Are Period Tracker Apps Covered by HIPAA?

DEFINITION

HIPAA

The Health Insurance Portability and Accountability Act, a US federal law that sets privacy and security standards for protected health information. HIPAA applies specifically to covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates. Consumer health apps not connected to a healthcare provider are generally not covered.

DEFINITION

Covered entity

An organization that must comply with HIPAA: health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically. A period tracker app that operates independently and is not affiliated with a healthcare provider or insurer is not a covered entity.

DEFINITION

Business associate

A person or company that performs services for a HIPAA covered entity that involve access to protected health information. A software vendor serving a hospital, for example, is a business associate. A consumer app sold directly to the public is not.

DEFINITION

FTC Section 5

The section of the Federal Trade Commission Act that prohibits unfair or deceptive acts or practices in commerce. This is the primary federal law applied to consumer health app privacy violations. The FTC's enforcement actions against Flo (2021) and Premom (2023) were brought under Section 5.

The HIPAA Misconception

Many people assume that health data is protected by HIPAA. This assumption is reasonable — HIPAA is the most prominent health privacy law in the US — but it leads to a false sense of security when using consumer health apps.

HIPAA was designed for the healthcare system: hospitals, clinics, insurers, and the companies that serve them. When you share health information with your doctor, HIPAA governs how that information can be used and disclosed. When you enter the same information into a consumer app, HIPAA does not apply.

This is not a loophole — it is an intentional scope limitation. HIPAA was enacted in 1996, long before consumer health apps existed. Congress has not updated the law to cover them.

What FTC Section 5 Actually Provides

The FTC’s enforcement authority under Section 5 covers unfair and deceptive practices. Applied to period trackers, this means:

• A company that says it will not share your data and then shares it can face an FTC enforcement action (as Flo did in 2021)
• A company that shares data in ways users would not reasonably expect may face enforcement
• A company that accurately discloses in its privacy policy that it shares data with advertisers is, from the FTC’s perspective, not being deceptive

The standard is not “protect health data.” The standard is “do not lie about what you do with health data.” This is meaningfully weaker.

State Laws: A Patchwork of Protections

California’s CCPA gives residents rights to know what data is collected, opt out of sale, and request deletion. Washington’s My Health MY Data Act (effective March 2024) created specific protections for consumer health data. Texas and other states have enacted their own frameworks.

If you are a California, Washington, or similarly covered resident, your state law provides more specific health data protections than federal law. If you are not, your protections depend primarily on the FTC’s enforcement posture and the app’s voluntary commitments.

The Architectural Alternative to Legal Protection

Legal protections depend on companies complying, regulators enforcing, and laws keeping pace with technology. Architectural protection — using an app that never sends your data to a server — does not depend on any of these. It works regardless of the legal environment because there is no data at the company end to protect, misuse, or produce.