privacy-in-practice

Period Tracker Data and Health Insurance Discrimination

Period tracker data isn't covered by HIPAA. Here's how it can reach insurers through data brokers, what the ACA protects, and how to reduce exposure.

The HIPAA Gap That Affects Every Period Tracker User Most people assume health data has legal protection. It does, but only when held by covered entities: doctors, hospitals, health insurers, and their business associates. That protection is HIPAA, the Health Insurance Portability and Accountability Act. Consumer apps are not covered entities. The FTC confirmed this clearly in its enforcement action against Flo Health in 2021. The FTC found Flo shared period dates, pregnancy status, and health symptoms with Facebook and Google. The FTC's authority came from general consumer protection law (Section 5 of the FTC Act), not HIPAA, because HIPAA simply didn't apply. The $59.5M class action that settled in September 2025 was a civil action. The data sharing itself wasn't illegal under HIPAA because HIPAA never covered Flo's data. This gap is the foundation of every insurance risk that follows. How Data Reaches Insurers The direct path, an insurer subpoenaing your period tracker, is not the realistic concern. A major insurer issuing targeted subpoenas to consumer app companies would trigger significant legal and public relations consequences and isn't a common practice. The realistic path