The Pendulum Swings Both Ways: State Responses to Protect Reproductive Health Data, Post-Roe

The U.S. Supreme Court docket is anticipated to imminently situation its opinion within the case Dobbs v. Jackson Girls’s Health Group (“Dobbs”)If the Court docket guidelines in a fashion to overturn Roe v. Wade, states can have discretion in figuring out how to regulate abortion companies.[1] Such a ruling would overturn practically 50 years of precedent, leaving sufferers, reproductive well being suppliers, well being plans, pharmacies, and lots of different stakeholders to navigate a number of uncharted authorized points. Particularly, stakeholders will seemingly want to untangle the online of cross-state authorized points which will emerge.

One such situation will likely be how and whether or not prosecutors and regulation enforcement personnel searching for to implement abortion bans will likely be ready to entry affected person medical data and use them in a courtroom of regulation.

A. Making Sense of the Publish-Roe Panorama

States have taken totally different approaches to regulating abortion, and lots of have current legal guidelines that may turn out to be efficient if Roe v Wade is overturned. As of June 1, 2022, 22 states had legal guidelines to prohibit the legality of abortion whereas 16 states and the District of Columbia have legal guidelines that shield the correct to abortion earlier than viability.[1] As an illustration, Texas is certainly one of 13 states with a “trigger law”, or abortion regulation that may go into impact within the occasion of an overturn of Roe, that may ban practically all abortions. Particularly, the Texas Human Life Safety Act of 2021 (“TXHLPA”) would create a felony offense in opposition to any one that “knowingly performs, induces, or attempts an abortion.”[2] As well as, the regulation would (1) require the state lawyer common to search a civil penalty of not lower than $100,000 for every violation[3] and (2) require the state medical board to revoke the license of any well being care skilled who “performs, induces, or attempts” an abortion in violation of the statute.[4]

If set off legal guidelines like TXHLPA take impact, state attorneys common and different regulation enforcement personnel could search affected person medical data so as to construct their circumstances in opposition to suppliers who carry out, induce or try abortions. Beneath sure state legal guidelines[5], those that help and abet the abortion course of can also be topic to felony prosecution.

B. HIPAA Background

The Health Insurance coverage Portability and Accountability Act (“HIPAA”), the Federal healthcare privateness regulation, governs the disclosure of protected well being data (“PHI”), and customarily restricts disclosure absent affected person consent.[7] Typically, HIPAA preempts contradictory state regulation (e.g., a coated entity can’t adjust to each the state and federal regulation or the state regulation impedes adherence to HIPAA). Nonetheless, HIPAA doesn’t preempt state regulation that’s extra stringent than HIPAA, or in different phrases, offers better privateness protections for the person who’s the topic of the PHI.

One could moderately suppose that prosecutors and regulation enforcement can be prevented from accessing PHI, corresponding to these relating to a person acquiring an abortion or associated reproductive well being companies. Nonetheless, whereas HIPAA typically prohibits the disclosure of PHI with out the consent of the affected person, there are a number of exceptions.[8] Notably, a coated entity could also be compelled to share PHI for law-enforcement functions, as required by regulation, or in response to a judicial or administrative continuing (e.g., a courtroom order, subpoena, discovery request, or summons).[9]

Nonetheless, it ought to be famous that HIPAA requires coated entities to solely disclose the “minimum necessary” data to fulfill such a request for data. Accordingly, abortion suppliers and different coated entities, in addition to their enterprise associates, should fulfill prosecutors’ and regulation enforcement brokers’ requests for disclosure of medical data and different PHI within the narrowest means potential.[10]

C. Connecticut’s Reproductive Freedom Protection Act

Whereas many set off legal guidelines would rapidly criminalize abortion within the occasion of the overturn of Roe, which might seemingly lead to requests for PHI disclosures below HIPAA for regulation enforcement functions, the pendulum is swinging within the different course in different states.  For instance, some states have handed legal guidelines or are considering taking motion to forestall disclosure of PHI associated to reproductive well being companies, together with abortion. This will likely shield sufferers and suppliers, amongst others, who could also be subjected to PHI request from prosecutors and regulation enforcement brokers.

Notably, on Could 5th, Connecticut Governor Ned Lamont signed the Reproductive Freedom Protection Act (“the Act”), which seeks to shield HIPAA coated entities from legal responsibility associated to reproductive companies legally carried out in Connecticut however that could be unlawful elsewhere.[11] The goal of this laws shouldn’t be solely to protect Connecticut residents from legal responsibility for acquiring or receiving reproductive well being companies, but in addition to shield vacationers from states which have outlawed abortion.[12] It accomplishes this by: (1) stopping HIPAA coated entities from disclosing PHI associated to reproductive well being companies with out the written consent of the affected person;[13] (2) prohibiting out-of-state judicial requests to situation a subpoena in Connecticut searching for to acquire reproductive well being PHI;[14] and (3) stopping public businesses from aiding investigations searching for to impose felony or civil legal responsibility for reproductive well being care.[15] As well as, the regulation creates a reason for motion that enables individuals who had been sued in one other state for reproductive well being care to get better litigation bills.[16]

D. Reproductive Health Information Privateness Publish-Roe: Two Illustrative Situations

  • What occurs if a prosecutor or regulation enforcement agent in a state with an abortion ban seeks the medical data of a affected person who acquired an abortion in Connecticut, for functions of implementing that state’s abortion ban?

