Dive Brief:
- Two Democratic senators are urging the Biden administration to update the Health Insurance Portability and Accountability Act to prevent health data from being shared with law enforcement agencies targeting people who have an abortion, following the Supreme Court’s decision last month to overturn Roe v. Wade, criminalizing the procedure in some U.S. states.
- The HHS on Wednesday issued guidance saying providers are not allowed under HIPAA to disclose patient information unless faced with a court order. But regulators have the authority to do more, Sens. Michael Bennet, D-Colo., and Catherine Cortez Masto, D-Nev., wrote in a Friday letter to HHS Secretary Xavier Becerra.
- The senators said the HHS should update HIPAA to limit when covered entities can share information on abortion or other reproductive health services, and specifically clarify that information can’t be shared with law enforcement pursuing abortion patients.
Dive Insight:
Late last month, the Supreme Court overturned Roe v. Wade, ending decades of settled precedent and the constitutional right to abortion. In the wake of the bombshell decision, dozens of states quickly restricted access to the procedure or banned it outright, resulting in patchwork medical access across the U.S. and a legal quagmire for providers.
The decision has jump-started a nationwide conversation about privacy. In today’s age of rampant data proliferation and collection, abortion and digital privacy advocates are concerned individuals’ digital footprints could incriminate those who seek access to or information about an abortion online.
As a result, many women have begun deleting menstrual cycle tracking and other health-related apps following the Roe decision, and abortion advocates have warned people seeking the procedure to be wary of their text messages, browser histories, emails and other digital records, which have been used to prosecute pregnancy-related criminal charges. Such data is not protected under health data privacy rules.
The Supreme Court’s ruling has also reinvigorated calls for legislation to enact greater data privacy protections, a push that has had bipartisan support in the past.
In the meantime, Masto and Bennet are calling on the HHS to use its existing scope of regulatory power to beef up HIPAA’s privacy measures to better protect patients seeking reproductive healthcare. The privacy rule is meant to “define and limit” the circumstances when a person’s health data can be used or disclosed by covered entities.
Along with updating the rule to clarify which organizations are covered entities, and limiting when that entity can share information on abortion services, the HHS should clarify that the data can’t be shared with law enforcement agencies, the senators wrote.
In addition, the senators urged the HHS to determine that crisis pregnancy centers, which encourage people to carry their pregnancies to term, are required to follow HIPAA’s privacy requirements.
“Following the Supreme Court’s decision in Dobbs, millions of Americans have lost a fundamental constitutional right to make their own health and reproductive decisions. We must do all that we can to protect their fundamental right to privacy,” the senators wrote.
Late last month, the HHS issued guidance finding that data disclosures without patient approval are permitted only in narrow circumstances under HIPAA, including if providers face a court order to comply with state law.
“Where state law does not expressly require such reporting, the Privacy Rule would not permit a disclosure to law enforcement,” the HHS said.
