HIPAA Compliance Checklist for Fertility Tracking App Developers

When Does HIPAA Apply to a Fertility Tracking App?

HIPAA applies to covered entities—health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically—and to business associates that handle protected health information on their behalf. A fertility tracking app is not covered by HIPAA simply because it collects sensitive reproductive health data. The app developer’s role and relationship with a covered entity matter. See HHS’s overview of covered entities and business associates.

For example, a standalone app that consumers download and use for their own cycle tracking may fall outside HIPAA. By contrast, an app a clinic provides to patients, where the developer handles patient information for the clinic, may bring the developer within HIPAA as a business associate.

HIPAA’s definition of protected health information (PHI) covers identifiable health information handled by a covered entity or business associate. It does not make every identifiable health detail held by every company PHI under HIPAA. Review both the data and the relationship in which your company receives or uses it, as explained in HHS’s guidance on PHI and individually identifiable health information.

Identify Fertility and Reproductive Health Data the App Collects

Inventory data across the app, website, connected devices, and support systems. Fertility tracking can involve more than cycle dates. Record whether the app collects or infers:

• Menstrual dates, bleeding patterns, cycle length, and ovulation or fertility-window estimates.
• Symptoms, mood, temperature, sexual activity, pregnancy-test results, pregnancy status, or pregnancy loss.
• Infertility diagnoses, fertility treatments, medications, clinic visits, appointment details, or laboratory results.
• Names, email addresses, account details, device identifiers, advertising IDs, IP addresses, location, and free-text entries.
• Insights or predictions generated by combining user entries with wearable, health-platform, or clinic data.

For each data type, document its source, purpose, sensitivity, storage location, access, recipients, and retention period. Consider whether combinations of otherwise ordinary data could reveal a user’s reproductive health or identity. When HIPAA applies, identifiers associated with health or care information may be PHI; de-identification must meet HIPAA’s applicable standard rather than rely on simply removing a name.

Determine Whether the Developer Is a Business Associate

Assess what your company does for each health care customer. A developer may be a business associate when it creates, receives, maintains, or transmits PHI on behalf of a covered entity to perform a function or service for that entity. HHS specifically identifies certain app developers serving a covered entity’s patients as potential business associates. The label in a contract is not a substitute for reviewing the actual relationship. See HHS’s business associate guidance.

If the relationship makes your company a business associate, put a written business associate agreement (BAA) in place before handling PHI. The agreement should define permitted and required uses, prohibit unauthorized uses and disclosures, address safeguards and incident reporting, and cover relevant subcontractors. A company that offers both a consumer app and a clinic service should assess each data flow separately: one product or customer relationship does not automatically determine the status of another.

An app developer does not become a business associate merely because a user chooses the app to receive information from a provider. HHS says an individual-directed transfer alone does not create that relationship if the app is not provided by or on behalf of the covered entity. See HHS’s guidance on individual-directed app transfers.

Map Data Flows and Third-Party Integrations

Draw a data-flow map from collection through deletion. Include information entered by users, imported from a clinic or health record, synced from wearables, and inferred by app features. Map where each item travels, which systems store or process it, who can access it, and when it is deleted.

Include cloud hosting, analytics, advertising, crash reporting, customer support, payment processing, email, push notifications, and software development tools. Check what each integration receives in practice—not just what its documentation says it can receive. Events, URLs, campaign parameters, device identifiers, and error logs can expose sensitive context even when the underlying fertility entry is not sent as an obvious data field.

For HIPAA workflows, identify business associates and subcontractors, confirm the required agreements are in place, and limit each recipient’s access and use to the authorized purpose. HHS explains that vendors handling PHI for a covered entity may qualify as business associates, including cloud and technology service providers. See HHS’s examples and BAA requirements.

Review Tracking Technologies and PHI Disclosures

Inspect tracking pixels, cookies, software development kits, session replay, advertising tools, and analytics scripts in both the app and its websites. Test the data they transmit during account creation, cycle logging, symptom searches, clinic integrations, and appointment-related actions. Pay particular attention to event names and identifiers that could connect a person to reproductive health information.

When a covered entity or its business associate handles PHI, tracking technology disclosures must have a valid HIPAA basis. A privacy notice that says tracking is used does not, by itself, authorize disclosure of PHI to a vendor. Depending on the relationship and purpose, the vendor may need a BAA and the disclosure must be permitted under the HIPAA Privacy Rule; otherwise, an appropriate HIPAA authorization may be required. See HHS’s tracking technology guidance.

Apply that guidance within its limits: a court vacated the portion that treated an IP address linked to a visit to an unauthenticated public health-related webpage, by itself, as triggering HIPAA obligations. HHS’s current page describes that limitation. It does not eliminate the need to assess other tracking technology disclosures, such as information entered into a regulated entity’s app or patient portal.

