HIPAA and data privacy for surrogacy agencies: a practical guide

A surrogacy agency holds some of the most sensitive information any business can: medical records, pregnancy histories, psychological evaluations, background checks, finances and photos of children. Whether or not HIPAA applies to your agency, you are expected to protect it as if it does.

Short answer: HIPAA applies directly to covered entities (health plans, clearinghouses and health care providers that bill electronically) and to their business associates. Many surrogacy agencies are neither, but some act as business associates of clinics, and state privacy and data breach laws, the FTC and your own contracts can apply anyway. In practice, agencies should treat medical and personal information to HIPAA-level standards: collect only what you need, get written authorisation before requesting or sharing records, share the minimum necessary, keep files in a secure system with role-based access and an audit trail rather than in email and shared drives, and have a plan for a breach. Ask a healthcare privacy attorney what applies to you.

General information, not legal advice. Whether HIPAA or a state privacy law applies to your agency depends on what you do and where you operate. Talk to a healthcare privacy attorney about your own obligations.

Does HIPAA apply to a surrogacy agency?

HIPAA's privacy and security rules apply to covered entities: health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically, such as billing insurance. They also apply to business associates: people and companies that create, receive, keep or transmit protected health information on a covered entity's behalf.

A typical surrogacy agency does not provide health care or bill insurance, so it is often not a covered entity. But the answer depends on what you actually do. An agency with an in-house nurse who provides care, or one that handles records on a clinic's behalf under a business associate agreement, may be in a different position. That is a question for a healthcare privacy attorney, not a blog post.

Even when HIPAA does not apply directly, the clinics, insurers and attorneys you work with often expect HIPAA-level handling, and intended parents and surrogates assume it.

The sensitive data agencies hold

• Medical records, pregnancy and delivery histories, and clinic screening results.
• Psychological evaluations and mental health history.
• Background check reports, for surrogates, partners and sometimes intended parents.
• Genetic and family history, especially in egg donor programs.
• Identity documents, insurance details and financial information.
• Photos, including of surrogates' children, and personal letters.
• Messages that discuss all of the above.

Other laws that can apply

• State privacy laws. A growing number of states have consumer privacy laws, and some have laws specific to health data, which may cover businesses HIPAA does not.
• State data breach laws. Every US state has a breach notification law that applies to certain personal information.
• The FTC. The Federal Trade Commission enforces against unfair or deceptive data practices, and its Health Breach Notification Rule applies to some non-HIPAA health apps and services.
• The Fair Credit Reporting Act for background checks.
• Laws in other countries when you work with international intended parents, for example the GDPR for parents in the European Union.

Practical safeguards

1. Collect only what you need, and only when you need it. A full medical history is not needed at the first application.
2. Get written authorisation before requesting records from a provider, and before sharing them with a clinic, attorney or intended parents.
3. Keep sensitive files out of email and personal devices. Attachments get forwarded; shared drive links get shared. Use a secure system where access can be controlled and revoked.
4. Give access by role. An intake coordinator does not need every match's financial file. When someone leaves, remove their access the same day.
5. Keep an audit trail of who viewed or changed what.
6. Use strong passwords and two-factor authentication on every system that holds client data, including email.
7. Train the team on what may be shared, with whom, and how. Most leaks are mistakes, not attacks.
8. Have a breach plan: who to call, how to assess what happened, and how to notify people if required.
9. Set a retention policy and follow it.

Sharing with intended parents, clinics and attorneys

Matching depends on sharing personal information, so decide in advance what each party sees. Intended parents usually see a surrogate's profile (her story, photos, pregnancy history in summary, preferences) but not her full medical records, which go to the clinic with her authorisation. Surrogates see the intended parents' profile, but generally not their embryo details, clinic records or donor information. Attorneys and insurers get what they need for their part, with consent. Write these rules down and build them into how profiles are shared, not into each coordinator's judgment on the day.

Choosing software

When you evaluate software for an agency, ask how data is encrypted in transit and at rest, whether each agency's data is isolated, how role-based access works, whether there is an audit trail, how backups work, and what the vendor says about HIPAA. If HIPAA applies to your agency, ask whether the vendor will sign a business associate agreement.

How SurroHub helps

Your data is protected, private, and HIPAA compliant. SurroHub is built so the safeguards above are the default rather than a policy someone has to remember.

• Isolated per agency. Your surrogates, parents and donors live in your own protected workspace; no data is ever shared between agencies.
• Encrypted. Records are encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access. You decide what each team member can see and do, and revoke access in one click.
• Full audit trail. Sensitive actions are logged, and every profile's activity shows who viewed it, every message, signature and stage change.
• Sharing you control. You choose exactly which profiles each intended parent or surrogate sees, in their private portal or by a link you send. Embryo, clinic and donor details on an intended parent's profile never reach surrogates or share links.
• Documents out of email. Contracts, uploads and internal documents live on the profile, not in inboxes; parties upload from their own portal.

Read how SurroHub protects agency data.

Want the facts in one place? SurroHub by the numbers: what it is, who built it, and what agencies run on it today.

Sources: HHS, Covered entities and business associates; HHS, Breach notification rule; FTC, Health Breach Notification Rule basics for business.

Frequently asked questions

← Back to SurroHub