Millions of women and girls use period-tracking apps to understand their bodies and plan their lives. They enter some of their most intimate information — when the period starts, whether they are pregnant, even details about their sex lives — with the expectation that it will remain private.
For users of Flo, one of the world’s most popular period-tracking apps, that trust is currently on shaky ground. In a class-action lawsuit filed in federal court in California, users accused Flo of sharing sensitive information about their menstrual cycles and pregnancies with outside technology companies despite promises that their information would be kept confidential. In September, Flo and Google agreed to pay a combined $56 million to settle claims stemming from the litigation, while denying any wrongdoing.
The lesson is bigger than this one case: every day, we leave behind sensitive health information through the apps we use, the websites we visit and even the places we go. But our privacy laws have not kept up.
The New York Health Information Privacy Act, sponsored by state Sen. Liz Krueger and Assembly Member Linda Rosenthal, would help close gaps in existing privacy protections. The legislation, which passed both houses of the Legislature for the second time this year, would establish reasonable safeguards around how sensitive health information is collected, processed and shared, giving New Yorkers greater control over how it is used.
Under the bill, companies would face restrictions on selling sensitive health data and would generally need people’s consent to use it for purposes beyond providing requested services and other permitted activities. New Yorkers would also have the right to request their health information be deleted. These protections would help put people in control of their personal health data rather than technology companies.
Many people assume HIPAA protects all of their health information, but its protections generally apply to data handled by healthcare providers, health insurers and their vendors, not information shared with most health, fitness or period-tracking apps.
The New York Health Information Privacy Act would help close that gap by ensuring sensitive health data is protected when HIPAA does not apply.
The stakes are especially high as abortion and gender-affirming care face growing legal and political attacks across the country. Since 2022, abortion has been banned or severely restricted in states across the country, while gender-affirming care has faced similar legal and political attacks.
That stark reality makes protecting information about reproductive and gender-affirming care particularly urgent. Information about someone’s mental health, HIV or STI status, medications, pregnancy or other medical concerns can expose them to stigma, discrimination or even criminalization.
New Yorkers should not have to imagine the worst-case scenario to believe this information deserves protection. Some things are simply nobody else’s business.
The Legislature has done its job. Now the decision rests with Gov. Hochul.
Technology has changed how New Yorkers manage their health, but the expectation of privacy should remain the same. People deserve meaningful protections whether they’re sitting in a doctor’s office or using an app on their phone. New York has an opportunity to close that gap and establish stronger safeguards for the future.
New Yorkers deserve privacy when it comes to their health. New York law must protect and guarantee it. This is why Hochul should sign the New York Health Information Privacy Act before the end of the year.
Stark is president and CEO of Planned Parenthood of Greater New York.