Dobbs moved health privacy risk outside the medical record
After the Supreme Court’s abortion decision, attention went to medical records, where HIPAA already set rules. The larger exposure for health systems sat at their own digital edges and in consumer data they never held but patients assumed was protected.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On June 24, 2022, the Supreme Court decided Dobbs v. Jackson Women’s Health Organization, overruling Roe v. Wade and Planned Parenthood v. Casey and returning the regulation of abortion to the states. Within days, attention turned to data: period-tracking apps, location data showing visits to clinics, search histories, messages and medical records. On June 29, the HHS Office for Civil Rights issued guidance on how the HIPAA Privacy Rule limits disclosures of protected health information, including to law enforcement. It also published separate guidance on protecting health information on personal phones and apps. On July 1, Google said it would delete location history entries for visits to sensitive places such as abortion clinics. A presidential executive order on access to reproductive health care, including privacy, followed on July 8.
This article is not about the merits of the decision. It is about what the decision did to the data responsibilities of health systems, many of which operate across states with very different laws. The first instinct of most privacy offices was to look at the medical record. That was sensible, and HIPAA already gave them a framework. But the record was the best protected of the places where reproductive health information lived. HIPAA protects health information held by covered entities and their business associates. A great deal of revealing data sits elsewhere: in the tracking code on a hospital’s own website, and in apps, devices and data brokers that no health system controls. We look at three places in turn, from most protected to least: the record, the hospital’s digital edge, and consumer data beyond HIPAA.
The record: a known process under new pressure
Inside the medical record, the HIPAA Privacy Rule set the terms. It permits, but generally does not require, disclosures to law enforcement, and most permissions come with conditions such as a court order, warrant or subpoena. OCR’s June 29 guidance stressed that point: covered entities could decline many requests unless a law required disclosure, and they should disclose only the minimum required.
The work here was procedural and familiar. Release-of-information staff needed a rule that any request touching reproductive health went to a designated reviewer and counsel before release. Multi-state systems needed to know which state’s law governed which request. Access monitoring for sensitive encounters, already common for celebrity patients and employees, could be extended to reproductive care. Organizations should check with counsel on how federal and state requirements interact in each state where they operate.
This zone mattered, but it had owners, procedures and a governing rule. The two that follow had far less of each.
The digital edge: tracking code on the hospital’s own pages
Health system websites, scheduling pages and patient portals often carried third-party tracking technologies: analytics scripts, advertising pixels, session replay tools and embedded chat widgets. Marketing teams added them to measure campaigns and improve conversion, often without privacy review. On a page for booking a gynecology appointment or reading about pregnancy options, those tools could send the visitor’s IP address, device identifiers and page details to outside companies.
Investigative reporting in mid-2022 showed that many hospital websites and some patient portals were sending such data to advertising platforms. After Dobbs, the stakes of that data flow changed. Information about a visit to a pregnancy options page, linked to an identifiable device, was now potentially sensitive in a legal sense as well as a personal one.
A sound response did not need to wait for regulators. It started with an inventory of every third-party script on public and authenticated pages, built by scanning the sites and by asking marketing and digital teams what they had installed. Each tool then needed a review: what data it sent, to whom, under what contract, and whether a business associate agreement was required or even possible. Tools that could not be governed came off sensitive service-line pages and all authenticated pages. Where measurement was still needed, server-side analytics that kept data under the hospital’s control replaced client-side pixels.
Governance had to change too. A rule that no tracking technology goes live without privacy and security review, enforced through the web content management system, keeps the inventory from refilling.
Beyond HIPAA: the data patients assumed was protected
The least protected data was data health systems never held. Period-tracking and fertility apps, location data sold by brokers, search histories, purchase records and messaging content could reveal reproductive health decisions without touching a medical record. Many patients assumed this information was covered like their chart. Usually it was not covered by HIPAA at all. The Federal Trade Commission’s authority over unfair and deceptive practices applied, and a few states had relevant laws, but there was no general federal rule.
Health systems could not govern this data, but they shaped how patients met it. Some updated patient education to explain app privacy settings and location controls in plain language. Some reviewed which consumer apps their clinicians recommended and which apps connected to the patient portal through data access interfaces. Data that leaves the portal for a consumer app usually leaves HIPAA’s protection too. Some examined their own patient-facing apps for location tracking and data sharing they did not need.
That last step points to the one control that works in every legal scenario: collect less. Data never collected cannot be subpoenaed, sold or breached. A health system that turns off location collection in its app, shortens retention of web analytics and strips identifiers from marketing data has reduced risk regardless of how state laws evolve.
Front-line staff belong in this zone as well. Patients ask nurses, schedulers and call center agents about privacy first. Short, accurate guidance on what the health system protects, and what it cannot control, lets staff answer calmly without promising more than the organization can deliver.
With hindsight
The policy response unfolded unevenly, and most of it landed in the two outer zones. In December 2022, OCR issued a bulletin on tracking technologies on regulated entities’ websites and apps; a federal court vacated part of it in 2024, but class actions over pixels on hospital sites and FTC enforcement against consumer health apps continued. Washington’s My Health My Data Act, passed in 2023, extended protections to consumer health data outside HIPAA, and other states followed. Inside the record, HHS finalized a HIPAA rule in April 2024 adding protections for reproductive health information, but a federal court in Texas vacated most of it in June 2025. By 2026 the legal map is still contested and state-specific. The durable controls are operational: govern tracking code on every page, keep a disciplined process for legal requests, and collect less.