State Reproductive Health Laws and Patient Privacy

The Biden Administration and the US Department of Health and Human Services (HHS) are assessing what steps they can take to address several issues related to abortion after the Supreme Court’s decision in Dobbs v Jackson Women’s Health Organization. One area of concern is patient privacy.

While HHS continues to evaluate options for protecting patient privacy in reproductive health care services records, several states have considered—and three have passed—legislation directly affecting the disclosure of these records.

This summer, the following 3 states enacted reproductive health privacy laws: Connecticut (HB5414), Delaware (HB455) and New Jersey (AB3975). While these laws have some differences, general themes are consistent. Generally, these laws aim to protect reproductive health care services information, typically defined as, “all medical, surgical, counseling, or referral services relating to the human reproductive system including, but not limited to, services relating to pregnancy, contraception, or termination of a pregnancy.” This definition is consistent with the Biden Administration Executive Order 14076 definition post Dobbs.

Interestingly, the definition goes much further than protecting records related to an abortion. These laws are written without mention of the patient’s sex, and since these laws cover “the human reproductive system,” they could quite possibly cover something like a consultation for a vasectomy.

Pursuant to the state laws, the means for protecting this information requires providers to obtain express written consent to disclose from a patient, patient’s conservator or guardian, or other legally authorized representative, with limited exceptions. Many providers in these states are considering addressing the patient consent issue by adding a section to their HIPAA authorization form where a patient may expressly consent to disclose reproductive health care services-related records. This approach is like the approach taken for disclosure of other highly sensitive information such as mental health records, substance use and abuse treatment records, and HIV/AIDS test results and treatment records.

With respect to disclosures that do not require patient consent, the list of general exceptions includes disclosures:

1. pursuant to the laws of the State or the Rules of Court;
2. by a covered entity to its attorney or professional liability insurer or insurer's agent for use in the defense of the action, claim, or proceeding;
3. to the state agency, or any professional licensing board for records of a patient or a covered entity in connection with an investigation of a complaint, if the records are related to the complaint; or
4. if child abuse, abuse of an elderly individual, abuse of an individual who is incapacitated, or abuse of an individual with a physical or mental disability is known or in good faith suspected.

With the exception of Delaware, these laws also generally provide that nothing in the law shall be construed to impede the lawful sharing of medical records as permitted by state or federal law or the Rules of Court.

In addition to disclosure obligations, providers are required to inform a patient, patient’s conservator or guardian, or other legally authorized representative of their right to withhold such written consent at or before the time reproductive health care services are rendered, or at such time as the patient discloses any information relating to reproductive health care services that have been previously rendered. Some providers are considering amending their notice of privacy practices to include a statement to satisfy this requirement. At this point, it is difficult to determine if this is an adequate approach. While amending forms already in use is a good first step, providers should consider implementing additional measures to comply with these laws.

Consider this hypothetical: a female patient enters the emergency room via ambulance after a vehicle accident. Upon examination, she complains of abdominal pain. The emergency room doctor asks when the patient experienced her last menstrual cycle and notes the file.

This rather innocuous question and response about the patient’s menstrual cycle is arguably “medical…services relating to the human reproductive system” and likely should not be disclosed in the subsequent personal injury action without the patient’s express consent to disclose. The question for the provider is, should this doctor’s question and patient’s response be redacted, should the entire record not be disclosed, or should the provider require express consent to disclose the record? These are all process and procedure questions providers must answer for themselves.

Consider a second scenario: a female patient is experiencing unexplained aura migraines and consults with her obstetrician/gynecologist regarding birth control pills to regulate hormones and hopefully alleviate the headaches. This scenario arguably falls under “all medical, and counseling, relating to the human reproductive system including, but not limited to, services relating to… contraception” and should not be disclosed without the patient’s express consent.  

With all the uncertainty after Dobbs, 1 thing is certain. Some states will take the steps they believe necessary to protect reproductive health records from disclosure without the patient’s express consent. Providers should consult with their legal, compliance, health information management and information technology teams to determine how best to comply with these laws and protect patient privacy.