“A new rulemaking by the Biden administration seeks to lessen the harmful effects of abortion bans by protecting certain health data from being used to prosecute both clinicians and patients. But in the current draft, the rulemaking is designed to reinforce the privacy of reproductive health in states where abortion is legal and does little for those seeking abortion in states where it is illegal. Further, some states, like Idaho, are implementing a law that makes it illegal to travel out of state for an abortion, effectively blocking its citizens from the potential benefits of this rulemaking.
The draft Notice of Proposed Rulemaking, titled “HIPAA Privacy Rule To Support Reproductive Health Care Privacy,” suggests new prohibitions on certain disclosures of personal health information that may be used to punish care seekers and care providers in the conduct of lawful health care. Specifically, the proposed rulemaking would “prohibit a regulated entity from using or disclosing PHI [personal health information] where the PHI would be used for a criminal, civil, or administrative investigation into or proceeding against any person in connection with seeking, obtaining, providing, or facilitating lawful reproductive health care, or identifying any person for the purpose of initiating such an investigation or proceeding.”
While well-intentioned, this rulemaking will further codify the rapidly growing reproductive health disparities at the state level and do little in abortion ban states that already have the weakest support for maternal health. Just as state-based policies that overruled or ignored federal mandates during Covid resulted in exacerbated disparities and higher death rates, in its current form, this rulemaking will leave too many women behind — including those who, arguably, need its protections the most. [..]
The clearest benefit of the proposed rulemaking would be protections for those travelling out of state for abortion care. The rule would protect health care providers and other HIPAA-covered entities from being legally obligated to disclose certain types of personal health information to state, local, or federal law enforcement authorities. While this doesn’t alleviate the need for those in abortion deserts to travel huge distances to seek care, it does provide them — and those assisting them — protections from data disclosures that could be used to prosecute them back home.
[..] If patients fear prosecution while seeking health care, they are less likely to divulge a complete picture of their situation, which creates a scenario where clinician decisions are based upon partial or even obfuscated data, resulting in poorer or even harmful outcomes. Incomplete and/or inaccurate health information undermines public health.
[..] HIPAA provisions that further protect certain types of especially sensitive data are not new. HIPAA already provides special protections for psychotherapy notes due to the sensitive and potentially harmful impacts that inappropriate uses of that data could cause and patients are made aware of these additional protections to their privacy. In reproductive health, the potentially harmful data is far more diffuse, highly complex, scattered across many health care entities and extremely easy to misunderstand or abuse.
Given the massive complexity across the multitude of state abortion bans, the federal rulemaking would create multiple scenarios. Specifically, it would not apply to or help citizens in abortion ban states that have also blocked travel to obtain an abortion. In abortion ban states without travel bans, the rulemaking would protect the use of health care data from situations where a person travelled to a state with legal abortion to receive care. In states where abortion is legal, the rulemaking will provide additional reproductive health privacy protection to those who obtain care as well as the providers who offer it, including to people from out of state.
The rulemaking also does not address privacy beyond HIPAA-covered entities — namely, the larger issue of the health information surveillance economy. We continue to see digital health providers and health care systems fail at protecting privacy as specified in their own policies, and most consumer data not covered by HIPAA can be used for health surveillance. For example, over the counter pharmacy and supermarket data are highly effective for determining health care activities, such as the number of pregnancy tests sold by pharmacy. Regulation of the consumer surveillance economy is a public health issue that must be addressed nationally.
Stalkerware is epidemic, a well-known tool of domestic violence and is already being used to track those seeking reproductive care. It is not far-fetched at all to assume that anti-abortion groups and autocratic state governments will turn to stalkerware for criminal investigations or even vigilantism. The FTC should continue to prosecute stalkerware harms, but it will take collaborative efforts across government and with states to rein in this insidious and harmful problem. A national approach would be best and building upon state-level efforts could be an accelerator. [..]
In the absence of national privacy legislation, we must greatly enhance health care and cyber literacy nationwide. Education campaigns, such as the recently established reproductiverights.gov are helpful but only marginally effective. We must target comprehensive cross-platform messaging into the markets where the information can do the most good.
There are many models to be considered and tested, from TV and streaming commercials and community outreach to chatbots and self-destructing messaging that can help ensure the privacy of two-way interactions. Given the known epidemiology and demographics, we should be actively targeting those with social vulnerabilities and social deprivation, including minors and people from disadvantaged ethnic backgrounds. One of the earliest digital health interventions, Text4Baby, an evidence-based opt-in prenatal and parenting information intervention, has proven that a simple text message program can improve patient knowledge, increase vaccination rates, reduce perinatal alcohol use, and encourage appropriate healthcare utilization.
Even better, the federal government should extend its efforts at education to create a nationally available platform that provides accurate and clear information on pregnancy, pre- and antenatal care, adoption, abortion, and, of course, personal privacy. The platform could interact with all stakeholders from Planned Parenthood to crisis pregnancy centers, abortion clinics and houses of faith — all curated, managed, and administered as a one-stop-shop for information that could also be used by formal education programs. It will surely be tricky to coalesce such diverse and often divergent groups and opinions within a single platform, which could become a lightning rod. But it’s a worthwhile effort, and combative groups could lose federal funding or be sanctioned or expelled.
Though a rulemaking may seem wonky, it will affect the lives of untold numbers of Americans. The comment period is open through June 16. If you work in health care, please consider advocating for your organization to respond to this critically important set of issues. The effective date of the final rule will be 60 days after its publication. Now is our time to act.”
Full editorial, ED Perakslis, KD McMillan and J Dunn, STAT News, 2023.5.12