Pressure is growing on President Joe Biden to safeguard abortion patients’ data, as concerns rise that prosecutors could deploy the information as evidence in states that have banned the procedure.
Biden administration officials, led by Health and Human Services Secretary Xavier Becerra, have taken some steps to reassure people and said they are exploring all options, while also trying to dampen expectations. And on Friday, Biden announced an executive order that promised to bolster privacy protections, but it was thin on new details.
Some Democratic lawmakers, joined by privacy- and abortion-rights activists — have urged the administration to do more to encourage Congress to pass privacy laws tightening control over personal data that patients share online at myriad websites and apps and to push the regulatory envelope.
“The best time to have taken forceful action to protect data would have been the day Dobbs leaked. The second best time is now,” said Matthew Cortland, a senior fellow at Data For Progress, mentioning the name of the Supreme Court decision last month ending the constitutional right to an abortion. “It is an ongoing urgent life and death issue for millions of Americans. And, frankly, the administration cannot afford to wait any longer.”
The growing concern comes amid broader frustration from a range of important Democratic constituencies including young voters, professional activists and many of the party’s lawmakers. They are dismayed at what they describe as an inadequate response from the White House to the court’s decision — both in tone and substance.
When it comes to data privacy, the focus is on HIPAA, the 1996 law governing the privacy of personal health information, and on how the Biden administration might strengthen its regulatory response by using the broad powers of the Federal Trade Commission to crack down on “unfair and deceptive” practices by online data-tracking firms.
With Congress gridlocked on privacy rights, “the Biden administration should do as much as it can on health privacy right now, like ensuring that HIPAA is enforced as much as possible and issuing stronger guidance,” said Justin Sherman, a senior fellow at Duke University’s Sanford School of Public Policy.
Instead of projecting powerlessness — Becerra last week said there was “no magic bullet” to restore abortion rights — the Biden administration could be more vocal about the importance of strong privacy laws, said Sherman.
Sherman isn’t alone. Activists and advocates with groups like the Electronic Privacy Information Center, Surveillance Technology Oversight Project and the American College of Obstetricians and Gynecologists are weighing in. Democrats in Congress have proposed legislation that, while facing significant obstacles to enactment, increases pressure on Biden.
Progressive Sens. Elizabeth Warren (D-Mass.), Bernie Sanders (I-Vt.) and Ron Wyden (D-Ore.) have introduced Senate legislation banning companies from selling health and location data. Rep. Sara Jacobs (D-Calif.) has a House bill that would limit the non-HIPAA-covered health data that companies could gather, and grant the FTC new enforcement responsibilities.
Wyden has called the possibility of prosecutors gaining access to information on people’s abortions a “five-alarm crisis” and “uterus surveillance.”
HIPAA ‘wiggle room’
No state has yet enacted a law threatening people who receive early term abortions with criminal prosecution. But trigger laws in some states banning abortion are vague and legal experts told POLITICO cases are possible. The laws now on the books do target abortion clinics.
The data prosecutors might use fall into two categories: health care information covered by HIPAA and information collected by websites and apps.
The administration issued guidance last month covering the protections for both data sets. It said HIPAA-covered data is protected from routine disclosure, but not necessarily from a court order.
Facing such an order, an abortion clinic would be allowed, but not required, to disclose the information. But the guidance didn’t offer total peace of mind for providers or people getting abortions.
“It clearly clarified, explained and identified how the rules work. That’s not a perfect solution,” added Kirk Nahra, a privacy lawyer at law firm WilmerHale. “There’s still some wiggle room in the rules.”
A section of the HIPAA rules allow providers to disclose protected health information without an individual’s consent if it is evidence of a crime on the provider’s property. That provision is meant to cover situations where, for example, a patient assaults a nurse, Nahra said, but could be applied to abortions.
Changing this would require the administration to go through a lengthy rulemaking process. On Friday, the White House said HHS would look into further actions on HIPAA but didn’t delve into details. Biden also said the Justice Department would recruit lawyers to help patients and providers on a pro bono basis.
Privacy advocates are pressing Biden to help keep patients and providers out of court. Eleni Manis, research director of the Surveillance Technology Oversight Project, said the administration should bar abortion providers from sharing health information about their patients.
“Their proper role is as caregivers, to protect the sanctity of the doctor-patient relationship, not as prosecutors,” Manis said.
Besides introducing legislation, Democrats in Congress are lobbying the administration directly. Sen. Michael Bennet of Colorado and Nevada’s Catherine Cortez Masto wrote to Becerra last week urging him to update HIPAA rules to prevent clinics from sharing health information with law enforcement pursuing abortion cases.
The issue couldn’t be more urgent,” Masto said in a statement to POLITICO. “I’m looking at every option to implement stronger protections for patient privacy.”
Online data sharing
Other data that might be relevant to a prosecution, such as web searches, location history and correspondence with abortion providers, is more vulnerable, the HHS guidance acknowledged. The administration suggested people who are considering an abortion turn off information sharing with websites and apps as a stopgap solution.
“Ultimately, the best way to protect your health and personal information from being collected and shared by your personal cell phone or tablet without your knowledge is to limit what personal information you send and store on or through the device,” the guidance said.
Privacy advocates were unhappy, noting it put the onus on individuals instead of taking aim at tech companies and lawmakers for inaction.
Even as the administration has urged Congress to take action, its messaging hasn’t included a push for data privacy legislation that might sway Democrats reluctant to embrace a compromise bill.
“Comprehensive privacy legislation is good for a whole host of reasons, one of which is that it provides protection for people seeking reproductive health services,” said John Davisson, senior counsel at the Electronic Privacy Information Center. “That needs to be part of the response to the privacy threats faced in the post-Roe world.”
Particularly without encouragement from Biden, Congress is unlikely to do anything soon. A House Energy and Commerce subcommittee approved bipartisan legislation that would limit the data that internet companies and data brokers can collect and store and require firms to obtain customers’ consent to share their health information last month, but the bill faces high hurdles because some Democrats say it doesn’t go far enough.
The administration said Friday that Biden asked the Federal Trade Commission to take steps to protect patient privacy. A person familiar with the White House’s plans who was granted anonymity to disclose them to POLITICO said that Biden wants the agency to crack down on websites and apps that are engaging in “unfair or deceptive practices related to reporting, surveillance, sharing or sale of personal information, including sensitive health-related information.”
Becerra said the administration is considering its options: “If there is something we can do, we will find it and we will do it.”
But the FTC has limited resources, which could blunt its impact.
“Regulation is not just about having a law on the books, but also having people who can enforce the law,” Sherman said. “In the FTC’s case, we need a lot more funding to people working on privacy over there.”
Whatever the regulatory and legislative obstacles, abortion-rights advocates say they’d like to see Biden at least use his bully pulpit more forcefully to push those who possess patient data to change their collection practices.
Biden discussed his concern about data brokers selling information that could be used by law enforcement in a speech Friday but didn’t go after tech companies or ask Congress to take action.
“The press assembled before me probably know more about it than I do,” Biden said. “I’m not a tech guy. I’m learning.”
Others have more concrete ideas. Writing for STAT First Opinion, Eric Perakslis of the Duke Clinical Research Institute said hospitals should stop sharing data for commercial research purposes so long as that might enable prosecutors to get ahold of it.
And Google this month said it would erase location data on visits to abortion clinics, evidence perhaps that such a strategy could prompt voluntary changes to data collection practices.
“The only responsible thing to do is to emphasize that the solution is not in the hands of pregnant people,” said Manis.
Recent Comments