The Increased Need to Protect Health Data Privacy in a post- Roe World

On 24-6-2022, the United States Supreme Court overruled Roe v. Wade¹, and Planned Parenthood of Southeastern Pennsylvania v. Casey², and held that the American Constitution does not confer upon its citizens the right to abortion. In doing so, the Court allowed the States to impose any form of restriction on the right to abortion. In States such as Missouri, Louisiana and Kentucky that already had trigger laws in place, abortion is now banned with very few, narrow exceptions.

The emotional, sociological, political, and financial impact of this ruling has been adequately documented in the weeks since it occurred. The ruling, however, also has implications for the field of health data and privacy, the most crucial of which is whether healthcare information can now be used to incriminate patients and healthcare service providers.

I. Health data privacy in the US

A. Reproductive health data as evidence

Unlike many other countries, including India, the United States has federal legislation that explicitly protects health data of its citizens — the Health Insurance Portability and Accountability Act (HIPAA).

One might assume that the HIPAA protects the health data of women seeking abortion. However, the law is inadequate in this regard, and the protection of patients’ privacy is not absolute. Health law experts Kayte Spector-Bagdady and Michelle Mello identified three situations in which HIPAA would fail to protect the privacy of patients.³ These include using a patient’s medical records to prosecute them for seeking abortion, using healthcare facility records to prosecute the medical institution and using online activity information to show that a woman is seeking abortion.

In the first scenario, where law enforcement authorities or courts have issued subpoenas to access the electronic health records of a patient, clinics, hospitals and medical establishments would be obliged to give the authorities the information. This is possible because of the exceptions prescribed under HIPAA. Entities that are covered by HIPAA and handle healthcare data would be “required by law” to comply with such orders. The information obtained can then be used as evidence by enforcement authorities to prosecute persons seeking or abetting an abortion.

B. Recent HHS interventions

US senators have recently called on the human and health services (HHS) to address this issue and protect the reproductive healthcare information of patients. The office of civil rights of the HHS then issued a guidance outlining the ways in which citizens could protect their health information while using cell phones and tablets, and provided guidance to healthcare providers that unless State law required them to report abortion related incidents, the privacy rule under HIPAA would prevent them from making such disclosures. Further, the guidance noted that healthcare providers were not required to disclose personal health information in absence of a valid court order or subpoena from law enforcement authorities.

The HHS has been urged to do more, including by way of using their administrative powers to update the HIPAA privacy rule, specify the covered entities, limit the circumstances in which these entities can share reproductive health or abortion related information and clarify that healthcare information cannot be shared with law enforcement agencies who may be targeting women seeking abortion.

C. Inter-State travel and privacy

Another issue that arises in this context is that of residents of one State travelling to another State to get an abortion. In his concurring opinion, Justice Brett Kavanaugh writes that he believes that States cannot prevent a woman from travelling to another State owing to their constitutional right to inter-State travel. However, the Justices Breyer, Sotomayor and Kagan were skeptical, and of the view that States may end up banning such travel or prevent women from obtaining abortion medication from other States.

Some States have proactively adopted laws to prevent out of State prosecutors from obtaining a patient’s information and abortion records in order to shelter the abortion rights of women from other States. For instance, Connecticut State law protects medical information at a general level and bars HIPAA covered entities from sharing medical data relating to reproductive healthcare services to out of State prosecutors. However, health law expert Carleen Zubrzycki argues that such laws do not do much to address the “interoperability trap”.⁴

According to her, due to the increased regulatory push to sharing data and electronic health records and the limited scope of HIPAA, prosecutors can easily obtain information about abortion related procedures through a doctor or hospital in their home State. Interoperability of health data allows doctors from different medical practices to access prior healthcare information of a patient. By using this to their advantage, prosecutors can ask home State providers that are not subject to the laws of other States to simply hand over medical records.

On 8-7-2022, President Joe Biden passed an executive order aimed at protecting access to abortion. The order issued directions to the Health and Human Services, the Department of Defense and the Federal Trade Commission (FTC) to make efforts to give women access to abortion medication, travel across States among others. But again, without a federal law, Biden will not be able to protect the right to abortion or prevent States from accessing reproductive healthcare information from providers.

D. Online data collection

Another privacy concern that Spector-Bagdady and Mello highlight is a person’s online activity being used as evidence to establish the fact that they sought abortion or assisted someone else with an abortion. Many women use menstruation apps on their mobile phones to keep track of their reproductive health. These applications collect various data points including information about one’s sexual life and menstruation cycles. All of this may be used to infer the status of pregnancy by law enforcement agencies.

Strikingly, these apps are not regulated by HIPAA as they do not fall under the category of covered entities. This also allows them to freely monetise the data that they collect. It has been found that many menstruation apps in the US share data with third parties. Information such as, whether the woman wishes to have a baby or wants to avoid one is used by advertisers to display ads about fertility or abortion clinics.

Apart from the menstruation apps, other online activities including internet searches, phone records, geolocation and text chats can also be used by prosecutors to pursue legal action against those seeking abortion. State prosecutors have already used a woman’s online search history as evidence in cases of alleged murder, neglect of a dependent and feticide.⁵ Law enforcement agencies can easily get hold of such digital information by obtaining a judicial warrant or even by buying the information from private companies who sell digital data.

Following President Biden’s executive order, the Federal Trade Commission, in a welcome move, asserted their commitment to enforcing the law against misuse of highly sensitive data. In a blog post, Kristin Cohen from the FTC’s division of privacy and identity protection, highlighted how easily companies are able to collect information about consumers either online or through mobile applications. Data such as location history and information related to reproductive health have even been used to target women seeking abortion, she says. The FTC warned companies not to engage in unfair trade practices, collect excessive amounts of data or exploit consumer data, or risk facing legal consequences.

