By Katie Gu
Within the post-Dobbs struggle to safeguard reproductive healthcare, a brand new highlight has been positioned on two current federal legal guidelines: the Well being Insurance coverage Portability and Accountability Act (HIPAA) and the Emergency Medical Remedy and Energetic Labor Act (EMTALA).
Steerage paperwork issued over the summer time by federal businesses emphasize how these legal guidelines can be utilized to guard reproductive well being privateness and entry.
The New Context
Within the wake of Dobbs, states have now handed legal guidelines that add new reporting necessities for abortions.
Physicians in Arizona are actually required to file a report with the state’s Division of Well being Companies documenting the particular indications supporting the medical emergency dedication that an abortion was wanted, in addition to the abortion’s possible well being penalties. Below Kentucky’s Home Invoice 3, sufferers searching for medication- or surgical-abortion care are required to file “birth-death certificates” for abortions carried out after 20 weeks of being pregnant. In Oklahoma, abortion suppliers are actually required to submit written affirmation that abortion-related rape or incest was reported to the police earlier than abortion procedures will be carried out.
These reporting necessities have been enacted alongside a normal rise in state legal guidelines criminalizing abortions (not less than 13 states at present ban most abortion procedures). On this new context, readability surrounding current authorized protections is urgently wanted.
Protections are wanted not just for sufferers searching for abortions, but additionally for practitioners offering abortion procedures. The three guidances printed this summer time have shed various levels of readability on current authorized protections located throughout the new post-Dobbs context.
The Outdated Legal guidelines
Handed in 1996, HIPAA created nationwide requirements to guard the privateness of delicate affected person well being data, together with medical information and different individually identifiable well being data (thought of “protected well being data,” or PHI). The legislation applies to well being care suppliers, well being plans, and well being care clearinghouses (thought of “lined entities”) that transmit PHI electronically. Importantly, HIPAA establishes limitations on the use and disclosure of PHI made with out affected person authorization or consent.
Handed in 1986, EMTALA requires hospitals accepting Medicaid or Medicare funds from HHS or CMS to supply abortion care mandatory to deal with emergency medical circumstances. As a result of most hospitals depend on Medicaid and Medicare funds, the legislation at present applies to almost all hospitals within the U.S. EMTALA additional establishes civil financial penalties and potential termination of Medicare-participation agreements in instances of violation. The legislation is enforced by CMS’ regional workplaces and HHS’ Workplace of Inspector Common.
The Guidances
In June 2022, the U.S. Division of Well being & Human Companies’ (HHS) Workplace for Civil Rights (OCR) issued two guidances reaffirming privateness protections assured by HIPAA. The next month, in July 2022, the Facilities for Medicare & Medicaid (CMS) issued a steering reiterating federal obligations positioned on hospitals and well being care suppliers by EMTALA.
OCR HIPAA Privateness Rule Steerage
OCR’s June 2022 “HIPAA Privateness Rule and Disclosures of Info Regarding Reproductive Well being Care” steering provides the bottom diploma of authorized protections throughout the post-Dobbs panorama of restrictive new state legal guidelines.
The steering clarifies three conditions by which the HIPAA Privateness Rule permits lined entities to reveal PHI with out affected person authorization: 1) disclosures required by legislation (below 45 CFR § 164.512(a)); 2) disclosures for legislation enforcement functions (below 45 CFR § 164.512(f)); and three) disclosures to avert a critical risk to well being or security (below 45 CFR § 164.512(j)). OCR emphasizes that even below these three circumstances, disclosures are solely permitted, not required, by HIPAA.
Finally, the steering does little to guard sufferers or suppliers in states which have handed legal guidelines explicitly requiring the reporting of reproductive well being information associated to abortions. Whereas HIPAA is drafted with a powerful preemption provision, the Privateness Rule has been interpreted to grant a big diploma of deference to state legal guidelines. In observe, hospitals are additionally much less seemingly to concentrate to the distinction between permitted and required disclosures when confronted with a court-issued order, warrant, or subpoena, and extra prone to lean in favor of disclosure to scale back their very own legal responsibility dangers.
OCR HIPAA Private Machine Steerage
OCR’s second June 2022 steering, “Defending the Privateness and Safety of Your Well being Info When Utilizing Your Private Cell Telephone or Pill,” offers extra concrete privateness recommendation for people with reproductive well being information saved on cellular units.
As a result of HIPAA doesn’t apply to expertise firms, the steering emphasizes that information saved on cellular purposes or private units (e.g., telephones, tablets, laptops) wouldn’t be protected towards disclosure. This information can embody not solely reproductive well being information, but additionally data associated to Web search histories and geographic places.
The steering helps increase vital shopper consciousness by suggesting key steps people can take to guard their very own information privateness. Additional, the steering can also assist encourage expertise firms to revise their information monitoring, administration, and retention insurance policies.
CMS EMTALA Steerage
Lastly, CMS’ July 2022 “Reinforcement of EMTALA Obligations Particular to Sufferers who’re Pregnant or are Experiencing Being pregnant Loss” steering reminds hospitals of their current obligations below EMTALA. Particularly, CMS clarifies that EMTALA preempts state legal guidelines prohibiting abortion with out an exception for the life and well being of the pregnant particular person. Additional, the steering specifies that state actions towards a doctor performing a stabilizing abortion below an emergency medical situation additionally could be preempted by EMTALA.
Nonetheless, only one month after the steering was printed, two instances reached reverse conclusions concerning the query of whether or not EMTALA can preempt state legislation.
In United States v. Idaho, a federal decide struck down Idaho’s strict abortion ban, which criminalized abortions offered in emergency medical contexts, as a violation of EMTALA. In different phrases, EMTALA was decided to preempt Idaho’s state legislation. In distinction, the federal decide in Texas v. Becerra prevented the enforcement of CMS’ EMTALA Steerage in Texas. The decide decided that there’s at present no direct battle between EMTALA and Texas legislation, and struck down the CMS EMTALA Steerage as unauthorized.
What’s Subsequent?
Regardless of HHS’ efforts to seek out new purposes of previous federal legal guidelines within the post-Dobbs struggle for reproductive justice, clear gaps stay.
Slightly than counting on previous legal guidelines, lawmakers even have launched new payments that present stronger protections for reproductive well being privateness and entry.
The My Physique, My Knowledge Act is a proposed federal invoice that may lengthen privateness protections to information collected by cellular purposes, cell telephones, and serps (entities not at present lined by HIPAA). Additional, the Act directs the Federal Commerce Fee (FTC) to implement these protections and would create a personal proper of motion for people to carry regulated entities accountable for privateness violations. One other federal invoice launched by Sen. Elizabeth Warren (D-MA), the “Well being and Location Knowledge Safety Act,” would ban the sale of delicate well being and placement information by third-party information brokers. The Act would equally depend on the FTC for its enforcement.
Whereas the three HHS guidances mentioned present necessary clarification for current federal legal guidelines, in addition they illuminate these legal guidelines’ shortcomings within the post-Dobbs context. New federal payments are wanted to deal with the privateness gaps left by HIPAA and the challenges in reproductive well being care entry, even below EMTALA. These payments may additionally present guiding frameworks for brand spanking new state legal guidelines, which can broaden the scope of reproductive justice protections shifting ahead.
Because of Joelle Boxer and Rachel Landauer for his or her beneficial discussions.
