By Ivy Miller
The decision in Dobbs v. Jackson Women’s Health Organization, issued on June 24, 2022, upended five decades of the right to abortion overnight, triggering a flurry of policy changes at both the state and federal levels. In 13 states, the Dobbs decision meant a near-immediate end to most legal abortions—these states all had previously enacted “trigger bans,” written to go into effect immediately upon Roe v. Wade’s overturning. Amid this drastic shift in abortion policy, President Biden issued an Executive Order aimed at safeguarding access to reproductive health services. The Executive Order mobilized several federal agencies, including the Department of Health and Human Services (HHS), to report and act on different ways that reproductive care could be protected.
Shortly after President Biden’s Executive Order, on April 17, 2023, HHS proposed a Rule to amend the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in order to better protect reproductive health records against their use in civil and criminal investigations by abortion-hostile states. The Proposed Rule is intended to protect both people traveling from abortion-hostile states to protective states to receive abortions and the clinicians providing those abortions, as well as patients and clinicians involved in reproductive care administered under the Emergency Medical Treatment and Active Labor Act (EMTALA) in abortion-hostile states.[1] The Proposed Rule would prohibit the use or disclosure of Protected Health Information (PHI) in furtherance of a civil, criminal, or administrative investigation in connection with the provision of legal reproductive care. It would also prohibit releasing the names of anyone involved in such care under the same circumstances, most importantly the clinician and patient. Critically, though, the prohibition applies widely, protecting a non-exhaustive list of activities: anyone “expressing interest in, inducing, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, assisting, or otherwise taking action to engage in reproductive health care, as well as attempting to engage in any of the same” is protected.
The prohibition on uses and disclosures created by the Proposed Rule would apply under three circumstances:
(1) The reproductive care took place in a protective state and the investigation or proceeding is taking place outside of that state (e.g. a resident of State A, where abortion is banned, crosses into State B, where abortion is legal, to receive an abortion);
(2) The reproductive care was authorized or required under a federal provision, like EMTALA (e.g. an individual presents at an emergency department with an ectopic pregnancy, and emergency physicians perform an abortion); or
(3) The reproductive care took place in a protective state and the investigation or proceeding is taking place within that same state.
Importantly, the prohibition is limited to only scenarios in which the PHI requested would further an effort to impose civil or criminal liability on someone for simply “seeking, obtaining, providing, or facilitating reproductive health care.” The prohibition would not apply if, for example, a physician was being sued by a patient for malpractice, where the services performed happened to be reproductive services. Neither would the prohibition apply for certain auditing purposes. These limits on the scope of the prohibition maintain consistency with the spirit and effect of HIPAA as a whole, which is in part to facilitate health information sharing. The narrowness of the scenarios in which the Proposed Rule would apply also indicate forethought on the part of HHS—a broader or vaguer rule would be more likely to be struck down once it inevitably becomes the subject of lawsuits.
In describing the justifications for the Proposed Rule, HHS goes to great lengths to emphasize the importance of trust within the provider-patient relationship. HHS explicitly calls out the Dobbs decision, remarking that it “created new concerns about the privacy of PHI related to reproductive health care” and has subsequently “creat[ed] barriers or disincentives for individuals to obtain health care.” By directly and publicly calling out the Supreme Court decision in this way, HHS has indicated a willingness to stand firm in protecting reproductive care. However, it is important to note that this Proposed Rule was enabled by President Biden’s Executive Order, and thus might easily be abandoned or rolled back under a different administration. Unfortunately, the Proposed Rule might therefore only temporarily alleviate patient and provider uncertainty.
This Proposed Rule represents a significant departure from the current standard under the HIPAA Privacy Rule. Under the current regulations, which remain in effect until the Proposed Rule is finalized, covered entities generally may disclose PHI to law enforcement or in furtherance of a proceeding, but are not required to do so, unless another law requires the disclosure. This Proposed Rule, in contrast, expressly prohibits such uses and disclosures. In this way, abortion-hostile states may view the Proposed Rule as an effort by the federal government to intervene in state proceedings, an argument that will likely generate legal action. On the other hand, the Proposed Rule represents creative leveraging of federal regulatory authority to protect much-needed care. Without efforts like these, reproductive health care remains threatened in all states—not just those that have enacted bans.
While this Proposed Rule is an important step towards protecting reproductive health care and alleviating provider uncertainty, its applicability is narrow. Besides protected care under EMTALA, the Proposed Rule only reaches reproductive care that is provided in states where it is already protected by state law. While the Proposed Rule ensures that providers can perform this care without risking their licenses or facing criminal charges, it does not reach much-needed services performed in hostile states. In practice, this rule is unlikely to create meaningful access to abortion care where there currently isn’t any.
This limitation is emblematic of how polarizing issues can create drastic disparities across different states, and how little the federal government can sometimes do about it. This is becoming more common in health care, as more services become political rallying points. For example, gender-affirming medical services are increasingly the subject of state-wide restrictions and bans. Beyond leveraging federal funding, which has historically resulted in lengthy litigation, the federal government is largely unable to prevent these bans from going into effect. While some sanctuary states have enacted laws that include protections for gender-affirming care records (often, alongside those for reproductive health care records) similar to those in the Proposed Rule, state-level laws are generally unable to preempt other states’ bans, creating a choice-of-law conflict that could ultimately still end in a criminal charge. The Proposed Rule, on the other hand, has the benefit of preempting any conflicting state-level provisions.
At the time of publication of this article, HHS has received over 25,000 comments on the Proposed Rule from a wide range of sources, including individuals, medical bodies, religious organizations, and state agencies. While there has been no visible movement on the Proposed Rule, on January 22, 2024, the Biden Administration provided an update on the actions of its Task Force on Reproductive Healthcare Access in which it mentioned the Proposed Rule. Ultimately, the Proposed Rule is indicative of a willingness within the federal government, at least under its current administration, to protect reproductive care, and demonstrates a creative means of doing so. While it does have a limited scope, the Proposed Rule, if finalized, could pave the way for federal protection for other needed services coming under fire. It could also serve as a model for states looking to safeguard care for as many residents and non-residents as possible.
[1] EMTALA, a federal statute, imposes obligations to provide stabilizing care on Medicare-participating hospitals with emergency rooms. For pregnant people in emergency rooms, necessary stabilizing care can sometimes mean an abortion. Soon after the Dobbs decision came down, HHS issued a statement reminding emergency providers (particularly those in abortion-hostile states) of this particular obligation. This statement has become the subject of litigation in Texas and Idaho, as it in some cases creates a direct conflict between state and federal law. The Supreme Court has granted certiorari in one of these cases, for which it will hear oral arguments in April 2024.
About the Author
Ivy Miller (she/her) is a third-year JD/MPH dual degree student at Northeastern University School of Law and Tufts University School of Medicine. Originally from Southern California, Ivy graduated from the University of California, Irvine, where her interest in health policy was sparked. After graduation, Ivy hopes to use her degrees to advocate for health equity and access.