HIPAA faces test in new abortion reality

• The landmark federal privacy law restricts how health providers share medical information, but it doesn't prevent them from sharing it with law enforcement.

Catch up quick: In Texas, anti-abortion lawyers have started filing pre-lawsuit petitions to depose abortion providers in order to gain information about abortions, the Texas Tribune reported.

• Providers in such circumstances may need the advice of attorneys before handling requests for reproductive health information.
• "We are in such uncharted territory when it comes to this type of issue that providers really don't have guidance," said Samantha Deans, associate medical director for Planned Parenthood of South, East and North Florida.

President Biden recently directed the Department of Health and Human Services to consider actions "to strengthen the protection of sensitive information related to reproductive health care services and bolster patient-provider confidentiality."

• Advocates are calling on Biden to go further and tighten federal laws that govern how a patient's information is disclosed.
• "We continue to evaluate high-impact options to help people," an HHS spokesperson said.
• The administration needs to do whatever is necessary to keep the patient at the very center of the care," said Jill Gibson, medical director of Planned Parenthood Arizona.

Go deeper: In general, providers need a patient's authorization to disclose health information. However, there are some exceptions.

• If a request for a patient's information is "accompanied by a court order or a grand jury subpoena, then HIPAA permits a covered entity to disclose ... the minimum necessary amount of information to respond to that request," said Scott Weinstein, a partner at the law firm McDermott Will & Emery who specializes in health privacy and security.
• The law does not mandate providers to hand over a patient's records, and they can still refuse to do so.

State of play: It is "critical" that health providers educate themselves and their staffs on how to handle information requests, because there's the possibility that some violate HIPAA regulations, said Dianne Bourque, a senior attorney at Mintz specializing in health care law.

• HIPAA record requests are usually done in writing using forms that specify what information is being sought. If a request is made informally over the phone or in person and without a form, the decision should be handed off to "someone who can asses its validity," Bourque said.

• Patients have the right to know how many times their information has been disclosed.

Worth noting: Prosecutors and law enforcement still have other avenues if they're rebuffed by providers.

• HIPAA, which was enacted in 1996, didn't anticipate the advent of technology like period-tracking apps.
• "You could get enough information to see that somebody's ... period is late. That might make you wonder if they're pregnant, and then if it resumes, you wonder why, did they get an abortion?" said Lisa Ikemoto, professor at the University of California, Davis School of Law.
• It would likely take some sort of congressional action to protect a person's digital footprint and for tech industries to be subject to the law's privacy protections.

The intrigue: Federal law preempts state law. However, HIPAA is written so that it does not impede state public health activities.

• That brings into question how preemptive the law really is and what regulatory changes HHS can make to the law. Such questions are "uncharted waters," said Christopher Hart, an attorney with Foley Hoag LLP and member of the firm's reproductive health care team.
• Any Biden administration moves to tighten HIPAA via rulemaking and make it more difficult for states to access information could face legal challenges.