Rule bolsters privacy protection for abortion seekers
Suppose you’re 16 weeks pregnant and thus ineligible to legally get an abortion in the state of Florida, so you fly to Illinois where it’s still legal and have the procedure. Can Florida demand your medical records from your doctor or insurance company?
Soon, that answer will be no. The Biden-Harris administration announced a final rule Monday strengthening HIPAA privacy protections for people seeking abortions where they are legal and shielding medical records from politicians or prosecutors in states where they are not, according to a release from the U.S. Department of Health and Human Services (HHS).
Previously, health care providers and insurers were permitted to share private medical information to law enforcement agencies for criminal investigations and certain other cases. Some states, such as Alabama, Texas, Oklahoma and Idaho, have sought to stop traveling for abortion by making it a crime to help, or pay for, such travel. Lawsuits over such measures are pending in Alabama and Idaho, Reuters reported.
“Many Americans are scared their private medical information [is] being shared, misused, and disclosed without permission. This has a chilling effect on women visiting a doctor, picking up a prescription from a pharmacy, or taking other necessary actions to support their health,” HHS Secretary Xavier Becerra said in the release. “The Biden-Harris Administration is providing stronger protections to people seeking lawful reproductive health care regardless of whether the care is in their home state or if they must cross state lines to get it. With reproductive health under attack by some lawmakers, these protections are more important than ever.”
Traveling for abortion surged after the Supreme Court struck down the constitutional right to abortion in 2022 and some GOP state legislatures rushed to put bans in place. Democrats and reproductive health supporters warned about an expected flood of prosecution against people traveling for abortion but that has not materialized, although several attorneys general in conservative states have demanded protected information on out-of-state care for transgender patients.
President Joe Biden was scheduled to travel to Tampa Tuesday to talk about the more restrictive abortion bans that have passed in GOP-led states since Roe was overturned, including Florida’s pending 6-week ban.
What is HIPAA?
The Health Insurance Portability Act of 1996 or HIPAA is a nationwide standard that protects the privacy of individuals’ medical records and individually identifiable health information (referred to as “protected health information,” or PHI), according to the HHS.
It prevents disclosure of a patient’s medical records or history in such a way that could identify them without their authorization, except in certain specific situations, and gives the patient rights over their own information and its distribution.
What does the new HIPAA regulation on reproductive healthcare do?
Under the revised regulation, healthcare providers, insurers and other healthcare organizations are prohibited from sharing individual health information to state officials or prosecutors seeking to investigate, sue or prosecute a patient or provider for reproductive healthcare if it was legally provided.
The protection applies if:
The reproductive healthcare is lawful under the law of the state where it was provided, or
The reproductive health care is protected, required, or authorized by Federal law, including the U.S. Constitution, regardless of the state in which such health care is provided, or
The reproductive health care was provided by a person other than the covered health care provider, health plan, or health care clearinghouse (or business associates) that receives the request
Health information may still be voluntarily disclosed under HIPAA’s Privacy Rule if the request for the information “is not made to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.”
hhhWhen can my reproductive healthcare information be shared?
Under the regulation, a covered healthcare provider, health plan, or healthcare clearinghouse may respond to requests for reproductive healthcare information if they get a signed attestation that the request is not for a prohibited purpose. Allowable reasons include:
Health oversight activities
Judicial and administrative proceedings
Law enforcement purposes
Disclosures to coroners and medical examiners Protected health information may be shared with law enforcement when required by law such as through a warrant or under mandated reporting laws, but the HIPAA Privacy Rule requires such disclosure to be as limited as possible to satisfy the request.
hhhhWhat is ‘abortion trafficking’?
Some states that have outlawed abortion in most cases have also sought to prevent residents from going to places where abortion is still legal. Some counties in Texas have made it illegal to use public roads to transport a pregnant person to get to an abortion clinic or legal state, which supporters refer to as “abortion trafficking.”
In November last year, the U.S. Department of Justice
supported two lawsuits brought against Alabama Attorney General Steve Marshall, who threatened to charge anyone doing so under conspiracy statutes.
In a statement, Attorney General Merrick Garland argued, “As I said the day Dobbs was decided, bedrock constitutional principles dictate that women who reside in states that have banned access to comprehensive reproductive care must remain free to seek that care in states where it is legal.”
When does the new rule on reproductive health care information go into effect?
The new regulation goes into effect 60 days after it is published in the Federal Register.