Assess Privacy and Breach-Notification Laws Beyond HIPAA

A consumer fertility app outside HIPAA may still be subject to other federal or state requirements. The Federal Trade Commission Act can apply to app developers’ privacy and security practices, including misleading privacy promises or unfair handling of sensitive data. The FTC’s Mobile Health App Interactive Tool identifies federal laws that may apply to apps collecting health information.

Assess whether the FTC’s Health Breach Notification Rule applies. It covers certain vendors of personal health records, related entities, and service providers; the FTC explains that a personal health record can include an identifiable electronic record with the technical capacity to draw information from multiple sources and that is managed, shared, and controlled by or primarily for the individual. The amended rule clarifies its application to health apps and similar technologies. Review the FTC’s Health Breach Notification Rule guidance and build an incident-response process around the rules that apply to your product.

State laws may cover consumer health data or impose separate consent, privacy, and breach-notification duties. For example, Washington’s My Health My Data Act defines consumer health data to include linked or reasonably linkable information identifying a consumer’s health status, and expressly addresses reproductive or sexual health information. It generally requires separate consent for sharing, subject to statutory exceptions. Check the Washington law’s definitions and collection and sharing requirements, and assess other states based on where your users are and where your app operates.

Do not assume that all of the 2024 HIPAA reproductive-health privacy amendments remain in force. HHS reports that a federal district court vacated most of that rule on June 18, 2025, while certain Notice of Privacy Practices modifications remained. Review HHS’s current rule-status summary and applicable state law when evaluating reproductive-health data practices.

Build a Practical HIPAA Compliance Checklist

Use this checklist to turn your assessment into documented product and operational controls:

• Document HIPAA status. Identify covered-entity and business-associate relationships for each product, customer, and data flow.
• Maintain a data inventory. List reproductive health data, identifiers, inferences, sources, purposes, recipients, storage locations, and retention periods.
• Review every integration. Confirm what each SDK, vendor, and subcontractor can access and what it actually receives.
• Execute required agreements. Put BAAs in place where the relationship requires them, and limit vendors’ access and use by contract and system design.
• Control tracking technology disclosures. Disable or configure tools that transmit PHI without an applicable permission, and test behavior after app or website changes.
• Assess security risks. If HIPAA applies, perform and document an accurate, thorough risk analysis and implement appropriate administrative, physical, and technical safeguards under the HIPAA Security Rule. See HHS’s Security Rule summary.
• Make privacy choices clear. Describe collection, use, sharing, and retention accurately. Obtain an authorization when the HIPAA Privacy Rule requires one; do not treat a general privacy notice as a substitute.
• Prepare for incidents. Define escalation, investigation, evidence preservation, and notification responsibilities. Under HIPAA’s breach notification rule, required notices must be made without unreasonable delay and no later than 60 days after discovery; a business associate must notify the covered entity under the applicable rule. See HHS’s Breach Notification Rule guidance.
• Review changes and train relevant staff. Reassess data flows, vendor access, privacy statements, and security controls when features, integrations, or business relationships change.

In short, a sound HIPAA compliance checklist for fertility tracking app developers starts with the app’s role and data flows—not with the sensitivity of the data alone. Map reproductive health information, control tracking technology disclosures, and assess HIPAA alongside FTC and state requirements.

FAQs

Does HIPAA apply to every fertility tracking app?

No. HIPAA applies to covered entities and their business associates, not automatically to every app that collects health data. A standalone consumer app may fall outside HIPAA, while an app handling PHI on behalf of a covered clinic may bring its developer within HIPAA as a business associate. See HHS’s covered-entity overview.

When can a fertility app developer qualify as a business associate?

A developer may qualify when it creates, receives, maintains, or transmits PHI on behalf of a covered entity to perform a function or service for that entity. If so, the parties generally need a written business associate agreement before the developer handles PHI. See HHS’s business associate guidance.

Is reproductive health information in a consumer app automatically protected by HIPAA?

No. Reproductive health data is not automatically protected by HIPAA simply because it is sensitive. HIPAA applies based on the entity’s status and relationship to the information. Other laws, including the FTC Act, the Health Breach Notification Rule, and applicable state laws, may still apply to a consumer app. See HHS’s app guidance and the FTC’s health breach guidance.

Can a privacy notice authorize sharing protected health information?

Not by itself. HHS states that a privacy notice describing tracking does not alone permit a HIPAA-regulated entity to disclose PHI to a tracking technology vendor. The disclosure needs an applicable HIPAA permission and, when required, a valid authorization; a vendor acting as a business associate may also need a BAA. See HHS’s tracking technology guidance.

What other privacy laws may apply to fertility tracking apps?

Depending on the app and the people it serves, the FTC Act, the FTC Health Breach Notification Rule, state consumer-health-data laws, and state breach-notification laws may apply. For example, Washington’s My Health My Data Act addresses consumer health data, including reproductive or sexual health information, and sets requirements for collection and sharing. Assess each law’s scope and exceptions for your app. See the FTC’s mobile health app tool and Washington’s My Health My Data Act.