{"id":5413,"date":"2023-05-12T23:27:49","date_gmt":"2023-05-13T04:27:49","guid":{"rendered":"https:\/\/blogs.luc.edu\/compliance\/?p=5413"},"modified":"2023-05-12T23:27:49","modified_gmt":"2023-05-13T04:27:49","slug":"reproductive-health-data-privacy-a-right-to-life","status":"publish","type":"post","link":"https:\/\/blogs.luc.edu\/compliance\/?p=5413","title":{"rendered":"Reproductive Health Data Privacy \u2013 A Right To Life"},"content":{"rendered":"

Marisa Polowitz<\/em><\/p>\n

Senior Editor<\/em><\/p>\n

Loyola University Chicago School of Law, JD 2023<\/em><\/p>\n

Following the Supreme Court decision to overturning Roe v. Wade<\/em> on June 24, 2022, the Dobbs v. Jackson Women\u2019s Health Organization<\/em><\/a> ruling that gutted the long-established right to an abortion has been a constant focus, both inside and outside of the legal and healthcare communities. Notably, the ruling has remained a central focus within both the government, federal and state, and surrounding the tech sector. And these Dobbs<\/em>-related conversations have a theme \u2013 the topic of health data privacy. But more specifically, discussions about data privacy surrounding reproductive<\/em> healthcare.<\/p>\n

<\/p>\n

The vocal groundswell of concern about reproductive health data following the Dobbs<\/em> ruling was immense, and (given the lead time granted by the ruling\u2019s leak<\/a>), instantaneous. Fear surrounding the privacy<\/a> and security of information relating to reproductive health and services exploded<\/a>. But this concern isn\u2019t new<\/a>. People have been speaking out about this<\/a> since long before the Dobbs<\/em> opinion blasted American women\u2019s right to bodily autonomy to pieces.<\/p>\n

The HIPAA trap<\/strong><\/p>\n

For a long time, Americans would point to the Health Insurance Portability and Accountability Act<\/a> (HIPAA) as evidence they could rest peacefully about how data related to their healthcare could be handled. But privacy has become an increasingly salient and nuanced issue, and a more insidious concern, in the (nearly 30) years since HIPAA was passed. While protecting a fairly broad range<\/a> of information types, HIPAA only applies to a narrow set of organizations<\/a>, in a narrow set of contexts, partaking in specific, healthcare-related business practices \u2013 that is how it was written and what it was designed to do.<\/p>\n

In response to the Dobbs<\/em> ruling, the Biden Administration issued an Executive Order<\/a> mandating action for multiple agencies within the federal government for the protection of \u201cAccess to Reproductive Healthcare Services.\u201d Including for the Secretary of Health and Human Services (HHS) to \u201cconsider actions to strengthen the protection of sensitive information related to reproductive healthcare services.\u201d In April 2023, HHS announced proposed changes<\/a> to the HIPAA Privacy Rule aimed at strengthening protection for reproductive care information, specifically citing<\/a> its concern of individuals\u2019 \u201ceroding trust in the health care system\u201d following the Supreme Court\u2019s decision in Dobbs<\/em>.<\/p>\n

These proposed changes would restrict HIPAA Covered Entities\u2019 (CEs) use and disclosure of some reproductive health care information. CEs would be prohibited from use or disclosure of protected health information (PHI) for criminal, civil, or administrative investigation into or proceedings against<\/a> someone relating to \u201cseeking, obtaining, providing, or facilitating\u201d legal reproductive health care.<\/p>\n

The HHS proposed changes to the HIPAA Privacy Rule will undoubtedly provide some shelter for those concerned about privacy when seeking reproductive services while residing in jurisdictions hostile to reproductive rights. That shelter is necessary<\/a>. Following the ruling, many states where abortion is a protected right are experiencing a huge increase in numbers<\/a> of people traveling to their states seeking abortions \u2013 after all, the interstate commerce clause still allows for Americans to travel freely across state lines for access to goods and services. Justice Brett Kavanaugh, author of a concurring opinion in the Dobbs ruling, explicitly stated that, in his opinion, a state attempting to bar a resident of that state from traveling outside the state for an abortion would be in violation of the constitutional right to interstate travel<\/a>. But that doesn\u2019t mean that states wouldn\u2019t attempt to prosecute individuals for receiving services outlawed within their state, elsewhere. Nor does it mean that states won\u2019t try to prosecute people providing those services<\/a> to their state\u2019s residents, even while in a jurisdiction where it\u2019s legal.<\/p>\n

