The US Supreme Court’s ruling in Dobbs v. Jackson Women’s Health Org. permanently altered the patient-provider relationship. In the aftermath of the Dobbs decision, expect the HHS to revise the Information Blocking Final Rule to better reflect the intersection between reproductive health, patient privacy, and access to a patient’s medical record. That’s because—as it exists in its current form—the rule may inadvertently facilitate retrieval of patient reproductive health data without a patient’s consent or knowledge.
The Free Flow of Protected Health Information
Congress passed the 21st Century Cures Act in 2016, and the Department of Health and Human Services implemented the Information Blocking Final Rule in 2020. Both the law and the regulations were designed to improve patient health outcomes and promote interoperability—the free flow of electronic protected health information between patients and their providers.
The regulations explain how actors and covered entities, including health care providers and health information networks, access and exchange electronic personal health information. The access of electronic PHI often occurs between health practices and providers from different entities, including health practices and health systems in different states across the country.
The Information Blocking Final Rule was designed to make the access and exchange of health information as seamless as possible. But after Dobbs, the free flow of electronic health information has new implications. Health-care providers are now concerned that even counseling a patient about their reproductive options might be illegal, and patients are wary about sharing information with their providers. Doctors routinely ask about patients’ reproductive and sexual health, and seemingly innocuous information regarding a patient’s menstrual cycle could reveal a pregnancy or that an abortion occurred.
In states that have banned abortion, evidence that a patient may have obtained an abortion—even if they did so in a different, more permissive state—may be considered probable cause for law enforcement to subpoena a patient’s electronic medical data.
Applying the interoperability rule, it’s not far-fetched to assume that an abortion provider or clinic would have access to a patient’s entire medical record. If that provider is subpoenaed, that patient’s medical record (and possible history of a past abortion) could be turned over during a criminal investigation. Many states also mandate reporting of abortion statistics, including the justification for the procedure and whether informed consent was obtained.
Safeguards Fall Short
There are two exceptions to the Information Blocking Final Rule that allow covered entities to withhold patient information from authorities and other covered entities.
The first exception states that providers can stop the release of patient health data if they are doing so to prevent harm to a patient or another person. The second exception allows providers to block access to a patient’s electronic medical record to protect an individual’s privacy. Importantly, adhering to the exceptions isn’t mandatory for covered entities, which means that discretion to share electronic protected health information is in the hands of the provider.
There are also limiting circumstances for when the second exception can be used:
- if the patient doesn’t provide express written consent;
- if the actor is a health IT developer, not a provider;
- if the denial is at the request of the patient; or
- if the denial is consistent with the HIPAA Privacy Rule.
Under the HIPAA Privacy Rule, a provider may disclose a patient’s health information in response to a court order or subpoena. But a provider must disclose a patient’s health information if related to a criminal investigation of child abuse or neglect. Therefore, in states with fetal personhood laws (e.g., Georgia), a pregnant patient might be criminally charged for seeking an abortion because it would constitute child abuse, and the provider would be compelled to share the patient’s medical record if subpoenaed.
It might be tempting for a provider to protect a patient by refraining from documenting a reproductive health procedure in the first place. But not documenting a procedure to prevent disclosure of reproductive health information could actually compromise a patient’s health, cause reimbursement and billing issues, and expose a provider to liability or arrest for providing an illegal abortion. If the reason for the procedure isn’t entered into the patient’s medical record, the provider can’t use the affirmative defense that abortion was necessary to save the patient’s life.
What to Expect
The Department of Health and Human Services may address the issue of interoperability in 2023, but its approach is unclear. The HHS could amend the Information Blocking Final Rule to carve out another exception specifically addressing these concerns. It could also issue guidance directing actors on how to respond to a criminal subpoena related to reproductive health. Or, it could restrict covered entities from sharing an individual’s reproductive health information without their express consent.
The House of Representatives passed the Women’s Health Protection Act in July to address the health privacy issues raised by Dobbs, but it didn’t advance in the Senate, and it’s unlikely that Congress will find consensus on a topic as controversial as abortion.
Acknowledging this gap, Democratic senators recently sent a letter to HHS Secretary Alex Barrera, encouraging the HHS to update the HIPAA Privacy Rule and to strengthen privacy protections for reproductive health information.
Until the HHS issues guidance, medical professionals will be left questioning whether their actions will result in licensure revocation or imprisonment. And patients are left with limited options as they try to seek necessary care.
Access additional analyses from our Bloomberg Law 2023 series here, covering trends in Litigation, Transactional, ESG & Employment, Technology, and the Future of the Legal Industry.
Bloomberg Law subscribers can find related content on our In Focus: Abortion Law practice page.
If you’re reading this on the Bloomberg Terminal, please run BLAW OUT<GO> in order to access the hyperlinked content, or click here to view the web version of this article.