’s behalf. For example, a fertility clinic might contract with an app company to provide its patients with cycle tracking, fertility treatment messaging, appointment support, or monitoring that feeds into the clinic’s care services.

If the app developer receives or stores identifiable patient information to provide that contracted service, the clinic generally must have a written BAA in place before allowing the developer to handle the PHI. An app developer may also be a business associate subcontractor if it handles PHI on behalf of another business associate, such as a vendor providing a clinic’s patient platform. HHS’s business associate guidance includes health app developers among its examples.

For instance, if a clinic supplies an app to patients and the app sends cycle records or treatment updates to the clinic for care management, the app’s role and data flows may create a business associate relationship. The specific arrangement matters: a provider’s name or logo in an app, by itself, does not determine whether a BAA is required.

When is a BAA not required for a fertility app?

A BAA is generally not required when a person independently chooses a consumer fertility app, enters information for personal use, and the app company is not handling that information on behalf of a covered entity. The fact that the data concerns health, or that it is sensitive, does not by itself make the app developer a HIPAA business associate.

A provider’s transmission of records at the individual’s direction does not automatically make the receiving app a business associate. HHS explains that simply facilitating access to PHI at the individual’s request does not create that relationship; the app must be performing a function on behalf of or for the benefit of the covered entity. See HHS’s guidance on patient-directed app access.

A software vendor also does not become a business associate solely by selling software to a provider if it cannot access the provider’s PHI. If the vendor hosts patient data or accesses it while providing support, however, the relationship may require a BAA. HHS explains how software vendors’ access affects their role.

How HIPAA applies to consumer fertility-tracking apps

HIPAA applies to covered entities—such as certain health care providers, health plans, and health care clearinghouses—and to business associates performing covered functions or services on their behalf. PHI generally means individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate in a covered context.

That means an identifiable fertility history may be PHI when a covered clinic or its business associate handles it, but the same person’s information in an unaffiliated consumer app is not automatically protected by HIPAA. HHS states that HIPAA generally does not protect information people voluntarily enter into apps that are not developed or offered by or on behalf of a regulated entity. HHS guidance on health apps and online tracking explains this distinction.

When a covered entity provides an app or uses an app developer to manage PHI, the covered entity remains responsible for complying with HIPAA, and the app developer may have direct obligations as a business associate. When a person directs a provider to send information to an unaffiliated app, HIPAA protections generally do not follow the information into that app once it receives it. HHS describes how patient-directed transfers affect HIPAA coverage.

What a fertility app BAA must cover

A BAA should describe the app developer’s role and set clear rules for handling PHI. Under HIPAA, the agreement must address matters including permitted uses and disclosures, safeguards, incident reporting, individual rights, HHS oversight, subcontractors, and what happens to PHI when the relationship ends. HHS lists required BAA provisions.

• Permitted uses and disclosures: Specify how the app may use PHI to provide the contracted service and prohibit uses or disclosures beyond the agreement or what the law requires.
• HIPAA Security Rule safeguards: Require appropriate protections for electronic PHI, including safeguards against unauthorized access, use, or disclosure.
• Security incident reporting: Require the app developer to report impermissible uses or disclosures and breaches as required by the agreement and HIPAA.
• Individual rights and oversight: Address assistance with applicable requests for access, amendment, and accounting, and make relevant records available to HHS for compliance review.
• Subcontractors and termination: Require subcontractors handling PHI to accept applicable protections and address returning or destroying PHI when feasible after the agreement ends.

A BAA is not proof that an app or clinic is fully HIPAA compliant. The parties still need to follow the agreement and meet their own applicable HIPAA duties; a written contract alone does not replace appropriate security practices.

How to assess an app’s role and data flows

Before deciding whether a BAA is needed, map how fertility information moves through the app and identify who directs each step. Consider whether the app is offered independently to consumers, supplied or paid for by a clinic, connected to the clinic’s systems, or used by clinic staff to provide or manage care.

• Identify the parties: Determine whether the app company works directly for a covered entity or through another business associate.
• Trace the information: Identify what the app collects—such as cycle dates, symptoms, test results, pregnancy status, or treatment details—and where that information is stored or sent.
• Clarify the purpose: Ask whether the app is supporting the individual’s personal tracking or carrying out a clinic’s service or care-management function.
• Review access: Check whether the app developer, hosting provider, analytics vendor, or support team can access identifiable patient information.
• Confirm contract terms: If the developer handles PHI on behalf of a covered entity, ensure the appropriate BAA is in place and covers relevant subcontractors.

HHS’s health app developer resources provide scenarios for evaluating an app’s function, data, and relationship with covered entities. Review the actual service arrangement and data flows rather than relying only on a privacy-policy label such as “HIPAA compliant.”

Limits of HIPAA protection for fertility data

HIPAA is not a general privacy law covering every company that handles health information. If a person enters fertility information into an independent consumer app, HIPAA may not govern the app’s collection, use, or sharing of that information—even if the person previously obtained some of it from a health care provider.

Other requirements may apply. Depending on the app and its data practices, the Federal Trade Commission’s Health Breach Notification Rule may cover certain health apps that are not covered by HIPAA. The FTC’s rule guidance explains which types of businesses may have notification obligations.

In short, a fertility app generally needs a BAA when it handles PHI for a covered entity, not merely because it tracks reproductive health. The app’s relationship to the provider, the purpose of the service, and the path the data takes determine whether HIPAA’s business associate requirements apply.

FAQs

Does a fertility tracking app need a BAA to work with a healthcare provider?

Not in every arrangement. If the app developer creates, receives, maintains, or transmits PHI on behalf of the provider to deliver a service, the provider generally needs a BAA with the developer. A patient’s choice to send information to an independent app, by itself, does not create that relationship.

Is a consumer fertility app covered by HIPAA?

Not automatically. HIPAA generally applies to covered entities and business associates, not every consumer app that collects health information. A consumer app may fall within HIPAA when it is provided by or on behalf of a covered entity and its developer handles PHI for that entity.

Does a fertility app need a BAA if users enter health information themselves?

User entry alone does not settle the question. An independent consumer app generally does not need a BAA just because users enter fertility information. But if the app is being operated on behalf of a covered entity and handles PHI for that entity, a BAA may be required even when users enter some of the information themselves.

What obligations does a BAA impose on a fertility app?

A BAA sets limits on the app’s permitted uses and disclosures of PHI and requires applicable safeguards, reporting of specified incidents, cooperation with certain individual-rights obligations, appropriate protections for subcontractors, and return or destruction of PHI when the relationship ends if feasible. The exact agreement should reflect the service and applicable HIPAA requirements.