Proposed rules to protect health data in an era of abortion bans fall short

When the Supreme Court overturned Roe v. Wade, it effectively rescinded national protections of reproductive health care. The decision was very quickly followed by abortion bans in 14 states with more pending such as the highly restrictive 12-week abortion ban recently passed by North Carolina.

The tragic results are already too numerous to name here. Beyond life-threatening health risks, women have been arrested for taking abortion pills and arrested for murder for inducing abortions. The massive increase in the digital surveillance of health care has prompted clinicians to make decisions out of fear, leaving fewer options for women seeking health care.

A new rulemaking by the Biden administration seeks to lessen the harmful effects of abortion bans by protecting certain health data from being used to prosecute both clinicians and patients. But in the current draft, the rulemaking is designed to reinforce the privacy of reproductive health in states where abortion is legal and does little for those seeking abortion in states where it is illegal. Further, some states, like Idaho, are implementing a law that makes it illegal to travel out of state for an abortion, effectively blocking its citizens from the potential benefits of this rulemaking.

The draft Notice of Proposed Rulemaking, titled “HIPAA Privacy Rule To Support Reproductive Health Care Privacy,” suggests new prohibitions on certain disclosures of personal health information that may be used to punish care seekers and care providers in the conduct of lawful health care. Specifically, the proposed rulemaking would “prohibit a regulated entity from using or disclosing PHI [personal health information] where the PHI would be used for a criminal, civil, or administrative investigation into or proceeding against any person in connection with seeking, obtaining, providing, or facilitating lawful reproductive health care, or identifying any person for the purpose of initiating such an investigation or proceeding.”

While well-intentioned, this rulemaking will further codify the rapidly growing reproductive health disparities at the state level and do little in abortion ban states that already have the weakest support for maternal health. Just as state-based policies that overruled or ignored federal mandates during Covid resulted in exacerbated disparities and higher death rates, in its current form, this rulemaking will leave too many women behind — including those who, arguably, need its protections the most.

The rulemaking is one outcome of the presidential executive order announced shortly after the Supreme Court overturned Roe v. Wade. The goals of the proposed rulemaking are to improve access to lawful reproductive health care, reduce maternal mortality via improved communications with health care providers, decrease barriers to prenatal health care, enhance mental health and emotional well-being during pregnancy, protect victims of rape and incest, and protect individuals and health care institutions from the costs and liabilities of criminal or civil litigation.

The clearest benefit of the proposed rulemaking would be protections for those travelling out of state for abortion care. The rule would protect health care providers and other HIPAA-covered entities from being legally obligated to disclose certain types of personal health information to state, local, or federal law enforcement authorities. While this doesn’t alleviate the need for those in abortion deserts to travel huge distances to seek care, it does provide them — and those assisting them — protections from data disclosures that could be used to prosecute them back home.

The harms of the threat of prosecution for reproductive care are clearly articulated within the rulemaking. It’s about trust. If patients fear prosecution while seeking health care, they are less likely to divulge a complete picture of their situation, which creates a scenario where clinician decisions are based upon partial or even obfuscated data, resulting in poorer or even harmful outcomes. Incomplete and/or inaccurate health information undermines public health.

But how to convince a scared and distrustful public to feel safe in sharing their most intimate details with health care providers? HIPAA provisions that further protect certain types of especially sensitive data are not new. HIPAA already provides special protections for psychotherapy notes due to the sensitive and potentially harmful impacts that inappropriate uses of that data could cause and patients are made aware of these additional protections to their privacy. In reproductive health, the potentially harmful data is far more diffuse, highly complex, scattered across many health care entities and extremely easy to misunderstand or abuse.

Given the massive complexity across the multitude of state abortion bans, the federal rulemaking would create multiple scenarios. Specifically, it would not apply to or help citizens in abortion ban states that have also blocked travel to obtain an abortion. In abortion ban states without travel bans, the rulemaking would protect the use of health care data from situations where a person travelled to a state with legal abortion to receive care. In states where abortion is legal, the rulemaking will provide additional reproductive health privacy protection to those who obtain care as well as the providers who offer it, including to people from out of state.

The rulemaking also does not address privacy beyond HIPAA-covered entities — namely, the larger issue of the health information surveillance economy. We continue to see digital health providers and health care systems fail at protecting privacy as specified in their own policies, and most consumer data not covered by HIPAA can be used for health surveillance. For example, over the counter pharmacy and supermarket data are highly effective for determining health care activities, such as the number of pregnancy tests sold by pharmacy. Regulation of the consumer surveillance economy is a public health issue that must be addressed nationally.

Stalkerware is epidemic, a well-known tool of domestic violence and is already being used to track those seeking reproductive care. It is not far-fetched at all to assume that anti-abortion groups and autocratic state governments will turn to stalkerware for criminal investigations or even vigilantism. The FTC should continue to prosecute stalkerware harms, but it will take collaborative efforts across government and with states to rein in this insidious and harmful problem. A national approach would be best and building upon state-level efforts could be an accelerator.

We also need to effectively educate reproductive health care seekers regardless of their location, access to technology, insurance type, or income. In addition to calling for this rulemaking, the Biden executive order specifies, “The Secretary of Health and Human Services shall … consider actions to educate consumers on how best to protect their health privacy and limit the collection and sharing of their sensitive health-related information.” It also calls for public health campaigns promoting awareness of free reproductive health services including contraception, ensuring full protections for emergency medical care including pregnancy loss and protections from fraudulent schemes and deceptive practices.

In the absence of national privacy legislation, we must greatly enhance health care and cyber literacy nationwide. Education campaigns, such as the recently established reproductiverights.gov are helpful but only marginally effective. We must target comprehensive cross-platform messaging into the markets where the information can do the most good.

There are many models to be considered and tested, from TV and streaming commercials and community outreach to chatbots and self-destructing messaging that can help ensure the privacy of two-way interactions. Given the known epidemiology and demographics, we should be actively targeting those with social vulnerabilities and social deprivation, including minors and people from disadvantaged ethnic backgrounds. One of the earliest digital health interventions, Text4Baby, an evidence-based opt-in prenatal and parenting information intervention, has proven that a simple text message program can improve patient knowledge, increase vaccination rates, reduce perinatal alcohol use, and encourage appropriate healthcare utilization.

Even better, the federal government should extend its efforts at education to create a nationally available platform that provides accurate and clear information on pregnancy, pre- and antenatal care, adoption, abortion, and, of course, personal privacy. The platform could interact with all stakeholders from Planned Parenthood to crisis pregnancy centers, abortion clinics and houses of faith — all curated, managed, and administered as a one-stop-shop for information that could also be used by formal education programs. It will surely be tricky to coalesce such diverse and often divergent groups and opinions within a single platform, which could become a lightning rod. But it’s a worthwhile effort, and combative groups could lose federal funding or be sanctioned or expelled.

Though a rulemaking may seem wonky, it will affect the lives of untold numbers of Americans. The comment period is open through June 16. If you work in health care, please consider advocating for your organization to respond to this critically important set of issues. The effective date of the final rule will be 60 days after its publication. Now is our time to act.

Eric D. Perakslis, Ph.D., is the chief digital and science officer at the Duke Clinical Research Institute and professor of population health sciences at Duke School of Medicine. Katie D. McMillan, MPH, is the founder and CEO of Well Made Health, LLC. Jessilyn Dunn, Ph.D., is an assistant professor in biomedical engineering and biostatistics and bioinformatics at Duke University.