HIPAA Compliance Guide for Fertility and Egg Donor Agencies

Which fertility and egg donor agencies are covered entities or business associates under HIPAA?

Fertility and egg donor agencies are not automatically covered by HIPAA just because they handle sensitive information. HIPAA applies to covered entities—health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically—and to business associates that perform specified services for covered entities involving protected health information (PHI). See HHS’s guidance on covered entities and business associates.

A fertility clinic that provides health care and conducts a covered electronic transaction, such as electronic claims billing, will generally be a covered entity. A separate matching or coordination agency may be a business associate if it handles PHI on behalf of a covered clinic—for example, by carrying out contracted administrative or care-coordination functions. The relationship and the work performed matter; sharing referrals or doing business together does not, by itself, make an agency a business associate.

Agencies should assess each service and data flow, including whether they act independently or on behalf of a covered clinic. An agency that is neither a covered entity nor a business associate is not subject to HIPAA’s rules solely because it holds sensitive information, although other laws, contracts, and privacy obligations may apply.

What protected health information do fertility and donor agencies handle?

PHI is individually identifiable health information held or transmitted by a covered entity or its business associate, in any form—including electronic records, paper files, and oral communications. It relates to a person’s health or condition, health care, or payment for health care, and identifies the person or could reasonably be used to identify them. HHS explains the definition in its Summary of the HIPAA Privacy Rule.

Depending on an agency’s role, records may include donor or recipient medical histories, fertility evaluations, treatment and screening information, genetic test results, reproductive health details, treatment dates, and identifying details linked to those records. Genetic information can be PHI when it is individually identifiable and maintained by a covered entity or business associate, as HHS explains in its guidance on HIPAA and genetic information.

Not every donor profile or agency record is automatically PHI. Whether HIPAA applies depends on who holds the information and the agency’s relationship to a covered entity. Agencies should map where information originates, who can access it, how it is shared, and whether identifiers are connected to health information.

How should agencies manage HIPAA authorizations and patient consent?

Distinguish a general consent for care from a HIPAA authorization. A covered entity may generally use or disclose PHI for treatment, payment, and health care operations without a separate authorization, subject to the Privacy Rule. For other uses or disclosures that are not otherwise permitted or required, it generally needs the individual’s written authorization. A notice of privacy practices is not a substitute for an authorization when one is required, as HHS explains in its guidance on authorization requirements.

When an authorization is required, make it specific and understandable. It should identify the information to be disclosed, who may disclose it, who may receive it, the purpose, and an expiration date or event. It must also include required statements, such as the individual’s right to revoke it and the possibility that the recipient may redisclose the information. See HHS’s Privacy Rule summary.

Before sharing donor or recipient health information with intended parents, confirm whether the information is PHI and whether the agency is acting as a covered entity or business associate. If HIPAA applies, obtain a valid authorization for a disclosure that is not otherwise permitted or required. Donor agreements, matching preferences, or a general consent form do not automatically replace that authorization. Where the minimum necessary standard applies, limit the disclosure to what is reasonably needed for its purpose; the standard does not apply to disclosures made pursuant to an individual’s authorization.

HHS reports that a federal court order issued on June 18, 2025, vacated most of the 2024 HIPAA reproductive-health privacy rule. Certain notice-of-privacy-practices revisions remained in effect, with a February 16, 2026 compliance date. Agencies should consult HHS’s current reproductive-health privacy rule fact sheet and consider applicable state law.

What safeguards protect donor and recipient health information?

For covered entities and business associates, the HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI (ePHI). Start with an accurate and thorough risk analysis of the ePHI you create, receive, maintain, or transmit, then use the results to select and manage safeguards. HHS describes these requirements in its Summary of the HIPAA Security Rule and risk analysis guidance.

• Administrative safeguards: Assign security responsibilities, set workforce access rules, train staff on agency policies, plan for security incidents, and review safeguards as risks or systems change.
• Physical safeguards: Control access to facilities and workstations, and protect devices and media containing ePHI.
• Technical safeguards: Use appropriate access controls, authentication, audit controls, integrity protections, and transmission security.

