Builds on 06 Redeeming the Time asked how a church may reach people. This asks what it may keep once they come.

Infera · The Mechanism Series · The Faith Layer · Exhibit 07 · Finale

HIPAA for the Pews

The church already keeps a book of the names of the dead. It has no rule for the rest of what it keeps.

First, the name. HIPAA, the federal health privacy law, does not cover most congregations, and nothing here is legal advice. We borrow the name only because people recognize it. What a church holds about its people, from prayer requests to a child's check-in, mostly sits outside every privacy law there is. Four rooms show where the law stops, who can still reach the file, and where a church's own beliefs collide with a right to be erased. Then your choices across the Faith Layer become one charter.

~21 min readPublished 24 October 2026Evidence through 24 October 2026FACT primary sourceREPORTED secondary, company or allegationINFERENCE Infera reading or modelWATCH unconfirmed or open

FACT

Kinds of organization HIPAA covers: health plans, clearinghouses, and providers who bill electronically. A congregation is usually none of them. 45 CFR 160.103.

FACT

0 of 7

Standards in the evangelical financial accreditation body ECFA's code that mention data privacy or security. Money has a standard; members' data does not.

REPORTED

700,000+

Accounts exposed in the Vatican's official prayer app in 2026; the flaw stayed open for about six months after a researcher found it. Dark Reading.

At a glance

The question: What does a congregation keep about its people that no law protects, who can still reach it, and what rule would a church write for itself?
Strongest evidence: HIPAA covers only health plans, clearinghouses and providers who bill electronically, so most congregations fall outside it. FACT Courts have ordered church files produced on the reasoning that privilege covers confidential spiritual communication, not an institution's records. FACT
Main uncertainty: We found no survey of how many US congregations have a written privacy policy, and no confirmed member-data breach at a major church-software vendor. INFERENCEsearch result Nothing here is legal advice.
Where Infera stands: This is an argued position, made as fairly as we can. We weigh consent, truthful representation, limited collection and meaningful endings heavily. We frame questions for congregations and families to decide; we do not settle them for any tradition.

Explore the exhibit 21 min

A · The three-box testOf ten records a church keeps, two land inside HIPAA and most land under no privacy rule at all. FACT INFERENCEour reading of the definitions
B · The words, not the fileFrom 1997 to 2025, courts kept opening church files; the confession itself is what a state backed away from. FACT REPORTED
C · Who else holds the fileEleven cases of breach, broker purchase and court-side exposure, several of which never touched a church server. REPORTED
D · The baptism and the eraserA data right meets a theology of permanence in a case now before the EU's highest court. FACT WATCH
Finale · The charterYour choices from all seven exhibits become one congregation charter, kept only in your browser, with a precedent under each clause.

How to read our labels. FACT means we read it at the primary source. It tells you what that source says: a company's own documentation, a study's finding in its own sample, a statute's text. It does not certify that the claim holds everywhere or that a product works as promised. REPORTED is a secondary account. INFERENCE is Infera's reading or model. WATCH is unconfirmed or open. Where a label needs more precision we add a note, such as company documentation, study finding, editorial model or search result.

ROOM A · THE THREE-BOX TEST

Ten things a church keeps. Which law reaches each one?

HIPAA attaches to who holds information, not to what it says. Run the test and watch where a congregation's records land: inside HIPAA, under some other law, or under nothing but a duty to say so after a breach.

Ten records · three boxes

HIPAA

health plans, clearinghouses, electronic-billing providers

Some other law

in some states, or above a size threshold

No privacy rule

a breach notice, after the damage, in most states

Tap any record to see why it lands where it does.

What this showsThe most intimate things a congregation holds, prayer requests about illness, counseling notes, a child's allergies, usually fall outside HIPAA and below every state privacy law's size threshold. HIPAA names clergy in one place only: a hospital may tell a Methodist minister which patients are Methodist, unless a patient objects. FACT We found no survey of how many US congregations have a written privacy policy. That missing number is itself a finding. INFERENCEsearch result

Placements are Infera's reading of the definitions, not legal advice. Whether a denominational health plan counts as a HIPAA health plan turns on how it is set up and run; we found no federal guidance naming church plans. WATCH The state privacy laws that reach nonprofits do so only above 35,000 to 100,000 people a year, as reported by law firms. REPORTED

ROOM B · THE WORDS, NOT THE FILE

Clergy privilege protects a confession. Courts keep opening the files.

The Angel at 2 A.M. found that privilege covers words spoken to a minister, not a server log. Here is what it has meant for paper. Walk the record from 1997 to now.

