Paging the Clinical Informatics Community: Respond STAT to Dobbs v. Jackson's Women's Health Organization

If the coronavirus disease 2019 (COVID-19) pandemic was a wake-up call that clinical informatics and digital health play vital roles in our future, the 2022 U.S. Supreme Court ruling in Dobbs v. Jackson Women's Health Organization (Dobbs)[1] is a blaring alarm. Dobbs, which overturned Roe v Wade and Planned Parenthood v. Casey, allows states to individually regulate access to abortion. This ruling has triggered the enforcement of existing state laws that ban or restrict abortion and efforts to pass similar new laws.

Some state statutes have included criminal or civil penalties for individuals who receive abortions, provide abortion services, or assist others in obtaining abortions.[2] These statutes make it difficult or impossible for pregnant patients to receive essential or emergent medical care[3] and have already had a chilling effect on the willingness of clinicians to provide appropriate medical care.[4] The United States, which already ranked last in maternal mortality among industrialized countries,[5] is expected to experience worse maternal outcomes post-Dobbs.[6] Additionally, pregnant patients are expected to be increasingly prosecuted for pregnancy loss.[7]

The Dobbs ruling has reversed U.S. law for half a century, while health information technology (IT) has advanced significantly during the same period. There has been widespread adoption of electronic health record (EHR) systems that can store and instantly exchange massive amounts of patient data. Thousands of personal digital applications (apps) track different aspects of health. Contemporary medical practice is inextricably linked to health IT, and the recent ruling undeniably has implications for clinical informatics. Given the present circumstances, we in the clinical informatics community must decide how we will respond to safeguard our patients' health.

In deciding how we proceed as a community, we can first take inventory of how our field intersects with this ruling:

1. We are experts in protected health information (PHI) and recognize that protections for reproductive health data under the Health Information Portability and Accountability Act (HIPAA) Privacy Rule are lacking.

2. We understand EHR documentation and how data could be used to prosecute abortion.

3. We implement interoperability efforts to support PHI portability and understand the implications of data exchange for out-of-state abortion care.

4. We create telehealth and virtual care programs that provide care to underserved communities by reducing the need for patients to travel long distances.

5. We partner with EHR vendors to develop necessary features, such as opting patients in or out of sharing PHI.

6. We create data exchange standards such as Data Segmentation for Privacy (now called Shift)[8] that allow clinicians to block sections of a record from sharing.

7. We leverage cloud servers, remote patient monitoring, telehealth, and personal health apps and appreciate their potential for reproductive health data capture and misuse.[9]

8. We lead patient-facing communication efforts and can advise patients and families on the limited privacy protections beyond HIPAA's “covered entities” and the digital surveillance capabilities of apps selling data to third parties.

9. We know how to harness EHR data to identify at-risk populations who may need additional support due to systemic inequities.[10]

Our clinical informatics community includes experts across all these relevant topics.

In response to the Dobbs ruling, the clinical informatics community can and should take several immediate actions:

1. Shift our mindset to acknowledge that reproductive health care, including abortion care, is health care and under the purview of clinical informatics.

   Situation: Historically, reproductive health care, and abortion care specifically, has been siloed and considered an area of medicine reserved for clinicians trained in obstetrics.

   • 1.1 Action: Challenge this thinking. We in the clinical informatics community must view ourselves as major stakeholders in the conversations surrounding care and the delivery of safe and effective reproductive health care. Abortion care, which is part of the full spectrum of reproductive health care, is health care. The clinical informatics community supports patients and clinicians across all clinical specialties.

   • 1.2 Action: Introduce yourself to local health systems stakeholders, including doctors and other clinicians providing abortion care, early pregnancy care, and miscarriage management. Start a dialogue to identify their needs and offer your partnership in their efforts to provide safe and effective health care.

2. Monitor, evaluate, and disseminate findings surrounding Dobbs' effects on patient care and health outcomes.

   Situation: The Dobbs ruling has created many new risks and uncertainties, and new data are needed to understand the ruling's impact on patients, clinicians, and health systems.

   • 2.1 Action: Collect and analyze data on the impact and consequences of the Dobbs ruling on patients, clinicians, and our health systems from operational and research perspectives. These findings can contribute to future policy efforts, including reversing abortion bans.[11]

   • 2.2 Action: Introduce yourself to local health system researchers in the reproductive health care space. Start a dialogue to understand their research efforts and research needs, and offer your partnership in producing high-quality, unbiased research.

