privacy-in-practice

Published by Floriva · Updated 2026-07-31 · How Floriva checks its guides

Your Medical Records and Period Data

Patient portals, proxy access, EOBs, lab and imaging results, and telehealth. Where your cycle data ends up in a medical record, and who else can see it.

Care creates copies. A visit note, an after-visit summary, a portal message, a lab report, a bill, and an insurance notice can each carry period data. Some of those copies go to people you did not pick. This page shows where the copies land and which ones you can change.

Getting care is good for you. It is also a copy machine.

One appointment can create a lot of paper. A visit note. An after-visit summary. A portal message. A lab order and a lab report. A bill. An insurance notice. Each of those can carry period data. A few of them go to people you did not choose.

This page maps where the copies land and which ones you can change. It is not legal or medical advice.

1. What HIPAA gives you, and what it does not

HHS says the HIPAA Privacy Rule gives you rights over your health information. It also sets limits on who can look at it and receive it. It sets national standards for covered entities and their business associates.

HHS also says covered entities may use and share protected health information for treatment, payment, and health care operations. That last part is the piece people miss. HIPAA is a set of rules, not a wall.

So keep two ideas side by side:

• Your clinician's notes about your cycle are covered.

• A consumer period app account is not covered, unless the app is offered by a covered entity or a business associate.

That gap is why FTC rules matter for apps. The FTC says health apps and similar technologies can fall under the Health Breach Notification Rule when they handle personal health records. And the FTC alleged that Flo shared users' health data with Facebook, Google, and analytics providers after promising privacy.

Two rights worth knowing:

• HHS says HIPAA access rights can include information in a designated record set. Its examples involve lab results and electronic access. You can ask to see and get copies of your records.

• HHS says many plans and covered providers must give you a notice explaining privacy rights and practices. Read yours. It should say how to request records and how to ask for a correction. It should also say how family access works and how to file a complaint.

2. Your portal holds more than the visit

People check portals for results. Period data sits in more places than that.

Notice the last two rows. Those are the ones you can usually change today.

Alerts. Result and message alerts show up in more places than the portal. An email subject line. A text preview. A push alert. A watch. A calendar reminder. A portal home screen card. Ask the clinic for plain subject lines. Turn off text alerts if you share a phone. Switch to portal-only notice if the option exists.

Devices. A portal on a shared tablet or a family computer keeps downloads. Check the Downloads folder after you save anything.

3. Proxy access: who else can open your chart

Proxy access is portal access given to another person. It can be full or limited, and clinics define those differently.

A proxy may be able to see appointments, visit notes, messages, test results, bills, medications, attachments, and form answers.

Do not assume "limited access" hides period notes. Ask your clinic for the exact list of sections a proxy can open.

Questions worth asking by name:

• Who currently has proxy access to my chart?

• Which sections can each proxy see?

• Can they read my messages?

• Can they see test results, and all of them or some?

• Does access change at a certain age?

• Does access change by care type?

• Are sexual health notes handled differently?

• Are menstrual notes handled differently?

• How do I remove a proxy, and how long does it take?

The legal frame behind this is short. HHS says a family member's right to your protected health information usually turns on one question. Is that person your personal representative under state or other law? HHS also says a covered provider or plan generally must let a personal representative see and copy protected health information.

For minors, HHS says the Privacy Rule generally allows a parent to access a minor child's records. The parent acts as the child's personal representative. That holds when the access is not inconsistent with state or other law. That last part carries a lot of weight, and it varies. Clinics also change teen proxy settings at certain ages. Ask your clinic what its policy is instead of guessing.

4. The EOB problem

This is the copy most people never see coming.

An EOB is an Explanation of Benefits. It is a notice from a health plan explaining a claim. It is not a bill. It can still say a great deal.

What an EOB can show:

• Date of care

• Provider name and clinic name

• Type of service

• Lab name

• Prescription claim

• Amount billed, amount paid, amount you may owe

• Claim status, including denial or review notes

The problem is delivery. On a family plan, the notice may go to the policyholder, not the patient. More than one adult may receive it. It may arrive by paper mail, email, portal, or some mix.

Call your plan and ask, in these words:

• Who receives EOBs for this plan?

• Can I choose paper only, email only, or portal only?

• Can I use a separate mailing address?

• Can I use a separate email address?

• Can I turn off claim alerts?

• Can any plan holder see my claims?

• Can a dependent receive private messages?

Do not assume the answer. Plans work differently from each other. Ask your plan for a confidential communication. That means they send notices somewhere else. Plan rules vary. Ask what your plan can do for your account.

5. Result trails: what each result leaves behind

A result is rarely one document. It is a trail.

For most results, the trail runs like this. A portal result list entry. The full report. A clinician message. A PDF download with a file name. An email or text alert. A visit note saying why the test was ordered. A bill. An insurance claim.

That means the file name and the subject line matter as much as the result.

Pap and HPV. CDC explains that a Pap test checks the cervix for cell changes. Those changes may become cervical cancer if not treated. CDC also explains that an HPV test checks for HPV types that can cause cervical cancer. NCI explains the wording of results. They can use terms such as normal, unclear, abnormal, unsatisfactory, HPV-negative, and HPV-positive.

