The White House provided this fact sheet of actions the Biden-Harris Administration is taking to protect patient privacy in the wake of the assault on women’s access to reproductive health care:

Today, the Biden-Harris Administration will announce new actions to safeguard patient privacy at the third meeting of the Task Force on Reproductive Healthcare Access with Vice President Harris. These announcements build on actions that the Administration has taken to protect privacy and access to accurate information in the wake of the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, as the President directed in his first Executive Order to protect access to reproductive health care, including abortion. Efforts to protect sensitive health information, including related to reproductive health care, have taken on renewed importance, as states seek to penalize and criminalize health care providers and interfere in deeply personal medical decisions.

At the meeting, the Cabinet will discuss their ongoing efforts to defend reproductive rights and support access to reproductive health care more broadly. The Task Force will also discuss updates on the Administration’s response to Alliance for Hippocratic Medicine v. FDA, as well as efforts to implement the Presidential Memorandum on ensuring safe access to medication abortion, which has been approved by the Food and Drug Administration as safe and effective for over two decades.

Today, the Administration announced actions to:

• Strengthen Reproductive Health Privacy under HIPAA. The Department of Health and Human Services (HHS) is issuing a Notice of Proposed Rulemaking to strengthen privacy protections under the Health Insurance Portability and Accountability Act (HIPAA). This rule would prohibit doctors, other health care providers, and health plans from disclosing individuals’ protected health information, including information related to reproductive health care, under certain circumstances. Specifically, the rule would prevent an individual’s information from being disclosed to investigate, sue, or prosecute an individual, a health care provider, or a loved one simply because that person sought, obtained, provided, or facilitated legal reproductive health care, including abortion. By safeguarding sensitive information related to reproductive health care, the rule will strengthen patient-provider confidentiality and help health care providers give complete and accurate information to patients.                                              
• Protect Students’ Health Information. The Department of Education (ED) is issuing guidance to over 20,000 school officials to remind them of their obligations to protect student privacy under the Family Educational Rights and Privacy Act (FERPA). The guidance helps ensure that school officials—including those at federally funded school districts, colleges, and universities—know that, with certain exceptions, they must obtain written consent from eligible students or parents before disclosing personally identifiable information from students’ educational records, which may include student health information. The guidance encourages school officials to consider the importance of student privacy, including health privacy, with respect to disclosing student records. ED is also issuing a know-your-rights resource to help students understand their privacy rights for health records at school.  
• Support Consumer Privacy. The Federal Communications Commission (FCC) is launching a new guide for consumers on best practices for protecting their personal data on mobile phones. The guide also explains how existing FCC requirements protect against the disclosure of consumers’ sensitive information, including geolocation data, which can be especially important in the context of accessing reproductive health care. The guide follows a recent Notice of Proposed Rulemaking issued by FCC that is aimed at updating and strengthening data breach rules to provide greater protections to personal data. 
• Safeguard Patients’ Electronic Health Information. HHS is issuing guidance affirming that doctors and other medical providers can take steps to protect patients’ electronic health information, including their information related to reproductive health care. HHS will make clear that patients have the right to ask that their electronic health information generally not be disclosed by their physician, hospital, or other health care provider—including to other health care providers. The guidance also reminds health care providers that HIPAA’s privacy protections continue to apply to patients’ electronic health information.

The Administration also announced related efforts to provide access to accurate information and bolster data related to women’s health more broadly:

• Leverage Maternal Health Data to Address Disparities. FCC is committing to the swift implementation of the Data Mapping to Save Moms’ Lives Act, which directs FCC, in coordination with the Centers for Disease Control and Prevention, to incorporate publicly available data on maternal mortality and morbidity into its Mapping Broadband Health in America platform. This innovation will support women’s health by informing efforts to expand broadband access—including access to telehealth—in areas with poor maternal health outcomes. This builds on the Administration’s work to improve maternal health and address long-standing disparities, including those spotlighted this Black Maternal Health Week. FCC will continue to explore opportunities to improve research, data collection, data analysis, and interpretation in the context of reproductive health care and maternal health outcomes. 
• Promote Accurate Information About Reproductive Care. HHS is announcing that it will issue a new Notice of Funding Opportunity to establish a safe and secure national hotline to provide referral services to women in need of accurate information about their legal reproductive health care options. The nondirective hotline would provide information to patients served by the Title X family planning program who request information related to prenatal care and delivery; infant care, foster care, or adoption; or pregnancy termination.

Today’s announcements build on previous actions to protect patient privacy and access to accurate information. The Administration has taken action to:

• Prevent Illegal Use and Sharing of Sensitive Health Information. The Federal Trade Commission (FTC) has committed to enforcing the law against illegal use and sharing of highly sensitive data, including information related to reproductive health care. Consistent with this commitment, the FTC recently took first-of-its-kind enforcement action against companies for disclosing consumers’ personal health information without permission to Facebook, Google, and others. The FTC has also urged companies to consider that sensitive data is protected by numerous state and federal laws and that claims that data is “anonymous” are often deceptive. 
• Reinforce Existing Protections under the HIPAA Privacy Rule. Immediately after Dobbs, HHS issued guidance to help ensure doctors and other health care providers and health plans know that, with limited exceptions, they are not required—and in many cases, are not permitted—to disclose individuals’ health information, including to law enforcement. This guidance, which helps protect individuals seeking or receiving reproductive health care, remains in effect while today’s rulemaking is underway. The Notice of Proposed Rulemaking noted above would further strengthen privacy protections under the HIPAA Privacy Rule. 
• Protect Individuals’ Health Information Online. HHS issued a bulletin to affirm that HIPAA’s privacy protections extend to the use of online tools offered by or on behalf of covered entities that collect protected health information through websites and mobile apps. These tools, such as “cookies” on a website, can be used to track online activity and information about website and app users, sometimes in ways that collect or reveal protected health information. This can include information about reproductive health care, such as the location of where an individual sought medical treatment. The bulletin makes clear that health care providers and health plans—as well as many of the entities that these organizations do business with—cannot use online tracking tools or share patient information with third parties in a way that violates HIPAA.

• Help Consumers Protect Their Personal Data. HHS issued a how-to guide for consumers on steps they can take to make sure they are protecting their personal data on personal cell phones or tablets. HHS also provided tips for protecting individuals’ privacy when using mobile health apps, like period trackers. This resource helps ensure that consumers have the information they need to better protect their health information when it is accessed or stored on their personal cell phones or tablets, which are generally not protected under HIPAA.  
• Promote the Privacy of Service Members. The Department of Defense issued an updated policy to provide Service members with time and flexibility to make private health care decisions while accounting for the responsibility placed on commanders to meet operational requirements and protect the health and safety of those in their care. This policy standardized the timeframe for Service members to inform their commanders about a pregnancy, generally allowing Service members until up to 20 weeks of pregnancy to notify their commanders of their pregnancy status, with limited exceptions to account for specific military duties, occupational health hazards, and medical conditions. 
• Provide Access to Accurate Information and Legal Resources. On the day of the Supreme Court’s Dobbs decision, HHS launched ReproductiveRights.gov, which provides timely and accurate information about reproductive rights and access to reproductive health care. This includes know-your-rights information for patients and providers and promotes awareness of and access to family planning services, as well as guidance for how to file a patient privacy or nondiscrimination complaint with its Office for Civil Rights. DOJ also launched justice.gov/reproductive-rights, a webpage that provides a centralized online resource of the Department’s work to protect reproductive freedom under federal law.