The Biden Administration’s Efforts to Protect Reproductive Health Information from Law Enforcementdobbs it depends on how much authority your health agency has to preempt state criminal laws, a thorny issue for health care attorneys.
a recent executive order shows that the administration is considering how to strengthen privacy protections for abortion-related health information. It is part of a broader fight by the Biden administration to make substantive policy changes to protect access to reproductive health, as it lacks the votes to pass new legislation.
Advocates worry that prosecutors and law enforcement officials may target people’s reproductive health information in their efforts to enforce abortion bans. The Health Insurance Portability and Accountability Act privacy rule allows abortion providers to share reproductive health information with law enforcement, and some state laws require that sharing in certain situations.
HHS should consider tightening the HIPAA privacy rule provision that allows health care workers and facilities to communicate with law enforcement, said Matthew Cortland, senior resident fellow at Data for Progress, who works in health care and disability.
“When a pregnant patient shows up in the emergency department, she shouldn’t be afraid that a health care worker will call the police because she suspects that patient is, for example, self-managing a medical abortion,” Cortland said.
HHS did not respond to a request for comment on whether the agency is considering such a move.
“The HIPAA statute has a strong preemptive provision, but the Privacy Rule, as written, shows a lot of deference to state law,” said Deven McGraw, co-founder of Ciitizen Corp., a health technology company for the consumer. McGraw previously worked on information privacy at the Health and Human Services Office for Civil Rights.
“To what extent can HHS use a regulation attached to a preemption provision to strike down a state criminal law?” she said. “That is a difficult question. I’m not sure what the answer to that is.”
The HIPAA enforcement provision, as it currently stands, will likely have a “chilling effect” on patients seeking reproductive health care, said Carmel Shachar, executive director of the Petrie-Flom Center for Health Law Policy, Biotechnology. and Bioethics from Harvard Law School. .
Patients who self-manage abortions may be reluctant to go to the emergency room for follow-up treatment if something goes wrong, he said.
“Inserting status between a woman and her doctor is really problematic, and will likely lead to suboptimal outcomes, including even a risk of death for women,” Shachar said.
HHS issued guide on the protection of patient privacy after the decision of the US Supreme Court. dobbs abortion decision, but “there really isn’t much more than beefing up enforcement, considering ways to prevent fraud and working with the FTC on privacy,” said Christopher Hart, a partner at Foley Hoag LLP in Washington and president of the firm. . privacy and data security practice. “And what that tells me is that, in the absence of additional regulation, what we’re looking for is education for providers and patients about the current limits of what’s allowed.
Without changes in law or regulation, there appears to be little help the administration can provide to providers facing court orders, subpoenas or police investigations, Hart said.
“Once these requests start to happen, it will be up to providers and covered entities to decide whether to respond and whether to choose to litigate,” he said.
The enforcement provision in the HIPAA privacy rule is the result of a compromise between HHS and the Department of Justice, which was “lobbying hard on the need for data to sometimes be provided to law enforcement.” public for legitimate inquiries,” McGraw. said.
The current provision allows providers to release a limited set of information that could be useful to an investigation, such as “name, address, date of birth, Social Security number, blood type, type of injury,” McGraw said. But she would not allow law enforcement to ask a hospital for “all the names of the women who have had abortions at its facility” unless required by state law or a court order, she said.
Any review of the privacy rule would have to be narrowly tailored to make sure the law enforcement provision could still allow the kind of widely accepted disclosures for which it was made, said Kirk Nahra, co-chairman of the cybersecurity and privacy practice. at Wilmer Hale.
“That provision is the one used if a patient attacks a nurse” or if a robber with a gunshot wound shows up at a hospital, Nahra said. “I don’t know if you want to ban that disclosure.”
The Biden administration could model its approach after the substance abuse confidentiality regulations, which were written in the 1970s to encourage people to seek treatment without fear of legal repercussions. The rules require the patient’s permission to release information to law enforcement.
It would be feasible to review the regulation and exclude the disclosure of a specific type of health information, such as reproductive health information, Nahra said. Whether the Biden administration would explicitly adapt the rule in that way is a “political question,” he said.
Another more promising route would be to “make it more difficult for law enforcement to use information from a health care facility to prosecute a person across a wide range of health conditions,” McGraw said. Highlighting reproductive health information could invite legal challenges or policy changes every time the presidency changes parties.
Regulation vs. State Law
The fact that the enforcement provision comes from the privacy rule rather than the text of the statute means “HHS could certainly try to narrow down the exception through rulemaking,” said Dianne Bourque, an attorney at health privacy at Mintz.
HHS will likely have to go through the standard rulemaking process, including a potentially long notice and comment period, Cortland said.
And there are still “parameters in the HIPAA statute that may limit the scope of any regulatory change,” Bourque said.
For example, the statute says that “nothing in this part shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of illness or injury, child abuse, birth or death, surveillance of public health, or public health research or intervention.”
“Some of that really prevents closing that loophole completely” because a lot of state reporting requirements are “based on public health authorities,” Shachar said. For example, Louisiana used its public health authority to require providers to report all abortions and post-abortion complications.
Another looming issue is the potential conflict between a revised privacy rule and state laws that require disclosures to law enforcement in some circumstances.
“I wonder to what extent HHS regulatory authority through a congressional statute could preempt state criminal laws,” Hart said. “I’m surprised that this is new territory, and that regulation alone might not be able to solve it in the absence of a statute from Congress.”