HIPAA in a World Without Roe v. Wade
On June 24th, the U.S. Supreme Court overturned the 1973 ruling in Roe v. Wade in a 6-3 vote in Dobbs v. Jackson Women’s Health Organization sending the authority to restrict abortions back to the states. Even before the Court published the ruling, people began taking sides following Politico’s revelation of Justice Alito’s initial draft opinion on March 2nd.
Those upset by the ruling have sounded alarms prophesizing the loss of our constitutional right to privacy—a right not expressly written into the Constitution—despite not having read the opinion or understanding Roe’s position in privacy law. Others, including some legal experts, look into their crystal ball with assumed intentions of the Court reading more into J. Alito’s opinion than is in the text—in some cases even contradicting it.
Most critics of the conservative-appointed majority justify their opinion that the Court intends to strip away privacy rights, including gay marriage, interracial marriage, and contraception. They point to J. Thomas’s concurrence in which he, separate from the rest of the Court, opined the need to review the other privacy cases. Justice Thomas, however, conspicuously failed to list Loving v. Virginia—the case in which the Court held that states may not restrict marriages based solely on race—amongst the cases he considers open for review. Notably, J. Thomas’s marriage is interracial.
Many abortion advocates claim that the Court’s “attack” on privacy has rendered HIPAA’s Privacy Rule no longer effective and even unconstitutional. They assert our right to “medical privacy” is founded upon Roe v. Wade. Others question how state laws restricting abortion and requiring health care providers to report violations can coexist with HIPAA. In this article, I take you through the general development of privacy law and HIPAA’s place in it.
Our right to privacy developed through a progression of U.S. Supreme Court cases
In the 1965 decision in Griswold v. Connecticut, the Court determined that an implied right of privacy exists within the Bill of Rights that prohibits a state from preventing married couples from using contraception to prevent pregnancy. While the Constitution does not expressly grant individuals the right to privacy generally, the Court recognized that numerous amendments grant us certain specific rights that, in aggregate, imply that the right to privacy exists as a constitutional right.
For example, the First Amendment protects the right to association. The Third Amendment prohibits soldiers from quartering in a private residence without consent. The Fourth Amendment protects against unreasonable searches and seizures. The Fifth Amendment protects against self-incrimination. When considering these protections as parts of a larger whole, the makings of a general privacy framework appear.
But how can the Court extract a general right to privacy when there is none expressed in the text? To answer this question, the Court pointed to the Ninth Amendment, which provides that “the enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people.” In other words, the Court found that the Bill of Rights identified specific areas of privacy into which the government cannot intrude, and the Ninth Amendment provides for additional “zones of privacy” not enumerated in the text. Accordingly, the Griswold Court held to this reasoning in extending privacy to marriage and the decision for couples to use contraception.
The Court further expanded the right to privacy in a progression of cases. For example, Eisenstadt v. Baird prohibited states from criminalizing the distribution of contraceptives to unmarried persons. Carey v. Population Services International outlawed absolute prohibitions against distributing contraceptives to minors. Roe v. Wade expanded the right to privacy to include a woman’s choice to abort a pregnancy.
The Court also established a privacy progression for marriage. Lawrence v. Texas made laws prohibiting sexual conduct between same-sex partners unconstitutional. Loving v. Virginia prohibited states from restricting interracial marriage. Turner v. Safley recognized a conditional right of inmates to marry. Most recently, Obergefell v. Hodges expanded the right to privacy to include an individual’s right to choose whom they marry, including same-sex couples.
The Court’s Reasoning for Overturning Roe v. Wade
Justice Alito used 79 pages and another 29 pages of appendices to explain the reasoning behind the Dobbs decision that overturned Roe v. Wade. In his opinion, J. Alito explored every prominent argument for and against federal laws on abortion. This article is not a recitation of J. Alito’s argument. Instead, I focus on the privacy issue.
The Roe opinion contended that a woman’s right to abortion is integral to a broader entrenched right to privacy. Planned Parenthood of Southeastern Pa. v. Casey described this as the freedom to make “intimate and personal choices” that are “central to personal dignity and autonomy.” Justice Alito notes that neither Roe nor Casey assert that the right to privacy is absolute. Rather, “individuals are certainly free to think and to say what they wish about ‘existence,’ ‘meaning,’ the ‘universe,’ and ‘the mystery of human life,’ they are not always free to act in accordance with those thoughts.”
Justice Alito identified two meanings of a constitutional right to privacy: a person’s right to “shield information from disclosure” and a person’s right to “make and implement important personal decisions without governmental interference.” He asserted that the Roe Court conflated the two meanings while only the second meaning applies to the privacy issues of marriage and procreation. Justice Alito then distinguished Roe and Casey from the other privacy cases because Roe and Casey involve abortion and, as J. Alito highlights, abortion’s effect on what Roe termed “potential life.” Justice Alito also pointed out that almost 20 years after Roe, the Casey Court abandoned the privacy construct of Roe and reasoned solely on the grounds of the Due Process Clause of the Fourteenth Amendment (subject matter that is not the focus of this article).
