Abortion Bans Spur Biden Push to Bolster Patient Privacy Rights

The Biden administration is working on a proposal to better protect the privacy of patients seeking reproductive health care, a move that follows concerns from providers struggling to offer services amid state abortion restrictions.

The Proposed Modifications to the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (RIN 0945-AA20) by the Department of Health and Human Services Office for Civil Rights comes amid abortion bans in at least 24 states, and follows 2022 agency guidance for health providers to protect patient records when law enforcement requests them.

After the Supreme Court’s Dobbs v. Jackson Women’s Health Organization decision cut down federal abortion rights, “in some states with bans on abortion, there was concern over what actions law enforcement may take when investigating those laws and initiating prosecution,” said Leon Rodriguez, who led the HHS civil rights office under President Barack Obama.

Currently listed as under White House review—a step before public release—the proposed rule is one of a handful of recent actions the Biden administration may take on reproductive services.

The Food and Drug Administration announced in January that pharmacies can get certified to dispense the abortion drug mifepristone. Meanwhile, the HHS is also proposing changes to a Trump-era rule that observers say would make it more difficult for providers to decline offering abortions due to religious objections.

“I would imagine that this administration is intent on protecting access to reproductive health care to the full extent that the law allows,” said Rodriguez, now a partner at Seyfarth Shaw.

‘Nondiscriminatory Access’

Current OCR Director Melanie Fontes Rainer declined to share the content of the proposed rule with Bloomberg Law. She did, however, note that “the Office for Civil Rights has a statutory mandate to ensure nondiscriminatory access to health care.”

“Part of that mission is to promote privacy and protect health information,” she said. She added that the HHS conducted roundtables and listening sessions across the country with patients, providers, advocates, state health officials, and others.

But Roger Severino, who led the HHS civil rights office under President Donald Trump, said the proposal appears to be an attempt “to twist HIPAA to use it as a bludgeon against the Dobbs decision and interfere with cooperation with law enforcement.”

In January, the proposed rule was listed as under White House review without having previously been disclosed on the Biden administration’s agenda of upcoming regulations and proposals. Policy experts say this isn’t routine but not unheard of, due to things like changes in circumstances behind a proposal.

Severino, however, said that in this instance, “by all appearances it was deliberate in order to keep it as quiet as possible,” due to controversy of trying “to scare medical providers from cooperating with police in states where abortion is restricted.”

“‘I suspect what they’re trying to do is say that in pro-life states that cooperating with law enforcement to protect unborn life is a violation of HIPAA,” Severino said. He added that HIPAA defers to state law definitions for things like paternity and guardianship, and that certain states define unborn persons as persons.

Rodriguez, however, said rather than “trying to thwart state actions,” the HHS civil rights office’s effort appears to be “trying to make sure state actions are in compliance with federal law.”

The HHS put out guidance for medical providers shortly after Dobbs laying out what HIPAA calls for from medical providers when a patient’s health data might be of interest to law enforcement.

The guidance explains that hospitals and employees suspecting a patient had an abortion cannot simply provide their health information to law enforcement without violating HIPAA, a crucial distinction as state restrictions are bewildering medical employees. It also explains that health providers cannot hand over information like abortion records when requested by law enforcement without a court order or a mandate equally enforceable.

An administration official didn’t confirm whether the proposed rule would codify the guidance. But Rodriguez said, “It’s certainly part of the role of the office to update legal guidance and regulations based on change in the external environment that necessitates those changes.”

And reproductive health care is particularly personal, Rodriguez said, noting patients expect a high level of confidentiality.

“I would be very motivated to use all my legal authority to protect all the confidentialities of that information,” he said.

HIPAA Limits

HIPAA’s ability to secure reproductive rights, however, remains fairly limited.

Kirk Nahra, co-chair of the cybersecurity and privacy practice at law firm Wilmer Hale, said much of the data discussed in the abortion context—such as phone location data to see whether someone was near an abortion clinic or information on shopping purchases to see whether someone was pregnant—doesn’t fall under HIPAA at all.

“No matter what you can possibly do with the HIPAA rules, you can’t address all the Dobbs reproductive rights issues, because much of the relevant data has nothing to do with the HIPAA rules,” Nahra said.

Nevertheless, the HHS in December issued a bulletin signaling medical providers to stay alert of violating HIPAA with data tracking technology used for collecting and analyzing health information.

Nahra noted that HIPAA generally doesn’t distinguish between different types of health data, meaning the same protections for abortion-related information also apply to ankle surgery.

Yet, he said, HIPAA experts have recently begun weighing whether to treat data categories differently under HIPAA, a move that “would have lots of implications for how the health system works.” For example, altering the law to block disclosing abortion information to law enforcement could in theory cut off an avenue for hospitals to share data on someone accused of assaulting a nurse.

Abortion is “a complicated puzzle that has a lot of pieces. The HIPAA piece is part of the puzzle, and even on its own a complicated piece,” Nahra said. “No one should view changing HIPAA as a complete solution to the problem of abortion access,” but rather an important part of it.

Untested Waters

Yet driving the focus on HIPAA is state use of “fear and confusion” to enforce criminal laws against abortion, said Maggie Jo Buchanan, senior legal fellow for the Women’s Initiative at American Progress. That’s stemming “a real chilling effect,” both on doctors trying to navigate a patchwork of restrictions and the patients hesitant to be honest with them.

“We hear from folks on the ground all the time about this fear—we hear a lot of that in the miscarriage context, where doctors feel they have their hands tied to provide miscarriage treatment,” Buchanan said.

Still “while HIPAA protects some really important information,” Buchanan noted that “because the Supreme Court made the decision to allow health care as a criminal issue, there’s only so far HIPAA can currently go” in protecting information.

“There are so many unresolved legal questions here, because HIPAA does have a significant preemption provision, but there are also restrictions within HIPAA based on being in conflict with state law,” she said. “A lot of this is untested.”