IdeaLog

Stop UPCs from disclosing sensitive client health information

Posted on September 17, 2025

When clients go to any healthcare facility, they expect their sensitive personal health information to be kept confidential. But Unregulated Pregnancy Clinics (otherwise called Crisis Pregnancy Centers) often send personal health information to a nationwide antiabortion database.

Please be aware that there are probably a lot more Unregulated Pregnancy Clinics (UPCs) in your state than you imagine. You can see how many and where they’re located on this interactive map.

About 3/4ths of UPCs, or more, go to great lengths to look like medical offices, with waiting rooms, exam rooms outfitted with medical equipment, and staff wearing lab coats and/or scrubs. The UPCs’ impersonation of a medical clinic is intended to help them prevent clients, either by persuasion or delay, from having an abortion.

Clients are usually required to fill out intake forms. Even though virtually all UPCs are not real medical providers and have no legitimate need for the information, UPCs often ask clients for a list of the prescription drugs they take, a list of their current or past illnesses, and a list of medical conditions including those which are not relevant to the services that UPCs provide. Some ask for the name or age of the potential baby’s father, whether the client is living with a man to whom she is not married, the client’s age when she first became sexually active, whether the client is currently sexually active with more than one partner, and whether the client engages in homosexual relationships. Further, even though the information is irrelevant because they don’t bill insurance, UPCs often ask for the client’s government identification documents, insurance information, income, employer, or eligibility for public assistance.

UPCs also collect personal health information on appointment request forms, reports of interviews, written results of STI/STD testing or ultrasound examinations, and on write-ups from counseling sessions.

Because, overwhelmingly, UPCs are not regulated medical clinics, they can and do violate clients’ privacy. Traditional medical clinics must follow the privacy, confidentiality and records security requirements of the Health Insurance Portability and Accountability Act (HIPAA). UPCs are not subject to HIPAA and, therefore, are not required to protect clients’ health information, a fact that national UPC umbrella organizations concede. Nevertheless, many UPCs give clients a sense of security by deceptively claiming they are subject to HIPAA or “HIPAA compliant.”

In fact, most UPCs maintain client records in online databases that are accessible by third parties outside of the UPC. A digital system called eKYROS feeds personal client information into a central database linked with the national UPC umbrella groups Heartbeat International and Care Net. Other central databases used by UPCs include Next Level and CoolFocus.

As a brief by the Alliance reports: “the CPC industry is now functioning as surveillance infrastructure for the anti-abortion movement, amassing data that could be used in pregnancy- and abortion-related prosecutions…. The global anti-abortion group Heartbeat International, for example, stores ‘digital dossiers’ on clients, stating ‘Big data is revolutionizing all sorts of industries. Why shouldn’t it do the same for a critical ministry like ours?’”

Many states have their own laws requiring medical privacy and security, and the UPC industry should be brought under such laws. According to a 50-State Survey of Health Care Information Privacy Laws, most states have their own privacy laws that cover at least some medical facilities. Similarly, the American Health Lawyers Association (see p. 29-31) explains: “Most states have enacted laws and regulations related to the privacy and confidentiality of individuals’ health information. Such regulations are usually set forth in facility and/or professional licensure laws, requiring both licensed health care facilities and licensed health care professionals to maintain the privacy and confidentiality of patients’ health information.” Such laws should be enacted or amended to cover UPCs.