An executive order signed by President Biden places the weight of the White House firmly behind states where access to abortion is guaranteed, urging the FTC and other executive bodies to review and strengthen data protection policies. Without a digital trail to follow, attempts to criminalize private medical activity across borders may prove much more difficult.
The coming legal battles over reproductive rights in the post-Roe era are likely to be complex and unprecedented, and data will be an important part of them. As a medical procedure, abortion is covered by federal HIPAA patient privacy law, but this will likely conflict with state rules requiring disclosure. Additionally, digital services like period-tracking apps and even fitness and wellness platforms can track and even sell data that could be incriminating.
The executive order fundamentally limits what he can accomplish (as many will recall, Trump has issued dozens of them to little effect), but it outlines what federal resources will be deployed and where they will be deployed in future legal disputes. The full text of the EO is here, but let’s take a look at the parts most immediately relevant to the tech industry. (The quoted text is very slightly edited for brevity.)
First, the Secretary of Health and Human Services will release a report…
… identify ways to increase awareness and education on access to reproductive health services, including launching a public awareness initiative to provide timely and accurate information on such access, which should …
share information on how to obtain free or reduced-cost reproductive health services through Health Resources and Services Administration-funded health centers, Title X clinics, and other providers; and…
include promoting awareness and access to the full range of contraceptive services, as well as information about knowing your rights for those seeking or providing reproductive health services
This clearly targets attempts to limit the information available to people seeking care; some states plan to make it difficult to know what options are actually available, if it’s legal to travel to another state for a procedure or medication (it is), etc. While the federal government cannot force, for example, a public health agency to provide information on where to obtain abortion pills or the like, it can ensure that this information is available in the state by other ways. They can even get a foot in the door with hospitals and clinics that receive federal funding.
While this may seem elementary (of course the federal government can put whatever it wants on its own sites), the real purpose here is to list the ways in which states will attempt to control information and the best way to counter them.
Then, federal entities, including the Attorney General and Homeland Security, will “consider actions” to address emerging safety and security risks associated with providing or seeking reproductive care.
To address the potential threat to patient privacy caused by the transfer and sale of sensitive health-related data and by digital surveillance related to reproductive health services, and to protect individuals seeking reproductive health services against fraudulent schemes or deceptive practices:
The Chairman of the Federal Trade Commission (FTC) is encouraged to consider actions…to protect the privacy of consumers when seeking and providing information about reproductive health services.
The Secretary of Health and Human Services shall consider actions, including providing advice under [HIPAA]and any other laws, as appropriate, to enhance the protection of sensitive information related to reproductive health services and enhance patient-provider confidentiality.
The first part of this is clearly a warning to big tech companies like Google and Meta, who have the means and ability to track people’s behavior at a worrying level of granularity. We’ve all read horror stories of people seeing ads for baby products before announcing they’re pregnant. Now imagine if a state required a company to disclose whether a user had discussed or was algorithmically classified as seeking an abortion.
Protecting people from “fraudulent schemes” seems less of an issue than the day-to-day trading of potentially sensitive information to data brokers. The FTC may very well issue guidance on this issue regarding “privacy” claims that are not supported by a company’s actual practices.
The HIPAA portion is difficult, as there will almost certainly be a direct conflict between federal non-disclosure laws and state forced disclosure laws that will need to be resolved in court. While this is likely a years-long dispute and speculation about its outcome is futile at this point, in states where abortion remains legal, it may be simpler.
Health and Human Services are likely to release guidance and interpretation of HIPAA regulations that promote privacy in a way specifically tailored to mess up cross-border requests. If state law and federal law stack up to protect a patient’s privacy, lawsuits and demands from states seeking to criminalize the behavior in neighboring jurisdictions may not get off the ground.
The next section adds to this in that the AG will provide “technical assistance” to states on the issue of out-of-state patient protection, which is to say “let’s write this law together.”
To some, this executive order will seem like a trivial thing; and indeed, if that is all the administration can deliver after weeks of inaction, it is rightly disappointing to those calling for more concrete action. But while it doesn’t accomplish much on its own, it clearly shows the administration’s intent to, at the very least, support states that fight to protect reproductive rights rather than those that restrict them.
Tech