One caution about HPV results. A result label invites people to guess about you, a partner, sex, or timing. It does not answer those questions, and nobody needs to be blamed. Decide who actually needs to know before you forward anything.

Breast imaging. CDC says a doctor reads mammograms and reports results. ACR says patients get a plain summary of a mammogram result. The trail here usually adds a result letter with a title and date, plus a facility name on the bill.

Labs, including thyroid and iron. These start as simple numbers. The copies around them say more. A portal note can name fatigue. A visit summary can name period changes. A file name can name the test. A claim adds another trail.

Practical steps for any result:

• Rename PDFs before you save or send them.

• Check whether the download went to a shared device.

• Turn off lock screen previews for portal alerts.

• Delete old downloads you no longer need.

• Check whether the lab has its own separate portal and account.

6. Telehealth

Telehealth for birth control, PCOS, or irregular cycles has a common shape. You type cycle data straight into a company's app. Two different things then happen with that data.

The clinician writes a record. That part is a medical record.

The service also runs software. Analytics and crash reporting kits can send health events along with device identifiers. That is the pattern the FTC described in the Flo case. Health events went out with descriptive names attached. Some services run ads on a free tier. Some send prescribing to outside physician networks and share your data with them under agreements.

Read the service's policy for these words. Analytics partners. Service providers. Business purposes. Aggregated health data.

Also be careful with one phrase. "HIPAA compliant" is not the same as "HIPAA covered." A company can follow HIPAA-style practices without being legally bound by them. A covered entity must give you a Notice of Privacy Practices. Look for that notice.

7. Bring a summary, not an export

MedlinePlus says preparing helps you get more from a visit. Write down symptoms. List your questions. Take notes. Learn how to get your records. That is also the privacy-friendly move, because a summary carries less than a full export.

HHS describes a minimum necessary standard for covered entities: limit protected health information to what is needed for the purpose. You can apply the same idea to what you hand over.

What clinicians usually find useful:

• Cycle length history over several months. The gap from the first day of one period to the first day of the next. A pattern is more useful than one month.

• Flow duration and how heavy. How many days of bleeding, and how heavy on the heaviest days. Product counts are more objective than a rating.

• Pain, with the date and cycle day. Use one scale and stay on it. Log the days without pain too, because that is what shows a cyclical pattern.

• Timing of pain relative to bleeding. When pain starts and when it peaks matters for conditions like endometriosis.

• Pain location. Lower belly, low back, rectal area, legs. Log locations separately if more than one is involved.

• Symptoms outside the bleeding window. Spotting between periods, ovulation pain, pain with sex, pain with urination or bowel movements. These often get left out because app screens focus on bleeding. Use the notes field.

• Functional impact. Hours of work or school missed, plans canceled, days you had to lie down. Clinicians often respond to this most directly.

• Basal body temperature charts, if you have been charting and the question is about ovulation.

What is usually less useful, unless it is the reason for the visit: mood emoji streaks, skin ratings, and food cravings.

Use a short template like this instead of exporting everything:

Cycle summary
    
    Time range:
    
    Period start dates:
    
    Typical length and range:
    
    Flow, heaviest days:
    
    Pain: score, cycle day, location:
    
    Symptoms outside bleeding days:
    
    Function impact:
    
    Medicines or treatment changes:
    
    What I want help with:

Then decide the handoff, recipient by recipient.

8. When you are documenting for insurance

Sometimes the point of the record is to get care approved. That is a different goal from keeping data small, and it is a fair reason to write more down.

For PCOS, a documented log of actual cycle lengths over several months is stronger than saying periods are irregular. Also document symptom presence and severity, not only dates, so there is a before-and-after when treatment starts. Functional impact matters too, because appeals often turn on demonstrated impairment. If you are already on treatment, log how cycles and symptoms changed on it. That is evidence for continued coverage.

For endometriosis, the useful record is pain by cycle day over several months, with location, non-bleeding-day symptoms, and hours missed. A chart reads faster than a paragraph. A simple table of date, cycle day, pain score, and one note works fine.

Then say it the way clinicians think. "I have logged symptoms for six months. Pain starts a few days before bleeding, peaks during the heaviest days, and I have missed work most cycles." That framing gets used in a referral letter.

9. Before you upload, message, or screenshot

Run this list every time:

• Who will receive this?

• Why do they need it?

• Is a one-page summary enough?

• Does it include sex, partner, or conflict notes?

• Does it include mental health or safety details?

• Does it include medicine or substance notes?

• Will it become part of the permanent record?

• Can I remove private notes first?

• Will a copy stay in email, cloud storage, or a portal?

• Where will the file live on my own device afterward?

If any answer is unclear, pause and ask before you send.

MedlinePlus notes that a personal health record can help you keep track of your own information across offices. Keeping your own copy is a good idea. Keep it somewhere you control.

What Floriva changes

Floriva keeps basic tracking on your device, so the app is not another server holding your cycle history. When you want to share, you can prepare a short summary instead of handing over everything.

It does not change what your clinic records, what your plan mails, or who has proxy access to your chart. Those are separate doors, and the steps above are how you close them. See how our data handling works.