HIPAA and Elective Ultrasound Studios: Start with Applicability

TL;DR — HIPAA does not automatically apply to every elective ultrasound studio or every pregnancy-related image. The first question is whether the studio is a covered entity or is acting as a business associate. If HIPAA applies, the Privacy, Security, and Breach Notification Rules require a fact-specific compliance program. Other laws and contracts may apply even when HIPAA does not.

Facts checked September 8, 2026 against official HHS guidance. This article is general information, not legal advice.

Step 1: determine whether HIPAA applies

HHS explains that the HIPAA rules apply to covered entities and business associates. Covered entities include certain health plans, clearinghouses, and health care providers that conduct specified electronic transactions. A business associate performs certain services for a covered entity involving protected health information.

An elective studio is not automatically inside or outside HIPAA merely because it captures an ultrasound or collects identifying information. Its services, transactions, contracts, and relationships matter. Document the facts and obtain qualified legal advice for the jurisdictions where you operate.

Step 2: map every party and data flow

List the studio, referring providers, franchise or network, scheduling system, payment processor, capture and delivery vendors, AI vendors, cloud storage, messaging services, and support providers. For each one, record what data it receives, why it receives it, where it stores it, and which agreement governs the relationship.

Step 3: verify safeguards and agreements

If HIPAA applies, assess the required administrative, physical, and technical safeguards and whether a business associate agreement is required. Do not treat a “HIPAA compliant” marketing label as proof. Ask for written terms, security documentation, incident handling, retention and deletion rules, access controls, audit capabilities, and subprocessor information.

If HIPAA does not apply, still assess applicable state privacy and breach-notification laws, consumer-protection rules, contracts, card-payment obligations, and the promises made in your own privacy notice.

Step 4: test the delivery workflow

Use non-production sample data to test client matching, wrong-recipient prevention, access revocation, export, deletion, failed uploads, support escalation, and incident response. Train staff on the workflow you actually deploy and keep the evidence used for your decision.

For delivery-specific questions, read USB, Email, or Cloud? A Safer Ultrasound File-Delivery Checklist.