Notably, J. Alito anticipated the arguments of abortion advocates and particularly the argument that this decision threatens precedents of other privacy rulings, including those on gay marriage, interracial marriage, and contraception use. J. Alito expressly rejected that argument by somewhat humorously citing Roe and Casey. The Casey Court recognized that abortion is a “unique act” because it terminates “life or potential life.” The Roe Court argued that abortion is “inherently different from marital intimacy, or bedroom possession of obscene material, or marriage, or procreation, or education.” J. Alito further clarified that the Dobbs decision “concerns the constitutional right to abortion and no other right; [n]othing in this opinion should be understood to cast doubt on precedents that do not concern abortion.”
The Dobbs decision overturned Roe and Casey solely on the proposition that there is no constitutional right to abortion. Justice Alito went to great lengths to distinguish Roe and Casey from the other privacy cases to send abortion regulation back to the states, arguably without undermining the privacy framework established by the Court. I say “arguably” because, despite J. Alito’s unambiguous assurances, abortion advocates, including many legal professionals, contend that the individual right to privacy in marriage and procreation is under threat. Such a perspective conflicts with J. Alito’s plain words and suggests in critics an ideological bias or the assumption that he lied. I am not writing to argue for or against that issue.
Where does HIPAA’s Privacy Rule fit?
While HIPAA does establish some limited rights for patients, it does not create a right to privacy—a right implied in the Constitution and developed through a progression of U.S. Supreme Court cases, as you should now understand if you have read this far. Also, note in the preceding section that J. Alito referenced two meanings of a constitutional right to privacy, the first of which is a person’s right to “shield information from disclosure.” It is this meaning of privacy, not that which he asserted applies to Roe, that the legislature intended to protect when it passed the regulations contained in HIPAA’s Privacy Rule.
HIPAA, or the Healthcare Insurance Portability and Accountability Act of 1996, regulates a variety of healthcare entities and their supporting business associates in how they use, store, and disclose protected health information. If you would like to know more about what HIPAA does for you, the patient, check this out.
Indubitably, overturning Roe and Casey does not affect HIPAA. HIPAA is in no way predicated on Roe v. Wade. However, the Dobbs decision may affect healthcare providers and their disclosures of protected health information.
How does the Dobbs decision affect Healthcare Providers?
The HIPAA Privacy Rule defines when healthcare entities and their business associates may and must disclose protected health information and whether those required or optional disclosures require patient authorization. There are two key inferences from that statement: 1) entities you entrust with your protected health information can—and in some cases must—disclose your information, and 2) many of those disclosures do not require your knowledge, let alone your permission.
There are many instances in which HIPAA statutes permit healthcare entities to disclose protected health information to law enforcement. (Note: These selections contain additional conditions not represented here.)
Under 45 C.F.R. § 164.512, a healthcare entity or its business associate may disclose protected health information to authorities to prevent injury, report deaths, report child abuse, and “oversight activities authorized by law,” including criminal investigations. Other disclosures that do not require your knowledge or permission include responses to court orders and subpoenas and for law enforcement purposes under certain conditions.
The implication is that, as states outlaw abortion to various degrees, any entity subject to HIPAA regulation that possesses protected health information may report acts related to abortion if the state law or agency requires the entity to report the act and circumstances satisfy all conditions of the applicable disclosure rule.
The greatest concerns of abortion advocates seem to be two developing issues. First, some states are pursuing mandatory reporting laws like those of child abuse or neglect. Forty-six states and the District of Columbia already require various degrees of abortion reporting. Second, some states have considered laws subjecting women to murder charges for having abortions. The Louisiana legislature considered such a law; however, the idea carried virtually no serious support amongst elected officials.
One final provision that is a bit more ambiguous permits disclosures consistent with applicable law and standards of ethical conduct if the entity believes in good faith that the disclosure is “necessary to prevent or lessen a serious and imminent threat to the health or safety of a person” or “the disclosure is to a person or persons reasonably able to prevent or lessen the threat.”
As you might guess, the language of this regulation might be contentious, as government agencies and crafty attorneys will undoubtedly subject several terms to arguments over their meanings. For example, this regulation invokes consistency with standards of ethical conduct as a condition for disclosure. Also, when does a disclosure become necessary to prevent a serious and imminent threat? Notice that the regulation requires the presence of both seriousness and imminence. When is a threat serious and imminent? Some terms are interpretable using legal tools such as plain meaning, dictionaries, canons of construction, legislative history, and public policy analysis. Nevertheless, the meaning and application of these terms will be the subject of debate.
In response to the Dobbs decision, the U.S. Department of Health & Human Services, under the direction of the Biden Administration, released guidance on the HIPAA Privacy Rule and “disclosures relating to reproductive health care.” The guidance provides summaries, interpretations of the law, and examples of how the law might apply in hypothetical fact patterns. As any reasonable person would expect, guidance issued by a federal agency in the wake of such a politically charged event as overturning Roe v. Wade has at least some degree of slant, framing, and delivery that serves the political party in charge. I believe this would be equally true if we had a Republican in the White House.
Regardless of how one might interpret the regulation and how the law might apply in various scenarios, the guidance indicates the federal government’s intentions regarding enforcement.
In summary, the Dobbs decision overturning Roe and Casey does not affect HIPAA. However, the decision does likely impact healthcare entities and their business associates subject to HIPAA regulation as they look to navigate state prohibitions of abortion and comply with state mandatory reporting laws.
Written By: Landon Tooke, MLS, CHC, CCEP, CPCO, CHCSP, CHSRAP
Twitter: @LandonNTooke
LinkedIn: Landon Tooke
