It depends on how your agency handles medical information, and the answer is often more nuanced than a simple yes or no. Some agencies act as HIPAA business associates when they receive protected health information from IVF clinics or other covered entities, which brings direct compliance obligations. Even when HIPAA does not strictly apply, state privacy laws and the heightened sensitivity of reproductive data mean careful handling is essential. Recent federal guidance on reproductive health information has raised the bar for everyone in this space. We help you assess where you stand and put the right encryption, access controls, and safeguards in place either way.