In attempt to prevent situations exactly like those mentioned above, California, which aims to be an abortion \u201csanctuary state<\/a>,\u201d passed legislation prohibiting California-based companies<\/a> from disclosing data for out of state abortion investigations. But for that to work, the company would need to clearly know what the investigation pertains to, and in some situations, what the information itself pertains to \u2013 which isn\u2019t always clear<\/a>.<\/p>\n

With the incredibly robust addition of the recently enacted<\/a> Washington privacy legislation \u2013 the My Health My Data Act \u2013 another patch has been added to the already over-patchworked state privacy landscape. The Act, which goes further than any existing consumer privacy laws in broadening the scope of \u201chealth data,\u201d specifically aims to protect health-related data HIPAA fails to cover.<\/p>\n

But at the end of the day, HIPAA will continue to apply to a narrow set of organizations, partaking in specific, healthcare-related business practices. And as we know, the American (and global) data privacy landscape<\/a> looks starkly different, and notably more complex, than what anyone could have projected in 1996. What\u2019s protected by HIPAA only scratches the surface of sensitive information, especially pertaining to our health and health care that is worthy of protection.<\/p>\n

You\u2019re on your own, folks<\/strong><\/p>\n

The Federal Trade Commission (FTC), also given marching orders in Biden\u2019s July 2022, post-Dobbs Executive Order<\/a>, launched a guide for how consumers can protect<\/a> their personal data on their mobile devices. Another way to put the onus on individuals to protect themselves in a technological landscape the average person can barely comprehend<\/a>.<\/p>\n

Sure, it\u2019s great that companies like Foursquare<\/a> have made the choice to participate in initiatives designed to enhance protections around location data correlating to \u201cSensitive Points of Interest\u201d. This is, undoubtedly, a huge step in the right direction for consumer privacy, and it should be celebrated. But this is just one company\u2019s huge step. And while some companies may have consumer protection and privacy genuinely woven into their DNA, a lot do not<\/a>. In large part, the ethos seems to lean towards profits over privacy<\/a>. Do we want to keep letting them decide what of our information is worthy of protection<\/a> and what is not?<\/p>\n

It’s a right to life<\/strong><\/p>\n

In a post-Dobbs<\/em> landscape where we lack meaningful, comprehensive, federal consumer privacy legislation, the protection of highly sensitive<\/a>, non-HIPAA-covered information, data which is still very much health information<\/a>, falls on the shoulders of individuals<\/a>, on individual companies<\/a>, and to state governments. And the burden it places on those most in need of protection and care is heavy, and for many, unachievable.<\/p>\n

 <\/p>\n

Maybe the confluence of too many, too varied, too disjointed pieces of the privacy puzzle will finally push lawmakers<\/a> to protect our data like the inalienable right to life, liberty, and the pursuit of happiness depend on it<\/a> \u2013 because it does.<\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Following the Supreme Court decision to overturning Roe v. Wade on June 24, 2022, the Dobbs v. Jackson Women\u2019s Health Organization ruling that gutted the long-established right to an abortion has been a constant focus, both inside and outside of the legal and healthcare communities. Notably, the ruling has remained a central focus within both the government, federal and state, and surrounding the tech sector. And these Dobbs-related conversations have a theme \u2013 the topic of health data privacy. But more specifically, discussions about data privacy surrounding reproductive healthcare.<\/p>\n","protected":false},"author":90,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[405,575,1032,1622,1623,1690],"class_list":["post-5413","post","type-post","status-publish","format-standard","hentry","category-hipaa-health-information","tag-civil-rights","tag-data-security","tag-hipaa-2","tag-privacy","tag-cybersecurity","tag-regulation"],"_links":{"self":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/5413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/users\/90"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5413"}],"version-history":[{"count":0,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/5413\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}