New reproductive privacy rule could bring challenges for clinicians

Key takeaways:

• A federal reproductive health care privacy rule is intended to prevent law enforcement from obtaining reproductive care medical records.
• The protections only apply to lawfully received abortion care.

In June, HHS finalized a HIPAA privacy rule to prevent law enforcement in abortion-restrictive states from obtaining reproductive care medical records to prosecute patients and physicians.

The new rule is noteworthy because it relies on clinicians — not state law enforcement — to make determinations about whether an abortion was provided lawfully, according to Carmel Shachar, JD, MPH, assistant clinical professor of law and faculty director of the Health Law and Policy Clinic at the Center for Health Law and Policy Innovation at Harvard Law School. The reproductive privacy rule holds health care providers to a reasonable standard, Shachar wrote, meaning clinicians must decide “whether it would [be] reasonable for a similarly situated regulated entity to determine ... that the reproductive health care is lawful under the circumstances in which such health care is provided.”

The reproductive privacy rule has the potential to close a significant privacy loophole in HIPAA, especially for patients who travel to other states for abortions, Shachar said; however, it may be challenging for clinicians to implement.

Healio spoke with Shachar about how the new privacy rule affects pregnant patients, clinicians and health care organizations, which patients remain unprotected and why, and what legal challenges to the rule may lie ahead.

Shachar’s viewpoint article was recently published in JAMA.

Healio: How does the HIPAA privacy rule to support reproductive health care privacy work?

Shachar: HIPAA is the regulatory regime that governs our medical data, security and privacy. HIPAA does a lot, but it also has many limitations. In the context of accessing abortion care, one big limitation that people realized right after Dobbs was that there a lot of exceptions for law enforcement and for courts to get access to medical records. So, HIPAA was not protecting people’s medical records from law enforcement who might want those records to investigate, say, getting an abortion. The reproductive privacy rule is an attempt to close that loophole. It does so partially, not completely. What it does is it says if you get a lawful abortion, then your records are protected from any law enforcement seeking to prosecute you for getting that abortion.

This rule does not cover someone getting an abortion that is unlawful in the state where they reside.

Healio: This shifts some of the authority regarding medical records to clinicians. How does this rule directly impact the day-to-day work of clinicians and health care organizations?

Shachar: This rule is unusual in its approach to determining what is a lawful abortion. It does not give the authority to, say, an attorney general or HHS. The rule states that the clinician is the closest person to the medical records. Therefore, they should be able to determine whether a lawful abortion was provided. That empowers clinicians.

It can also potentially put clinicians in a very challenging spot because it is very possible that state law enforcement will argue that an abortion was not lawful and will continue to push for records. This does not solve that problem; however, it is an important tool, especially for providers who want to make sure people have access to medically necessary abortions.

Healio: How might this rule apply to people seeking abortion care who fall into legal gray areas?

Shachar: We know that a lot of people are traveling across state lines right now to access abortion care. We see it in the increased number of abortions that these border states are performing. The rule is very explicit to say we are protecting those people. If you are traveling to a state where the abortion is lawful, you receive that protected status, even when that medical record follows you back home. It is protected. That is important and I am glad HHS moved to do that.

Healio: In the paper, you write that it may be challenging to implement this rule and that it “remains to be seen how effective it will be.” Can you explain why that might be?

Shachar: First, clinicians are going to have a hard time with the fact that they now determine what is lawful. When you have a gray area, like telehealth abortion care, do you go by what the physician’s home state says in regard to shield laws? Then, you might consider if it a lawful abortion. Do you go by the patient’s state laws? It is unclear what protections apply there. There are many court cases being litigated right now about exceptions for the life and health of the pregnant person. I am not sure that HHS necessarily designed this rule to be a tool there, but I think it can be a tool there.

A clinician can now say that HIPAA empowers me to decide whether this abortion is lawful. We will see litigation around that, similar to the way we see litigation around the use of EMTALA (Emergency Medical Treatment and Labor Act) to provide legal cover for abortions that might otherwise be unlawful in certain states.

Healio: You mentioned that this rule does not close all of the loopholes. What more needs to be done to better protect patients with regard to HIPAA?

Shachar: The challenge is this further heightens the disparities between the people who can access jurisdictions with lawful abortion care and those who cannot. It is a useful rule, particularly related to travel for abortion care. But the people we are most worried about — young people, people with low incomes, or those living in a state with banned abortion care — it is not really going to protect them.

HIPAA is focused on medical records. HIPAA is not going to protect the Facebook message you sent your best friend about the fact that you need an abortion. HIPAA is not going to protect your geolocation data showing that you traveled for an abortion. HIPAA will not protect your internet search records. People need to be aware that we live in a digital age and there are many breadcrumbs that can be accessed by law enforcement.

Another point I want to make: the Supreme Court did a lot this term that impacts what legal academics call administrative law. For the last 40 years, when a court has looked at an agency’s decisions, they gave them deference, because they are the experts. After a recent ruling, that changed. Recent Supreme Court decisions have created a real vulnerability for administrative actions, of which this new rule will absolutely be a big target. I expect to see challenges here, especially now that the Supreme Court has empowered people to take the administrative state to task. This rule was worth doing, but I do not think everything is safe and settled. This is not the final chapter.

References:

• HHS. HIPAA and Reproductive Health. https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/index.html. Accessed July 16, 2024.
• Shachar C. JAMA. 2024;doi:10.1001/jama.2024.9670.

For more information:

Carmel Shachar, JD, MPH, can be reached at cshachar@law.harvard.edu.