Page 8 - September-October-2022-CBA-Report
P. 8

                                       Personal Data
10 DAYS
   Tracking i i n n a a P P o o s s t t - - R R o o e e W Wo o r r l l d d
 By Elise Elam and Vaughn Stupart
 8
THE REPORT | September/October 2022 | CincyBar.org
The U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Org to overturn Roe v. Wade, and the subsequent criminalization of abortion in several states, has led to a number of privacy-related questions and concerns. In particular, there is a real concern that the data collected by health apps, including period-tracking apps, along with internet search history and geographic location information, could be used in certain states to prosecute individuals who seek to terminate a pregnancy.
The data collected and stored by these apps is valuable beyond the cycle-tracking features intended for the end user. This data can provide third parties the ability to know which individuals are pregnant, trying to get pregnant, or trying not to get preg- nant. This is valuable data to marketers, to be sure, but with the potential for criminal liability in some states for terminating a pregnancy, many are questioning whether it is wise to continue using these apps at all.
Collecting Sensitive Data
Cycle-tracking apps have become extremely popular due not only to their cycle and fertility prediction capabilities but also for their convenience. One such app, Flo — the self-proclaimed “No. 1 period and cycle tracking app” — reports that it has been chosen”by over 230 million users globally. For better or worse, these apps provide far more robust tracking capabilities than the age-old paper tracking systems: marking cycle dates on a paper calendar.
In a typical cycle-tracking app, users can enter information about the start and end of their period, how heavy or light it may be on any given day, their methods of birth control, their physical and sexual activity, mood, and other symptoms. The apps then use this information to predict when a user’s next period may come, when the user might be most fertile, and if the user has missed a period and should take a pregnancy test. Some apps then continue to track the baby’s development based on the time of conception, and guide users through a countdown to their due date.
When Does HIPAA Apply?
Many individuals incorrectly believe that the information collected by cycle-tracking and other health apps is protected under the Health Insurance Portability and Accountability Act (HIPAA). However, the U.S. Department of Health & Human Services Office for Civil Rights (OCR) has issued guidance stating that HIPAA generally does not protect the privacy or security of a person’s health information when it is accessed through or stored on a personal mobile device. This means that a person’s internet search history, geographic location, and other information volun- tarily shared online would not be protected under HIPAA and could therefore be shared with third parties.
In addition, HIPAA does not apply to an app, or the infor- mation collected by that app, unless it is provided by a covered entity or business associate — a category in which most cycle- tracking apps do not fall. The guidance also cautions that simply
       




















































































   6   7   8   9   10