Michigan Gov. Gretchen Whitmer signed Executive Directive 2026-4, “Protecting Reproductive Health Data,” on November 5, 2026. The order tells executive-branch departments and agencies to review how they collect, keep, store and retain records about people’s reproductive health, to tighten those practices, and to restrict sharing of that information with federal and commercial entities where the law allows. Departments that hold relevant data have 45 days to report findings and recommended changes to the governor’s office. The directive does not create new private rights or bind businesses directly, but it puts every state agency’s data inventories, contracts and location data on a short clock.
TL;DR
- Gov. Whitmer signed Executive Directive 2026-4 on November 5, 2026, ordering Michigan executive departments and agencies to review policies on collecting, maintaining, storing and retaining reproductive health data.
- Agencies must then revise those practices for maximum protection, including restrictions on sharing with federal and commercial entities, without conflicting with statutory, grant, audit or interagency reporting duties.
- Departments with relevant data must report findings, recommended policy changes and any legislative or technical needs to the Executive Office of the Governor within 45 days.
What the directive orders
The directive is short and structured in three numbered instructions, issued under the governor’s constitutional authority over the executive branch. It takes effect immediately.
- Review. Executive departments and agencies must conduct a comprehensive review of all policies, procedures and practices governing the collection, maintenance, storage and retention of records and data relating to an individual’s reproductive health.
- Revise. After the review, they must update those policies to ensure “maximum protection” for reproductive health data, including restrictions on sharing with federal and commercial entities, consistent with the reproductive freedom rights in Section 28 of Article 1 of the Michigan Constitution and other laws.
- Report. Within 45 days, departments with relevant data must send the Executive Office of the Governor a report summarizing findings, recommended policy changes, and any legislative or technical needs.
The definition of reproductive health is broad. It covers “all matters relating to pregnancy,” including prenatal care, childbirth, postpartum care, contraception, sterilization, abortion care, miscarriage management and infertility care. The definition of the data in scope is equally wide: it includes any precise geolocation information derived from a person’s internet-connected device, and it pulls in existing data-sharing agreements and contracts. That last point means the review is not only about databases but about the paperwork that lets data leave an agency.
One safety valve matters for anyone reading the order closely. The directive says it is not intended to conflict with any statutory, grant, audit or interagency reporting obligation. In other words, agencies cannot simply stop federally required reporting; the restrictions apply where they are legally permissible.
What the governor said, and a small correction
In the governor’s press release, Whitmer said: “Data misuse is a growing threat, and we must make sure that reproductive care data never lands in the hands of people who could weaponize it.” She added that she was proud to sign the directive “to secure Michiganders’ reproductive health data and strengthen patients’ confidence as they seek reproductive care.”
Some early summaries described the order as a review of agencies’ data “collection and deletion practices.” The text itself speaks of collection, maintenance, storage and retention, not deletion as such, though retention policies naturally decide when records are destroyed. The reporting requirement also falls on departments “with relevant data,” not on every public body in the state, and the report must cover findings, recommended changes and legislative or technical needs rather than only a description of current practices. The full text of Executive Directive 2026-4 is addressed to state department directors and autonomous agency heads.
Why the governor framed this as a data problem
The directive’s preamble ties it to the 2022 ballot measure that wrote reproductive freedom into Michigan’s constitution after the U.S. Supreme Court overturned Roe v. Wade. It lists earlier steps: the 2023 Reproductive Health Act, the repeal of the 1931 abortion ban, Executive Directive 2022-5 telling agencies not to assist other states’ investigations of reproductive care, Executive Order 2022-4 on extradition, and Executive Directive 2022-13 on enforcing constitutional protections.
The new piece is data. The directive says the growing accumulation of health information is itself a threat and that “more must be done to ensure that the state is not indirectly providing data to federal or commercial interests.” It recalls that in 2022 the governor called on large technology companies to protect health and location data. This time the target is the state’s own systems. That framing reflects a broader recognition that some health data deserves extra protection even when it sits outside a hospital or clinic.
Where this fits among state health-privacy efforts
Executive Directive 2026-4 is narrower than the consumer health-data statutes other states have pursued, because it governs government agencies rather than private companies. Still, it borrows their vocabulary. Precise geolocation near clinics has been a focus of attorneys general, as shown in California’s location-data enforcement sweep, and Virginia moved on reproductive health information in consumer protection law, a shift explored in our look at Virginia SB 754 and reproductive health data.
Not every state effort has succeeded. New York lawmakers passed the New York Health Information Privacy Act, but Gov. Kathy Hochul vetoed it in December 2025. In Michigan itself, comprehensive consumer privacy legislation has been debated repeatedly, including the Personal Data Privacy Act proposals, so an executive directive is the governor’s available tool for the part of the problem she controls directly. Private litigation has filled some gaps, too, notably period-tracking app cases that turned on how sensitive app data reached third parties.
Practical implications for vendors and partners
Even though the directive is addressed to agencies, the review it orders runs straight through outside parties. Companies that process data for Michigan departments should expect questions soon.
- Contract reviews. Existing data-sharing agreements and contracts are expressly in scope, so vendors may see requests to amend sharing, onward-transfer and retention clauses.
- Location data. Any service that captures precise device geolocation for a state program, from benefits apps to transit or licensing tools, may face new limits.
- Analytics and tracking. Third-party scripts on agency websites dealing with maternal health, Medicaid family planning or vital records could be reassessed as “commercial” sharing.
- Retention schedules. Agencies may shorten how long they keep reproductive health records where no legal duty requires longer retention.
- Federal requests. Expect clearer internal rules on when agencies share data with federal bodies, bounded by statutory and grant obligations.
What happens after the 45-day reports is not yet known. The directive asks for recommended policy changes and any legislative needs, which leaves room for follow-on rules, procurement terms or bills, but none had been announced when this article was written.
Frequently asked questions
Does Executive Directive 2026-4 apply to private clinics or app developers?
Not directly. It instructs state executive departments and agencies. Private companies are affected mainly through contracts and data-sharing arrangements with those agencies.
When are the agency reports due?
Within 45 days of the November 5, 2026 directive, which points to late December 2026. The reports go to the Executive Office of the Governor; the directive does not say they will be published.
Does the order stop agencies from complying with federal law?
No. The text says it is not intended to conflict with statutory, grant, audit or interagency reporting obligations, so sharing that the law requires can continue.
Is location data really covered?
Yes. The directive expressly includes precise geolocation information derived from a person’s internet-connected device within reproductive health records and data.
The directive’s most consequential line may be its quietest: the instruction to look at existing contracts. For a state government, the risk to sensitive health data often lies less in its own servers than in the agreements that move data elsewhere, and Michigan has now given itself 45 days to read them.