3. Educate colleagues and local health care systems on HIPAA in the context of Dobbs.

   Situation: At present, the most substantial risk to patients receiving abortion care is legal, not medical.[11] There is a history of clinicians reporting pregnant patients to authorities for situations clinicians think might be illegal or inappropriate,[12] and clinicians are more likely to report Black and low-income pregnant patients.[13] Prior to the Dobbs ruling, between 2000 and 2020, 39% of people criminally investigated or arrested for allegedly ending their own pregnancy or helping someone else to do so “were reported to law enforcement by health care providers and 6% by social workers.”[14]

   • 3.1 Action: Emphasize to your health care community that at the present time, no state mandates medical professionals to report suspicion of self-managed abortion. Reporting may violate patients' privacy rights and could result in penalties for medical professionals who inappropriately make reports.[15]

   • 3.2 Action: Implement educational campaigns explaining HIPAA in the context of the Dobbs ruling as described in the recent federal FAQs provided by the Office for Civil Rights of the U.S. Department of Health and Human Services (HHS),[16] which provides example scenarios.

   • 3.3 Action: Stay abreast of how the HIPAA Privacy Rule and state specific laws relate to different scenarios, such as the sharing of information when minors seek reproductive health care.

   • 3.4 Action: Consider creating a segmented patient record in which pregnancy-related health events are separated from other aspects of care to minimize the number of clinic staff with access to such information.[17]

4. Educate patients and health systems about security issues associated with health data shared on the Internet and through third-party apps.

   Situation: The use of Internet functionality (e.g., browsers and messaging services) and third-party apps on smart devices can be risky because these services and apps may collect, share, or sell data without informed patient consent.[18] Search histories[19] and Facebook direct messages[20] are being used to prosecute patients. Additionally, research suggests that 99.1% of U.S.-based abortion clinic Web pages use third-party tracking, which could potentially sell or share browsing data with law enforcement or civil litigants.[21]

   • 4.1 Action: Engage your health care community to discuss with patients how Internet services and apps may collect and misuse data without patient consent and steps that can be taken to minimize risk, as explained in the recent federal guidance, “Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet.”[22]

   • 4.2 Action: Help your local reproductive care clinics audit their websites to identify and remove third-party trackers.

5. Revisit interoperability and health data-sharing practices to address the “Interoperability Trap.”

   Situation: As described in Zubrzycki's, “Abortion's Interoperability Trap: How the Law of Medical Records Will Facilitate Interstate Persecution of Contested Medical Procedures, And What To Do About It,”[23] medical record sharing without patient consent is permitted through HIPAA whenever the purpose is for “patient care.” Therefore, when a patient from a more restrictive state receives abortion care in a more permissive state and then returns to the more restrictive state and seeks care—even for unrelated reasons—it is likely that the patient's entire record will be accessible by and available to clinicians in the more restrictive state. Some more permissive states, such as Connecticut, have enacted safe haven protections aimed at shielding those who participate in and receive abortion care within Connecticut from being prosecuted or sued elsewhere by preventing in-state clinicians from handing over the patient's medical records to more restrictive states. However, these provisions may be easily circumvented by simply requiring any clinician with access to the patient's records who is not subject to Connecticut privacy laws to hand over the records. According to Zubrzycki, “this gap creates an enormous loophole, one which—if weaponized by anti-abortion litigants—would swallow the protections the legislation purports to offer.”[23]

   • 5.1 Action: At the federal level, the clinical informatics community should advocate for strengthening privacy protections in HIPAA, such as limiting law enforcement's access to sensitive data in health records.[24]

   • 5.2 Action: At the federal level, the clinical informatics community should advocate for amending HIPAA's Privacy Rule to require specific consent before sharing records pertaining to abortion-related care, or, at least, amend the Information Blocking provision[25] to expressly protect hospital policies that are narrowly tailored to protect information related to abortion care.[23] [24] [26]

   • 5.3 Action: At the state level, the clinical informatics community should advocate for the states seeking to be safe havens to develop their own privacy requirements for medical records pertaining to reproductive services, including abortion.[23] These states should require explicit patient consent for the sharing of reproductive care–related records, “along with a detailed explanation that certain records could be used against the patients if obtained in out-of-state litigation.”[23] Likewise, states should require that these records be segmented from other aspects of an electronic medical record and shared only upon patient request.[23]

