Recent Executive Order Does Not Improve Health Privacy

On June 24, 2022, the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, Dobbs v. Jackson Women's Health Org., 142 S. Ct. 2228 (2022), overturned Roe v. Wade. On July 8, 2022, President Biden issued an Executive Order titled, “Protecting Access to Reproductive Health Care Services.” However, the order does not impose additional privacy measures despite the suggestive title. Individuals concerned about the release of reproductive health information only need to refuse to authorize a release of such records when asked to execute medical records releases with their providers.

The Executive Order is bifurcated. The first part states that, within thirty (30) days, the Secretary of Health and Human Services (DHHS) shall submit a report to the President identifying how to meet two goals: 1) Protect and expand access to abortion care, including medication abortion; and 2) Protect and expand access to the full range of reproductive healthcare services. The DHHS report must also include information that identifies ways to increase outreach and education about access to reproductive healthcare services and identifies steps to ensure that all patients — including pregnant women and those experiencing pregnancy loss, such as miscarriages and ectopic pregnancies — receive the full protections for emergency medical care afforded under the law.

The second part of the Executive Order states that the Attorney General and the Secretary of Homeland Security (DHS) shall consider actions to ensure the safety of patients, providers, and third parties, and to protect the security of clinics (including mobile clinics), health care records, pharmacies, and other entities providing, dispensing, or delivering reproductive and related healthcare services. DHHS was also tasked with providing guidance under the Health Insurance Portability and Accountability Act (HIPAA) to support the Executive Order’s goals. Thus, the Executive Order lacks any immediate changes or prescribes pathways towards change, which is perplexing given privacy precedents on other highly sensitive healthcare issues.

In 1972, The Confidentiality of Alcohol and Drug Abuse Patient Records Regulation 42 C.F.R. § 2.1 was issued by the Secretary of Health and Human Services, which imposes protections on the medical records of those patients receiving substance abuse treatment or mental health care, in addition to existing HIPAA privacy and security protections. Under HIPAA, a patient may execute a generic patient authorization form, allowing a medical provider to release his/her/their medical records to the party identified on the authorization form. However, if those same records include drug, alcohol, or mental health care treatments, a general authorization is insufficient to release those records to anyone aside from the actual patient. Instead, the Confidentiality of Alcohol and Drug Abuse Patient Records Regulation requires a separate, specific authorization that authorizes the release of such records. The Patient executing the release must specifically and unequivocally indicate his/her/their desire to allow the receiving party access to drug, alcohol, and mental health care information.

Although extremely different in nature, granting reproductive healthcare records the same additional privacy protections as mental health care, or substance abuse records, is an easy manner by which to address any post-Dobbs decision privacy concerns. And, unless or until such amendments are made, patients always retain the right to exclude reproductive healthcare information when asked to execute a HIPAA authorization or release. Whether a patient, state, or federal legislator, there is no need to wait on DHHS to answer the call from President Biden’s executive order regarding additional HIPAA protections.