WASHINGTON — Abortion-rights lawmakers in Congress are aiming to close loopholes that may force providers and hospitals to disclose a patient’s medical records if they are subpoenaed or requested by law enforcement.
These exceptions have become especially worrisome to patients in states that are imposing restrictions on abortion in the wake of the Supreme Court ruling in Dobbs v. Jackson Women’s Health Organization that overturned the federal right to an abortion and kicked the issue back to the states.
According to Rep. Sara Jacobs (D-Calif.), there are a number of ways that patient information could be shared with law enforcement despite HIPAA law, which is supposed to keep health information from being disclosed without the patient’s consent.
“There are some exceptions that allow health care providers to share patient’s abortion data,” Jacobs said in an interview. “I think it’s important to know that right now, your health records aren’t necessarily protected. And that is because HIPAA privacy protections weren’t prepared for this moment.”
Jacobs has teamed up with Rep. Anna G. Eshoo (D-Calif.) to the Secure Access for Essential Reproductive (SAFER) Health Act to close those loopholes.
The Biden administration also could act to close those loopholes almost immediately through rulemaking at the Department of Health and Human Services, said health care lawyer Linda Malek of the Moses Singer Law Group.
Malek said HHS could change HIPAA disclosure provisions and require that doctors and other covered entities under HIPAA obtain explicit consent from patients before sharing health information with law enforcement.
Other legal experts also expect the HHS to release guidelines requiring consent from the patient before doctors disclose reproductive health information, especially with a Democratic, abortion-rights president in place.
“Generally, physicians don’t want to ignore what a court tells them to do,” said Roy Wyman, a privacy and security attorney. “They’re wanting to have some guidance that would allow them to keep the relationship with the patient secure and not have their patients worrying about this. The big concern is that women are not going to receive treatment that they need for fear of law enforcement.”
Jacobs said she has been speaking with both HHS and the Biden administration to work on closing some of these exemptions in privacy law via rulemaking. A rulemaking session allows the department to develop and publish rules after soliciting comments from the public and other stakeholders.
Gabriela Sibori, a spokesperson for HHS, said that the department is in a session of rulemaking and could not comment on any potential changes to data privacy law around HIPAA and reproductive health. She also could not say when HHS will finish its rulemaking session.
But even if HHS changes its policies, Jacobs said congressional legislation would enshrine the safeguards. Jacobs, however, acknowledged that her bill is unlikely to pass in a Republican-controlled House.
“Executive rulemaking by the Department of Health and Human Services would be enough to close some of them,” Jacobs noted “But if this administration can make this change, the next administration could reverse it.”
Wyman said it’s still possible that women seeking abortions will be prosecuted even if HHS institutes a consent provision before doctors can legally disclose reproductive health records.
For instance, law enforcement and courts will still be able to subpoena grocery stores to see when someone buys or stops buying menstrual products like tampons, he said. Even rideshare companies could be forced to disclose routes to abortion clinics, he said.
Stacey Tovino, a professor at the University of Oklahoma’s College of Law, said that congressional action would be needed to extend privacy protections under HIPAA to additional persons and organizations. Apps, fitness watches, Google Maps routing a trip to Planned Parenthood and health care providers who take cash or credit cards (but not insurance) all hold reproductive health information and are not covered by HIPAA.
“If we want to expand the application of the HIPAA pivacy rule so that all of the people who collect, maintain, use and disclose reproductive health information are regulated, then we’d need Congress to amend HIPAA,” Tovino said.
Jacobs said she is still helping with a Senate companion bill for the SAFER Health Act. She said she thinks it’s necessary to begin thinking about privacy protections both under and separate from HIPAA in a post-Dobbs world.
“The Dobbs decision has prompted a lot of conversation around what we need to do to protect privacy, and especially the privacy of people who are in states criminalizing abortion,” Jacobs said.
Published in conjunction with 