   • 5.4 Action: Clinicians, health systems, insurers, and others interested in protecting themselves and their patients should work with the Office of the National Coordinator for Health Information Technology to determine what policies could be developed that would be consistent with the information blocking rule's privacy exception.[23] For instance, clinicians and health systems should explore the legality and feasibility of a policy, “requiring that medical information pertaining to an abortion care, miscarriage, or stillbirth be released only after the patient has provided specific written consent, and only after the patient has been told verbally about the risk that if shared, the medical records may end up in the hands of clinicians in states where abortion is illegal.”[23]

   • 5.5 Action: Work with health care EHR vendors and local health information management teams to develop solutions to give patients the opportunity to opt out of data-sharing capabilities easily across health care institutions and states.

   • 5.6 Action: Host creative design sessions or hackathons with all stakeholders (patients, clinicians, technology developers, designers, ethicists, lawyers, etc.) in an inclusive manner to develop solutions that balance maintaining interoperability and protecting patients from inadvertent data leakage.

6. Optimize documentation practices.

   Situation: Given the aforementioned privacy gaps and described “interoperability trap,” clinicians must consider the potential implications of documentation in the medical record and give serious consideration as to what documentation is clinically necessary and relevant. In some situations, documentation is not clinically necessary but could be used as evidence if the patient is charged with a crime.[11]

   • 6.1 Action: Engage with local health system stakeholders, including clinicians providing abortion care, early pregnancy care, and miscarriage management, to determine how care is currently documented. Work with risk management and local health systems stakeholders to develop minimum documentation best practices[3] and inform these stakeholders about the informatics solutions available, such as documentation templates.

7. Address privacy gaps across covered entities, noncovered entities, and others that fall through the cracks.

   Situation: HIPAA pertains only to PHI held by covered entities (health plans, health care clearinghouses, and most health care providers) and, historically, was designed to promote the portability of medical information.[27] Most noncovered entities handling health-related or other consumer data, such as social media platforms, wearable technology, and personal health record vendors, and personal record storage applications (such as menstrual period tracking apps) are subject to Federal Trade Commission (FTC) consumer protections. These efforts include FTC enforcement of Section 5 of the FTC Act, which prohibits companies from misleading consumers or engaging in unfair practices that harm consumers, and the FTC Health Breach Notification Rule, which requires certain organizations that are vendors of personal health records, personal health record–related entities, or third-party service providers for a vendor of personal health records not covered by HIPAA to notify their customers, the FTC, and, in some cases, the media if there is a breach of unsecured, individually identifiable health information.[28] Some entities, such as crisis pregnancy centers (CPCs), also known as “pregnancy resource centers,” “pregnancy care centers,” “pregnancy support centers,” or simply “pregnancy centers,” have largely escaped being held to the minimum privacy standards set by HIPAA or the FTC. CPCs work to prevent abortions by promoting adoption or parenting as better options. Most CPCs are not licensed medical clinics and their staff are not licensed medical professionals despite appearing, or attempting to appear, as such by having employees wear white coats or perform ultrasounds.[29] Because CPCs are often not licensed as medical clinics, they are exempt from the regulatory, licensure, and credentialing oversight—including HIPAA—that applies to health care facilities. There are also limits on enforcement through other conventional consumer protection mechanisms because CPCs often operate as nonprofit agencies and therefore avoid scrutiny under federal consumer protection laws.[30] As such, CPCs, as noncovered entities, are able to share data without restrictions.

   • 7.1 Action: Support advocacy efforts to extend and strengthen privacy protections defined by HIPAA[31] and broaden protections for consumers and means for enforcement by FTC.

   • 7.2 Action: Call on HHS to mandate noncovered entities such as CPCs follow HIPAA Privacy Rule requirements.[32]

   • 7.3 Action: Develop an app evaluation framework to help patients identify the presence and absence of privacy features that are important to consider when deciding to use apps for health care or other use cases.[18] A similar initiative has been led by the American Psychiatric Association's APP Advisor, which gives patients and other clinicians a framework to consider important information when picking an app for mental health.[33]

8. Be active in professional societies.

   Situation: Professional societies serve as a gathering place for experts in a given discipline to share ideas and establish the gold standards of clinical care. Professional societies have a special ability to harness the expertise of a field to affect change.

