When people think about protecting their reproductive health information, many assume HIPAA shields nearly everything. According to Andrew Crawford, senior policy counsel with the Center for Democracy & Technology’s Privacy and Data Project, that assumption is one of the biggest misconceptions in the post-Dobbs landscape.
“It’s really upon each user, each consumer, to do their homework and make sure they’re comfortable with those privacy practices that are associated with these very sensitive data sets,” Crawford said.
HIPAA, he explained, was designed to regulate healthcare providers, insurers and others directly involved in medical treatment. It generally limits how those entities can use or disclose patients’ health information outside the delivery of care. But the law’s protections end much sooner than many Americans realize.
The growing ecosystem of consumer health technology—including fitness trackers, smartwatches, fertility apps, period trackers, and AI chatbots—often falls entirely outside HIPAA. Instead, those companies largely establish their own privacy rules through lengthy terms of service and privacy policies that consumers rarely read before clicking “accept.” Crawford said that leaves users responsible for understanding how companies collect, retain and share highly sensitive information.
That distinction has become increasingly significant since the Supreme Court overturned Roe v. Wade.
Medical records remain important, but Crawford said digital evidence extends far beyond physicians’ offices. Information entered into reproductive health apps, conversations with large language models, wearable devices and fitness trackers may all reveal details about someone’s reproductive health.
“It’s not that hard to deduce that you and/or someone in your vehicle or with your device have sought reproductive care because you’ve gone to that clinic,” Crawford said. “The same thing is true with even things like shopping histories.
“If you’ve suddenly started buying a lot of prenatal vitamins or things that might indicate you’ve become pregnant, those data sets can also be very prohibitive into your reproductive health.”
Those separate streams of information frequently converge through another industry many consumers know little about: data brokers.
Crawford explained that data brokers assemble information from numerous sources to create detailed consumer profiles. Those profiles can include inferred categories such as people who are pregnant, trying to conceive or recently gave birth. Rather than relying on any single medical record, companies can combine multiple pieces of commercial data to reach surprisingly accurate conclusions about an individual’s reproductive health.
While HIPAA generally prohibits healthcare providers from selling or sharing patient information with advertisers, technology companies operate under very different rules. Outside the healthcare system, companies primarily must follow the promises they make in their own privacy policies. Federal regulators can pursue companies that misrepresent those practices, but consumers often have little ability to negotiate how their information will be handled beyond deciding whether to use a product at all.
Dobbs fundamentally altered the legal landscape for reproductive health data because abortion restrictions created new categories of investigations in some states. Crawford said that has produced a growing divide between states that criminalize abortion-related conduct and others that have enacted shield laws designed to prevent reproductive health records from being shared with out-of-state investigators pursuing abortion-related cases.
For consumers evaluating period-tracking or fertility applications, Crawford recommended paying close attention to several questions before downloading an app. Users should understand what information is being collected, whether the company gathers additional data beyond what is necessary for the service, whether information is shared with third parties and whether data is stored locally on a device or uploaded to cloud servers. He also pointed to recent independent evaluations of privacy practices, including reports examining reproductive health apps.
Encryption also plays an important role in protecting sensitive communications.
Crawford said consumers should understand the difference between protecting information while it is traveling across the internet and protecting it once it is stored on devices or cloud backups. Ideally, sensitive communications should remain encrypted throughout both stages, and users should understand whether cloud backups receive the same protections as messages stored directly on their devices.
Although technology companies have made some progress since Dobbs, Crawford believes significant structural problems remain. He argued that many companies continue collecting more personal information than necessary and often retain it longer than needed. A stronger privacy model, he said, would collect only the information required to provide a requested service and delete sensitive reproductive health data once it is no longer necessary. That approach would also limit what companies could produce if they later received requests from law enforcement.
“There’s still plenty of work that companies can do when it comes to tightening up their practices,” Crawford said.
Looking ahead, Crawford said comprehensive federal privacy legislation remains the most important reform. Such a law could establish consistent protections for sensitive health information that currently falls outside HIPAA, while states have continued advancing their own privacy legislation in the absence of broad federal action. Stronger laws, he said, should focus on limiting unnecessary data collection, sharing and retention while ensuring companies use personal information only for the purposes consumers reasonably expect.
Artificial intelligence will likely become another major front in the debate. Crawford expects AI to increase both the volume of sensitive information collected and the complexity of privacy questions surrounding reproductive health investigations.
“AI not only exacerbates, but just increases the kind of data that is being collected and could be sought by law enforcement for reproductive health investigations,” Crawford said.
Whether Congress ultimately enacts comprehensive privacy legislation or states continue filling the gap, he believes the central challenge will remain the same: limiting unnecessary collection of reproductive health data before it can ever become available to investigators, advertisers or data brokers.
We deliberately don’t keep electronic medical records.
HIPAA is often described as a shield for patient privacy, but it has important exceptions. While HIPAA generally limits when healthcare providers can share protected health information, it also permits disclosures that are required by law—including in response to a valid court order, subpoena, or other legal process under certain circumstances.
That matters because most healthcare providers use electronic medical record (EMR) systems. Those records don’t exist only in a doctor’s office—they are also stored, managed, or backed up by third-party EMR companies. If those companies receive a legally enforceable demand for records, they may be required to produce information they maintain, subject to applicable federal and state law.
For patients seeking highly sensitive healthcare, including reproductive healthcare in states with aggressive investigations, this reality is worth understanding. Digital records can include far more than a diagnosis or prescription. Depending on the system, they may contain appointment logs, clinical notes, laboratory results, billing information, patient messages, and metadata about when records were created or accessed.
HIPAA is an important privacy law, but it is not an absolute promise that information can never be disclosed. It regulates how health information may be used and shared; it does not categorically prevent records from being obtained through lawful legal processes.
This is why conversations about medical privacy need to extend beyond HIPAA. Patients deserve to understand what information is collected, where it is stored, who has access to it, and under what circumstances it could be disclosed. True privacy depends not only on legal protections, but also on thoughtful decisions about how healthcare information is collected, stored, and retained.