It’s seemingly that coated entities in Connecticut wouldn’t be permitted, absent affected person authorization (or different licensed consultant consent), to disclose the affected person’s reproductive well being medical data even when the prosecutor or regulation enforcement agent had a legitimate subpoena to acquire such data. It is because Connecticut’s Reproductive Freedom Protection Act requires Connecticut judges to reject a subpoena duces tecum requesting reproductive well being data from a Connecticut coated entity. Subsequently, due to the Act, a Connecticut coated entity ought to by no means obtain a subpoena for reproductive well being data from an out-of-state courtroom with out enough authorization from the affected person or a licensed consultant. Moreover, the Act would seemingly not be preempted by federal regulation as a result of it’s extra stringent than HIPAA. The Act meets a number of standards of the “more stringent” necessities, as enumerated in HIPAA: (1) the Act “prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under [HIPAA]” as a result of it prohibits disclosure of reproductive well being data upon subpoena, which is generally permissible below HIPAA and (2) the Act “provides greater privacy protection for the individual who is the subject of the individually identifiable health information” as a result of it restricts the power of prosecutors and regulation enforcement brokers to entry such people’ PHI, which will increase the power of people to shield the privateness of their reproductive well being data.[17]

Nonetheless, it ought to be famous that the Act doesn’t explicitly prohibit HIPAA enterprise associates from disclosing reproductive well being data; due to this fact, such enterprise associates is likely to be compelled by subpoena to disclose such data to a prosecutor or regulation enforcement agent in a state that criminalizes abortion. This raises an vital query of whether or not enterprise associates, together with digital well being report firms, could also be permitted below the Act to make disclosures of PHI even the place a HIPAA coated entity wouldn’t be permitted to achieve this below the Act.

Moreover, the Connecticut regulation solely protects the information of people upon subpoena; it doesn’t make point out of some other strategies of compelling historically protected PHI, corresponding to regulation enforcement requests and administrative requests. Subsequently, there could also be different methods by which an outdoor celebration could search to achieve entry to this reproductive well being knowledge in Connecticut.

  • What occurs if a prosecutor in a state with an abortion ban, corresponding to Texas, seeks the medical data of a affected person who acquired an abortion in a non-safe harbor state?

Coated entities and enterprise associates could also be permitted to disclose PHI on this situation, relying on the kind of request. HIPAA permits for disclosure with out affected person consent, as long as the disclosure responds to judicial or administrative proceedings, or for regulation enforcement functions. If the coated entity had been to obtain an administrative request or licensed investigative demand asking the entity to disclose a affected person’s reproductive well being data, the entity could also be required to disclose the PHI or danger dealing with contempt of courtroom. Nonetheless, HIPAA specifies that such requests should: (1) request data that’s “relevant and material to a legitimate law enforcement inquiry”; (2) be particular and restricted in scope; and (3) be requesting PHI that would not be de-identified. Subsequently, if a prosecutor or regulation enforcement officer requested data that arguably doesn’t fulfill one of many above three standards, then the coated entity below HIPAA can be required to refuse to present such data. Moreover, coated entities are required to adjust to the “minimum necessary” doctrine in all states, no matter whether or not the state protects reproductive well being data. It’s unlikely {that a} prosecutor or regulation enforcement officer may acquire identifiable reproductive well being data with out a legitimate subpoena or different court-issued doc, even in a state with out a protecting regulation like Connecticut’s.

E. Conclusion

If the U.S. Supreme Court docket overturns Roe v. Wade by way of its ruling in Dobbs, sufferers and coated entities ought to pay attention to state legal guidelines that influence their rights and obligations round disclosure of abortion-related PHI within the context of out-of-state regulation enforcement efforts. As illustrated by the Connecticut Reproductive Freedom Protection Act, such disclosures could also be barred inside states with reproductive well being privateness safety legal guidelines. Additional, the Connecticut regulation could function a mannequin for different states searching for to prolong reproductive well being privateness protections for his or her residents and others searching for reproductive well being companies inside their borders.

Attorneys at Epstein Becker & Inexperienced are well-positioned to help with navigating the complexities which will emerge from the Dobbs determination. For added details about the problems mentioned above, or when you have some other authorized or regulatory compliance issues, please contact the Epstein Becker & Inexperienced lawyer who often handles your authorized issues, or one of many authors of this weblog put up.

Ada Peters contributed to this text. Ada is a 2022 Summer season Affiliate for the Washington, DC workplace who shouldn’t be admitted to the observe of regulation.


[1] Thomas Dobbs v. Jackson Women’s Health Organizationet al., No.19-1392 (leaked Could 3, 2022).

[2] Guttmacher Institute, Abortion Policy in the Absence of Roe, June 1, 2022.

[3] Tex. Health & Safety Code Ann. § 170A.002 (2021). (also called “H.B. 1280”).

[4] Tex. Health & Security Code Ann. § 170A.005.

[5] Tex. Health & Security Code Ann. § 170A.007.

[6] Such state legal guidelines embrace Texas’ SB 8 and Oklahoma’s SB 1503.

[7] 45 CFR § 160.502.

[8] 45 CFR § 160.512.

[9] 45 CFR §§ 160.512(e)-(f).

[10] 45 CFR § 160.502(b).

[11] The Workplace of Gov. Ned Lamont, Gov. Lamont Signs First-in-the-Nation Reproductive Rights Legislation,   Could 5, 2022). P.A. 22-19.

[12] The Workplace of Gov. Ned Lamont, Gov. Lamont Signs First-in-the-Nation Reproductive Rights Legislation,  (Could 5, 2022).

[13] 2022 Conn. Legis. Serv. P.A. 22-19 § 2 (S.B. 5414), Efficient July 1, 2022.

[14] P.A 22-19 § 3.

[15] P.A. 22-19 § 6.

[16] P.A. 22-19 § 1.

[17] 45 C.F.R. 160.202 

Source link