Use role-based access so staff can view only the information needed for their work, and maintain procedures for securely handling paper records and conversations as well as electronic files. Encryption is an addressable Security Rule implementation specification, not a one-size-fits-all requirement: assess whether it is reasonable and appropriate for your circumstances and document the decision and any alternative safeguard. HHS explains this distinction in its encryption guidance.

How should agencies handle vendor agreements and business associate agreements?

If a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity—or performs a service for the covered entity that involves PHI—the vendor may be a business associate. A covered entity generally must have a written business associate agreement (BAA) or other qualifying written arrangement in place before the business associate handles PHI. HHS explains which relationships require a BAA in its Business Associates FAQ.

Review vendors based on the work they perform and the information they handle. Cloud storage, case-management platforms, billing support, and other services may require a BAA when they meet the business associate definition. A BAA should describe permitted uses and disclosures, require appropriate safeguards, address incident and breach reporting, set out relevant individual-rights support, and cover return or destruction of PHI when the relationship ends where feasible.

Business associates must also obtain written assurances from subcontractors that handle PHI on their behalf. A BAA does not replace the need to assess the vendor relationship, restrict access, and follow up on known material contract violations. HHS’s sample BAA provisions outline key contractual elements.

What are the breach notification requirements and reporting timelines?

The HIPAA Breach Notification Rule applies to breaches of unsecured PHI. An impermissible use or disclosure is generally presumed to be a breach unless the covered entity or business associate demonstrates, through the required risk assessment, that there is a low probability the PHI was compromised. Follow a written response process: secure affected systems, investigate what happened, preserve relevant records, assess the information and individuals involved, mitigate harm, and document the decision and actions.

A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach. For a breach affecting 500 or more individuals, it must notify HHS without unreasonable delay and within 60 days; breaches affecting fewer than 500 individuals may be reported to HHS annually, no later than 60 days after the end of the calendar year. If a breach affects more than 500 residents of a state or jurisdiction, notice to prominent media outlets serving that area is also required. HHS summarizes these requirements in its Breach Notification Rule guidance.

A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 days after discovery, and provide available details about affected individuals and the incident. A BAA may set a shorter reporting deadline, so agencies should follow the contract’s specific process and notify the covered entity promptly. If an agency is not a covered entity or business associate, HIPAA’s breach-notification deadlines may not apply to it, but other applicable notification laws may.

In practice, compliance depends on correctly identifying your role, limiting access and disclosures, using appropriate safeguards, documenting vendor relationships, and having a tested breach-response process. Review these controls as your agency’s services, vendors, and applicable requirements change.

FAQs

Are fertility and egg donor agencies automatically covered by HIPAA?

No. An agency is covered by HIPAA only if it meets the definition of a covered entity or business associate. A fertility provider may be a covered entity if it conducts certain covered electronic transactions; an agency may be a business associate when it handles PHI on behalf of a covered entity as part of a qualifying service.

When does an agency need a business associate agreement?

A BAA is generally needed when an agency performs a qualifying service on behalf of a covered entity and the work involves PHI. The covered entity and agency should assess the actual services, data flows, and relationship before PHI is exchanged.

Can donor information be shared with intended parents without authorization?

If the information is PHI and HIPAA applies, a covered entity generally needs a valid authorization to share it unless the disclosure is otherwise permitted or required by the Privacy Rule. An agency should not assume that a donor agreement, general consent, or profile-sharing practice alone authorizes disclosure of PHI.

What should an agency do after discovering a breach of protected health information?

Secure the information and affected systems, investigate and document the incident, assess whether unsecured PHI was involved and whether notification is required, and take steps to mitigate further harm. If the agency is a business associate, notify the covered entity promptly according to the BAA and HIPAA’s applicable deadline; the covered entity generally manages required notices to individuals, HHS, and, when applicable, the media.