Seven moments · 1997 to 2025Tap a year

What this showsCourts have ordered church records produced again and again, on the reasoning that privilege covers confidential spiritual communication, not an institution's files. The one thing the record shows a state backing away from is the confession itself. Holding less, and deleting on a schedule, is the only protection a church fully controls. INFERENCE

ROOM C · WHO ELSE HOLDS THE FILE

Breaches, brokers and bankruptcy courts. Some never touched a church server.

Eleven documented cases since 2020. Filter by the way the data left, and notice how many paths run around the congregation entirely.

Eleven cases · three paths

What this showsReligious data is a target, and three of these paths need no church at all: an app's location data, a dating app's signal data, and a law firm's servers. We found no confirmed member-data breach at a major US church-management vendor; that is an absence in what we found, not proof of safety. INFERENCEsearch result When a private equity owner sells a vendor, member records move under the vendor's terms, not the congregation's promises. INFERENCE

ROOM D · THE BAPTISM AND THE ERASER

A man baptized as a child asks to be erased. What should the register do?

Many traditions hold that a sacrament cannot be undone. European privacy law gives a person the right to have data about them erased. A case from Belgium is now before the EU's highest court. Choose what the parish does, and see who has said what.

One register · four answersWATCH a ruling is pending

What this showsThis is the cleanest live collision between a data right and a theology of permanence. European law already lets churches run their own data rules under independent oversight, and German churches do. The question for a US congregation is whether to write its own rule before someone else does. INFERENCE

BOTH SIDES, AT THEIR STRONGEST

Should congregations adopt a written data standard of their own?

Yes: the law has a hole where the most intimate data sits

Prayer requests about illness, counseling notes and children's records usually fall outside HIPAA, COPPA, FERPA and every state privacy threshold; breach laws act only after the damage. FACT INFERENCE
Religious data is a target: an intrusion at the Latter-day Saints church that law enforcement linked to a state-sponsored campaign, and member records reportedly taken from two Seoul megachurches in 2026. REPORTED
Courts already reach church files. Holding less, on a schedule, is the only shield a church fully controls. FACT
Churches have done this on their own terms before: Germany's Catholic and Protestant data laws, and Church of England parish guidance that treats listing members in a directory as needing opt-in consent. FACT REPORTED
A standard a congregation writes itself is the best defense against one written for it. INFERENCE

No, or not this way: who writes the rules for a church?

Any outside standard, from a vendor, an insurer, a regulator or a journalism project, invites outsiders to define what a church may record about souls. A federal judge blocked Washington's attempt to require priests to report what they hear in confession. REPORTED
A "voluntary" standard can harden into an insurer requirement or evidence of negligence in court; one church-law publication makes the same argument about children's privacy rules. REPORTED
Erasure rights collide with sacraments a church holds permanent, as Room D shows.
Most congregations are small and volunteer-run. A formal standard could push them onto vendor platforms owned by private equity, concentrating the risk. INFERENCE
A badge without an audit can make members trust a church more than its security deserves, and a public list of who complies could become a target map for communities with a history of being watched. INFERENCE

What this exhibit did not prove. Nothing here is legal advice. Room A's placements are our reading of the definitions; edge cases such as denominational health plans and parish nurses turn on facts we cannot see.
Several incidents in Room C rest on secondary reporting or a researcher's or company's account, as labeled. We did not survey denominational rules, Islamic or Jewish congregational data guidance, or any US diocesan data policy, and we found no case of a church member list sold in bankruptcy.
The Belgian baptism case awaits a ruling from the EU Court of Justice; an Advocate General's opinion is advice to the court, not a decision.
The charter below is a tool for conversation. It binds no one until a congregation's own people adopt it.

FINALE · THE CHARTER

Seven exhibits, seven clauses. Your congregation's charter.

Each exhibit ended with a choice. Where you made one, it is already here; change any clause. Under each one is a place the same rule already exists, so a council can argue about precedent instead of slogans. Nothing you choose leaves this browser.

Our congregation's data charter · draft

FORM YOUR OWN READ

Five questions for a church council.

What do we keep about our members that no law requires us to protect?
If a court asked for everything tomorrow, what would we hand over, and could we have kept less?
Which apps and vendors do we recommend, and what happens to their data if they are sold or fail?
Which of our records do we believe are permanent, and what would we say to someone who asks to leave?
Who in our congregation decides, and how would every member know what we decided?

THE END OF THE FAITH LAYER

That is the last room. There is nothing here to press.

Seven exhibits asked what is kept about the faithful: who came through the door, what a teenager said at 2 a.m., which children were signed in, what a system guessed, whose voice outlived them, where the hours went, and who holds the file. The answers belong to congregations and families, not to us. The last thing this series can do is stop asking for your attention. Close the page.

SOURCES