The Biden administration has proposed a new rule that would ban providers, health insurers and other entities covered by the HIPAA privacy law from sharing patient information that could be used to investigate abortions.
The proposed regulation released Wednesday from the HHS Office for Civil Rights is meant to protect patient-provider confidentiality and prevent private medical records from being used against people seeking, obtaining or providing legal reproductive healthcare, including an abortion or miscarriage management, the HHS said.
Privacy lawyers said the regulation would insulate physicians from the chilling effect of abortion bans, freeing them to keep detailed notes on patient visits and have open and honest conversations with patients about their reproductive healthcare options — even in states where abortion is illegal.
However, the rule — if finalized — is likely to face a legal challenge from conservative states.
The Supreme Court in June overturned the constitutional right to an abortion in its Dobbs v. Jackson Women’s Health Organization ruling. After the decision, dozens of states restricted access to the procedure, causing legal abortions to plummet in the U.S.
Pressure has been mounting on the Biden administration to protect the data of patients seeking abortion services, amid concerns that data could be used to prosecute people who seek or provide the procedure. Digital records have been used to prosecute pregnancy-related criminal charges in the past.
Now, the HHS is leaning into one strategy — strengthening the Health Insurance Portability and Accountability Act — to ameliorate concerns that medical data stored by healthcare entities could be weaponized to prosecute patients and providers. Experts have said the law as it currently stands isn’t adequate to protect reproductive health information post-Dobbs.
Under HIPPA, providers are allowed (though not required) to report abortion data if they receive a court order or summons, or a request from law enforcement.
The HHS now wants to modify the law to avoid the chance those provisions could be used as a pretext for organizations to request the disclosure of a person’s sensitive health information to “identify, investigate, sue or prosecute someone for seeking, obtaining, providing or facilitating” legal reproductive healthcare, including abortions, according to a release on the proposal.
The rule would prohibit HIPAA-covered entities from disclosing protected health information in tandem with a criminal, civil or administrative investigation into any person in connection with the provision of legally provided reproductive healthcare. It also prohibits them from disclosing information identifying any person for the purposes of starting an investigation.
The prohibition applies in the case of investigations authorized in a state where abortion is illegal, into care provided in a state where it is legal.
So, if a resident of a state where abortion is banned travels to a neighboring state where the procedure is allowed and receives an abortion, the provider in that state cannot share the patient’s information with their home state.
The proposal would also apply for reproductive healthcare provided in a state where the investigation is authorized and the care is legal.
This could help in cases such as that of a women who needs miscarraige treatment for an ectopic pregnancy in a state with an abortion ban, with an exception for the life of the mother. That women’s provider could not share details of her medical treatment with the state, even if she is accused of getting a voluntary abortion, shielding the woman and doctor in event of an investigation.
A handful of states have already imposed criminal or civil liability for people who seek out abortions, people who help facilitate them or the providers who furnish them.
Even in states with exceptions on abortion bans for the life of the mother, the laws have resulted in physicians delaying or refusing care to people with medically complex pregnancies over fear of liability.
OCR Director Melanie Fontes Rainer said the proposed rule stems from physician concerns over abortion restrictions and how they could erode the patient-physician relationship.
The rule is about “ensuring that when you go to the doctor, your private medical records will not be disclosed and used against you for seeking lawful care. This is a real problem we are hearing and seeing, and we developed today’s proposed rule to help address this gap and provide clarity to our health care providers and patients,” Fontes Rainer said in a statement.
Payers and providers would still be allowed to disclose sensitive reproductive healthcare data in other circumstances, like in a professional misconduct investigation involving reproductive healthcare, the OCR said.
The proposed regulation relies on a novel “attestation” lever for enforcement. It would require covered entities that get a request for reproductive health data to get a signed document from the requesting organization that the information won’t be used for a prohibited purpose.
The attestation requirement applies when the request is for protected data around judicial and administrative proceedings, law enforcement purposes, health oversight and disclosures to medical examiners and coroners, the OCR said.
Nothing in the new rule stops a law enforcement agency from signing the attestation, receiving the data and then using it in an investigation or criminal proceeding. However, that data could be inadmissable in court given it was illegally obtained, according to Dianne Bourque, a partner at Mintz who specializes in health law.
“What the attestation does do, if a requester signs it, is insulate providers from violating HIPAA” even if the data is later misused, Bourque said.
The new rule does align with existing HIPAA statute, Bourque said, noting there are other categories of data, such as psychiatric notes, that are entitled to special protection. The text of the rule notes that data related to reproductive health has become particularly sensitive and warrants heightened protections.
Yet the OCR is likely to face a legal challenge to the rule if it’s finalized, according to Bourque. States with bans could argue the prohibitions invalidate or limit their sovereign ability to enforce state law.
“I think it’s absolutely going to be challenged,” Bourque said.