   • 8.1 Action: Be engaged in professional societies and work to bridge the gap between clinical, legal, and policy professionals. Ask for the creation of working groups to address Dobbs' informatics implications or join existing ethical, legal, and social issues divisions of professional organizations, and prioritize this issue.

   • 8.2 Action: Reaffirm and specify professional obligations to center patient needs.[34] [35]

Although this list of recommendations is not comprehensive, it serves as a start to what is required: sustained engagement and commitment from the clinical informatics community. Should the clinical informatics community not respond, the cost of inaction is likely to be high: not only will patients and clinicians suffer from the medical and legal implications of Dobbs, but we also will demonstrate to the medical community that we do not reliably respond to emergencies. It is imperative that our community actively leverage our expertise, codify our ethical and professional obligations in health care, and support patient care. The Dobbs decision has created enormous health care needs, and the clinical informatics community must respond.

Note: This editorial represents our personal views and is not intended to represent our employers or any other organization.

• References

• 1 Supreme Court of the United States. Dobbs v. Jackson Women's Health Organization. Accessed September 18, 2022 at: https://www.law.cornell.edu/supremecourt/text/19-1392
• 2 Messerly M, Ollstein AM. Abortion bans and penalties would vary widely by state. Politico; 2022. Accessed September 18, 2022 at: https://www.politico.com/news/2022/05/06/potential-abortion-bans-and-penalties-by-state-00030572
• 3 Jost TS. What happens when federal laws to provide emergency care clash with state abortion laws? Commonwealth Fund; 2022. Accessed September 18, 2022 at: https://www.commonwealthfund.org/blog/2022/what-happens-when-federal-laws-provide-emergency-care-clash-state-abortion-laws
• 4 Holley P. When does a pregnant Texan's life count under the state abortion ban? Texas Monthly; 2022. Accessed September 18, 2022 at: https://www.texasmonthly.com/news-politics/when-does-pregnant-texan-life-count-under-new-abortion-ban/
• 5 Declercq E, Zephyrin L. Maternal mortality in the United States: a primer. Commonwealth Fund; 2020. Accessed September 18, 2022 at: https://www.commonwealthfund.org/publications/issue-brief-report/2020/dec/maternal-mortality-united-states-primer
• 6 Sidik SM. The effects of overturning Roe v. Wade in seven simple charts. Nature 2022; 608 (7922): 254-257
• 7 Aspinwall C, Bailey B, Yurkanin A. They lost their pregnancies. Then prosecutors sent them to prison. The Marshall Project; 2022. Accessed September 18, 2022 at: : https://www.themarshallproject.org/2022/09/01/they-lost-their-pregnancies-then-prosecutors-sent-them-to-prison
• 8 Office of the National Coordinator for Health Information Technology. Security Tags for Sensitive Information: Interoperability Standards Advisory (ISA). Accessed September 18, 2022 at: https://www.healthit.gov/isa/security-tags-sensitive-information
• 9 McGraw D, Mandl KD. Privacy protections to encourage use of health-relevant digital data in a learning health system. NPJ Digit Med 2021; 4 (01) 2
• 10 Lyles CR, Wachter RM, Sarkar U. Focusing on digital health equity. JAMA 2021; 326 (18) 1795-1796
• 11 Grossman D, Perritt J, Grady D. The impending crisis of access to safe abortion care in the US. JAMA Intern Med 2022; 182 (08) 793-795
• 12 National Advocates for Pregnant Women. Guidelines for healthcare providers. Accessed September 18, 2022 at: https://www.nationaladvocatesforpregnantwomen.org/wp-content/uploads/2022/06/5.CPC-Healthcare_6.22.23-1.pdf
• 13 Harris LH. Navigating loss of abortion services - a large academic medical center prepares for the overturn of Roe v. Wade. N Engl J Med 2022; 386 (22) 2061-2064
• 14 Huss L, Diaz-Tello F, Samurai G. Self-care, criminalized: August 2022 preliminary findings. If/When/How. Accessed September 18, 2022 at: https://www.ifwhenhow.org/resources/self-care-criminalized-preliminary-findings/