II. Health data privacy in India

The US experience shows us that despite the existence of a detailed healthcare privacy law focused on protecting sensitive information (the HIPAA), the health data of its citizens could still be left vulnerable, leading to reproductive health data not only being monetised by companies but even being used to prosecute women seeking access to abortion.

In India, the situation is arguably worse. In recent years, a worrying trend has emerged of data privacy legislation being drafted, debated by Parliamentary Committees and ultimately being shelved for reasons uncertain, even as the scale and scope of data monetisation by private and State actors multiplies.

A. DISHA, 2018

In 2018, the Ministry of Health and Family Welfare released the draft of Digital Information Security in Healthcare Act (DISHA) and invited comments from stakeholders. However, in the four years since the draft was published, there has been no progress in the implementation of the law, and DISHA has neither been passed nor tabled in the Parliament.

DISHA aimed to create national and regional health authorities and regulate the collection, storage, and transmission of health data. It also sought to ensure that data privacy and confidentiality are maintained. It acknowledged the importance of patient autonomy and requires the consent of the patient at multiple stages. It even banned the sharing of anonymised data for commercial purposes.

According to DISHA, digital health data would include electronic records of information related to an individual’s physical or mental health, tests or examinations conducted, health services availed, clinical establishment accessed and the donation of a body part or substance. Apart from this, DISHA also earmarked two separate categories of data: personally identifiable information and sensitive health-related information. The Act has a wide ambit and imposes a duty on clinical establishments, as well as any other entity who comes in possession of digital health data to protect the privacy, confidentiality, and security of the same.

DISHA has also faced its share of criticism, however. First, the Chief Health Officer of the Health Benefit Exchange Authority established under the Act would have access to the digital health data even though they only act as an intermediary. This raises concerns about a possible breach of data and unwanted sharing of health data. Another issue with the Act is that it does not explicitly recognise the right to be forgotten, which was emphasised by the Supreme Court in K.S. Puttaswamy v. Union of India⁶ judgment. Although not a concern for everyday citizens, tech and pharma companies have also criticised DISHA for completely prohibiting (including in anonymised form) the sharing of digital health data with third parties.

B. Personal Data Protection Bill, 2019, and the Data Protection Bill, 2021

Another piece of draft legislation that was recently withdrawn altogether, after lawmakers had laboured over it in one form or another for four years, is the Data Protection Bill, 2021 (DPB).

The DPB has its genesis in the famous 2017 judgment of the Supreme Court of India, in K.S. Puttaswamy v. Union of India⁷, which called out the need in India for a strong data protection regime. The judgment led to the constitution of a committee, headed by former Supreme Court Justice B.N. Srikrishna, which on 27-7-2018, proposed a draft data protection law, later codified as the draft Personal Data Protection Bill, 2018. This Bill was revised, after consultation with stakeholders, and tabled in Parliament on 11-12-2019, as the Personal Data Protection Bill, 2019 (PDP Bill). A Joint Parliamentary Committee was then set up to review the PDP Bill, which duly submitted its report in December 2021, proposing that the PDP Bill be replaced with a new Bill, the DPB.

The DPB was then abruptly withdrawn by the Government of India on 3-8-2022, with the stated reason being “to make way for a comprehensive legal framework for the digital ecosystem”.

The DPB, and the PDP Bill before it, had been criticised by privacy advocates and some lawmakers as shifting the focus of the Bill from citizens’ privacy to the economic and security interest of the State. It gave the Government broad powers to store, use and control the large amounts of personal data it gathered on its citizens, including fingerprints and iris scans, while exempting law enforcement agencies and public entities from the legal provisions, ostensibly for national security reasons. Opposition politicians pointed out that the DPB created “two parallel universes — one for the private sector, where it would apply with full rigour, and one for the Government, where it is riddled with exemptions”.

C. The IT Act and the SPDI Rules

The Information Technology Act, 2000 (the Act), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the SPDI Rules) framed under the Act, are today the only laws that govern data privacy (whether general or health data) in India.

The essence of the SPDI Rules is that body corporates must take steps to implement suitable security measures to protect sensitive data. If body corporates fail to safeguard the data of individuals or take appropriate security measures, they will be required to pay compensation to the individual affected.

The SPDI Rules are limited in scope — they apply only to body corporates. Small clinics or independent doctors, for example, who also handle health data are not subject to them. The SPDI Rules also fail to incorporate, among others, the right to be forgotten, or object to or restrict data processing, or the right to portability, and do not provide for a dedicated data protection authority for grievance redressal.

Conclusion

In a recent interview (with ET Tech on 4-8-2022), a government representative promised that the “comprehensive legal framework” referred to when the DPB was withdrawn, was “almost ready” and would “soon be made available for public consultation”. In any event, with the withdrawal of the DPB, the legislative process has regressed to 2011, as we are back to relying on the SPDI Rules for data protection.

In the meantime, a combination of increased smartphone adoption and rapid digitisation, and an institutional lack of commitment towards preserving citizens’ privacy, has led to indiscriminate data collection in India, including through massive, nation-wide Government-led initiatives such as the Aadhaar, Aarogya Setu and Ayushman Bharat Digital Mission (ABDM) projects (which aims to create a national electronic health records system that allows doctors, patients, and healthcare providers access to huge amounts of patient data). These programs operate entirely in the absence of in-built data protection principles and appear to collect data without explicit consent or purpose limitations.

Recent events in the US have shown how personal and health data can be used against a nation’s citizens in the absence of adequate data privacy laws. There is enough cause for Indian citizens to fear a similar fate given recent trends.