Abortion Privacy Push Pits Biden Against Criminal Laws in States

The Biden administration’s efforts to protect reproductive health information from law enforcement post-Dobbs hangs on how much authority its health agency has to preempt state criminal laws—a thorny issue for health-care lawyers.

A recent executive order shows the administration is considering how to beef up privacy protections for abortion-related health information. It’s part of a broader Biden administration scramble to make substantive policy changes to protect reproductive health access as it lacks the votes to pass new legislation.

Advocates are concerned that prosecutors and law enforcement officials could target people’s reproductive health information in their efforts to enforce abortion bans. The Health Insurance Portability and Accountability Act’s privacy rule allows abortion providers to share reproductive health information with law enforcement, and a handful of state laws require sharing in certain situations.

The HHS should consider tightening the HIPAA privacy rule provision allowing health-care workers and facilities to communicate with law enforcement, said Matthew Cortland, a senior resident fellow at Data for Progress, who works on health care and disability.

“When a pregnant patient presents to the emergency department, they should not have to fear a health-care worker will call the police because they suspect that patient of, for example, self-managing a medical abortion,” Cortland said.

The HHS did not respond to a request for comment about whether the agency is considering such a move.

“The HIPAA statute has a strong preemption provision, but the Privacy Rule as written shows a lot of deference to state law,” said Deven McGraw, co-founder of Ciitizen Corp., a consumer health-technology company. McGraw previously worked on information privacy in the Health and Human Services Office for Civil Rights.

“To what extent can the HHS use a regulation attached to a preemption provision to overturn a state criminal law?” she said. “That’s a tough question. I’m not sure what the answer to that is.”

‘Chilling Effect’

The HIPAA law enforcement provision, as it currently stands, will likely have a “chilling effect” on patients seeking reproductive health care, said Carmel Shachar, executive director of the Harvard Law School Petrie-Flom Center for Health Law Policy, Biotechnology, and Bioethics.

Patients who self-manage abortions may be reluctant to go to the emergency room for follow-up treatment if something goes wrong, she said.

“Inserting the state in between a woman and her physician is really problematic, and it will probably lead to sub-optimal outcomes, including even a risk of death for women,” Shachar said.

The HHS issued guidance on protecting patient privacy after the US Supreme Court’s Dobbs decision on abortion, but “there’s really not a lot there other than beefing up enforcement, considering ways to prevent fraud, and working with the FTC on privacy,” said Christopher Hart, a partner with Foley Hoag LLP in Washington and chair of the firm’s privacy and data security practice. “And what that says to me is, absent some additional rulemaking, what we’re looking at is education to providers and patients about the current limits of what’s allowed.

Without changes in law or regulation, there appears to be little help the administration can give to providers facing court orders, subpoenas, or law enforcement inquiries, Hart said.

“Once these requests start happening, it’ll be up to the providers and covered entities to decide whether to respond and whether they choose to litigate,” he said.

The law enforcement provision in the HIPAA privacy rule is the result of a compromise between the HHS and the Department of Justice, which was “pressing hard on the need for data to sometimes be able to be provided to law enforcement for legitimate inquiries,” McGraw said.

The current provision allows providers to disclose a limited set of information that could be helpful for an investigation, like “name, address, date of birth, Social Security number, blood type, type of injury,” McGraw said. But it wouldn’t allow law enforcement to ask a hospital for “all the names of the women who have had abortions in your facility,” unless it is required by state law or a court order, she said.

Any revision to the privacy rule would have to be narrowly tailored to make sure the law enforcement provision could still allow the kinds of widely accepted disclosures it was made for, said Kirk Nahra, co-chair of the cybersecurity and privacy practice at WilmerHale.

“That provision is what’s used if a patient assaults a nurse” or if a thief with a gunshot wound shows up to a hospital, Nahra said. “I don’t know that you want to prohibit that disclosure.”

The Biden administration could model its approach after the substance abuse confidentiality regulations, which were written in the 1970s to encourage people to get treatment without fear of legal repercussions. The rules require a patient’s permission to disclose information to law enforcement.

It would be feasible to revise the regulation and carve out the disclosure of a specific kind of health information, like reproductive health information, Nahra said. Whether the Biden administration would explicitly tailor the rule that way is a “political question,” he said.

Another more promising route would be to “make it harder for law enforcement to use information from a health-care facility in order to prosecute a person across a broad range of health conditions,” McGraw said. Singling out reproductive health information could invite legal challenges or policy changes whenever the presidency changes parties.

Regulation Vs. State Law

The fact that the law enforcement provision comes from the privacy rule rather than the text of the statute means “HHS could certainly try to narrow the exception through rulemaking,” said Dianne Bourque, a health privacy lawyer at Mintz.

The HHS would likely need to go through the standard rulemaking process, including a potentially lengthy notice and comment period, Cortland said.

And there are still “parameters in the HIPAA statute that may limit the scope of any regulatory changes,” Bourque said.

For example, the statute says that “nothing in this part shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention.”

“Some of that really does prevent closing that loophole entirely” because many state reporting requirements are “based on public health authorities,” Shachar said. For example, Louisiana used its public health authority to require providers to report all abortions and post-abortion complications.

Another looming issue is the possibility of conflict between a revised privacy rule and state laws requiring disclosures to law enforcement in some circumstances.

“I just wonder to what extent HHS’s rulemaking authority via a congressional statute would be able to preempt state criminal laws,” Hart said. “It strikes me that that’s new territory, and that rulemaking alone might not be able to resolve it absent a congressional statute.”