• 15 Harris LH, Grossman D. Complications of unsafe and self-managed abortion. N Engl J Med 2020; 382 (11) 1029-1040
• 16 Department of Health and Human Services. HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care. Accessed September 18, 2022 at: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/phi-reproductive-health/index.html
• 17 Clayton EW, Embí PJ, Malin BA. Dobbs and the future of health data privacy for patients and healthcare organizations. J Am Med Inform Assoc 2022; 30 (01) 155-160
• 18 Ozeran L, Solomonides A, Schreiber R. Privacy versus convenience: a historical perspective, analysis of risks, and an informatics call to action. Appl Clin Inform 2021; 12 (02) 274-284
• 19 Rankin L. How an online search for abortion pills landed this woman in jail. Fast Company. Accessed September 18, 2022 at: https://www.fastcompany.com/90468030/how-an-online-search-for-abortion-pills-landed-this-woman-in-jail
• 20 Coldewey D. Facebook helps cops prosecute 17-year-old for abortion. TechCrunch. Accessed September 18, 2022 at: https://techcrunch.com/2022/08/09/facebook-helps-cops-prosecute-17-year-old-for-abortion/
• 21 Friedman AB, Bauer L, Gonzales R, McCoy MS. Prevalence of third-party tracking on abortion clinic web pages. JAMA Intern Med 2022; 182 (11) 1221-1222
• 22 Department of Health and Human Services. Protecting the privacy and security of your health information when using your personal cell phone or tablet. Accessed September 18, 2022 at: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/cell-phone-hipaa/index.html
• 23 Zubrzycki C. Abortion's interoperability trap: how the law of medical records will facilitate interstate persecution of contested medical procedures, and what to do about it. SSRN Journal. 2022. Accessed September 18, 2022 at: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4147900
• 24 Walker DM, Hoffman S, Adler-Milstein J. Interoperability in a post-Roe era: sustaining progress while protecting reproductive health information. JAMA 2022; 328 (17) 1703-1704
• 25 Office of the National Coordinator for Health Information Technology. Information blocking. Accessed September 18, 2022: https://www.healthit.gov/topic/information-blocking
• 26 Khanna RR, Murray SG, Wen T. et al. Protecting reproductive health information in the post-Roe era: interoperability strategies for healthcare institutions. J Am Med Inform Assoc 2022; 30 (01) 161-166
• 27 Department of Health and Human Services. Health information privacy. Accessed September 18, 2022 at: https://www.hhs.gov/hipaa/index.html
• 28 Federal Trade Commission. Complying with FTC's Health Breach Notification Rule. Accessed September 18, 2022 at: https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0
• 29 Bryant AG, Swartz JJ. Why crisis pregnancy centers are legal but unethical. AMA J Ethics 2018; 20 (01) 269-277
• 30 Kuznitz A. Crisis pregnancy centers, data privacy a priority for Massachusetts attorney general's office with Roe v. Wade overturned. Masslive.com. Accessed September 18, 2022 at: https://www.masslive.com/politics/2022/07/crisis-pregnancy-centers-data-privacy-a-priority-for-massachusetts-attorney-generals-office-with-roe-v-wade-overturned.html
• 31 Rosenbloom ST, Smith JRL, Bowen R, Burns J, Riplinger L, Payne TH. Updating HIPAA for the electronic medical record era. J Am Med Inform Assoc 2019; 26 (10) 1115-1119
• 32 Bennet, Cortez Masto Call on HHS to Update HIPAA Privacy Rule to Protect Reproductive Rights. Personal Website. Accessed September 18, 2022: https://www.bennet.senate.gov/public/index.cfm/2022/7/bennet-cortez-masto-call-on-hhs-to-update-hipaa-privacy-rule-to-protect-reproductive-rights
• 33 American Psychiatric Association. The app evaluation model. Accessed September 18, 2022: https://www.psychiatry.org/psychiatrists/practice/mental-health-apps/the-app-evaluation-model
• 34 Petersen C, Berner ES, Embi PJ. et al. AMIA's code of professional and ethical conduct 2018. J Am Med Inform Assoc 2018; 25 (11) 1579-1582
• 35 Wynia MK. Professional civil disobedience - medical-society responsibilities after Dobbs. N Engl J Med 2022; 387 (11) 959-961