The pros and cons of privacy in a post-Dobbs era

Featured Sponsor

Store	Link	Sample Product
UK Artful Impressions	Premiere Etsy Store

Michele Gomez remembers the exact moment you noticed the problem. It was the fall of 2022. Gomez (who, like me, is a family physician and abortion provider in California) had recently performed a virtual medical abortion on a patient in Texas. The patient had flown to her mother’s house in California, where she had her appointment, she took her medications by mail and carried the pregnancy. Back in Texas, he became concerned about continued bleeding and went to the emergency room. The bleeding was self-limited; did not require significant medical interventions. Gomez found out about all this the next morning. “I sat down at my computer and saw your note from the ER. And I thought, ‘Oh God, if I can see his note, then they should be able to see my note”—a note that included prescriptions and instructions for medical abortion. For weeks, she waited for a call, fearing that the Texas police would come after her, or worse, come after her patient.

A vast system of digital networks, called the Health Information Exchange, or HIE, links patient data across thousands of health care providers across the country. With the click of a mouse, any physician can access a patient’s records from any other hospital or clinic where that patient received care, as long as both offices are connected to the same HIE. In a country without a national health system and hundreds of different electronic medical record (EMR) platforms, the HIE undoubtedly promotes efficient, coordinated, and high-quality medical care. But such interconnectivity comes with a major trade-off: privacy.

Patient privacy has always been a paramount value in abortion care, and the stakes have only increased after the Dobbs decision. I am among many concerned abortion providers calling for swift action from EMR companies, who have the power to create technical solutions to protect our patients’ digital health information. If these companies are not willing to build such protections, then the law should compel them to do so.

Although it is not enunciated in the Constitution, the Supreme Court has historically interpreted various amendments to imply a “right to privacy,” most famously in the case of Roe vs. Wade. By grounding the Roe decision in the due process clause of the 14th amendment, the Supreme Court effectively wrapped a right to privacy around the female body and its capacity for pregnancy.

During the next 50 years Roe, the internet arrived, then the electronic medical record and the HIE. Along with this increasing connectivity and portability, the federal government enacted a number of laws to protect health information, including the Privacy Act of 1974 and parts of the Health Information Portability and Accountability Act (HIPAA) of 1996. But HIPAA is No mainly a privacy law; its primary purpose is to facilitate the transfer of health records for billing and medical purposes. Many patients don’t realize that under HIPAA, doctors can (but are not always required to) share health information with other entities, including insurance companies, health authorities, and law enforcement.

HIPAA includes some privacy provisions to protect “sensitive” information. Certain substance use treatment records, for example, are viewable only to designated providers. Law enforcement are prohibited from accessing those records without a court order or written consent. Access to abortion records can be similarly restricted, but with a technical catch: These restrictions apply only to certain data, called “visit-specific” information, such as the text of the doctor’s note. Other data, called “patient-level” information, including ultrasound images, consent forms, and medications, remains detectable. If, for example, a patient travels to California and is prescribed mifepristone and misoprostol, the standard regimen for medical abortion, those medications will appear on her record in her home state. Any reasonable person can guess what happened on that visit, even without reading the note.