Effective July 1, 2022, Connecticut’s Reproductive Freedom Act (PA 22-19) expands access to abortion, enhances protections for reproductive healthcare records and provides protections to abortion providers and patients receiving abortion care in the state. Connecticut was the first state to pass such legislation after news of the Dobbs decision leaked. Massachusetts and California followed suit. This article will focus on the enhanced protection of reproductive health records in Connecticut.
The new law prohibits all HIPAA covered entities from disclosing, in any civil action or probate, legislative or administrative proceeding, any records, communications or information relating to “reproductive health care services” received by a patient unless the patient or the patient’s representative “explicitly consents in writing.” There’s a lot to unpack here.
What does “reproductive health care services” entail?
“Reproductive health care services” mean “all medical, surgical, counseling or referral services relating to the human reproductive system, including, but not limited to, services relating to pregnancy, contraception or the termination of a pregnancy.” This is a broad definition. It includes not only abortion services but also all counseling services or referrals to other providers relating to all aspects of reproduction.
How is the protection of records in PA 22-19 different than the existing protection of records under HIPAA?
HIPAA requires only a generalized written authorization for the release of most protected health information (PHI). Except for the very narrow category of psychotherapy notes, HIPAA does not treat categories of medical information differently.
Under certain circumstances, PA 22-19 essentially creates a special class of medical information for reproductive health care services information that receives more protection under state law than HIPAA provides. It is more protective because it requires explicit consent before a provider can disclose such information when the disclosure is for a civil action or probate, legislative or administrative proceeding.
This could involve, for example, a subpoena for documents or testimony, a request from an attorney related to a lawsuit, an investigative demand from a government agency or a request from a party in a probate court matter. Under these circumstances, a standard HIPAA authorization will not suffice to authorize the disclosure of reproductive health care services information. Rather, as with behavioral health, HIV/AIDS and substance use disorder information, the authorization must specifically allow the release of reproductive health care services information.
Will this impact how providers share information with other providers for treatment purposes?
No. PA 22-19 explicitly permits continued lawful sharing of PHI permitted by state or federal law. This includes sharing for treatment purposes. Although sharing reproductive health care services information for treatment purposes across state lines is permitted, I urge providers to document the patient’s understanding and approval of such sharing because once the records are in another state, the records are no longer protected by the Connecticut law.
What changes are necessary to ensure compliance with PA 22-19?
Providers will need to train staff to identify requests from lawyers, subpoenas, requests for information from a government agency or any similar requests seeking PHI that includes reproductive health care services information. They will need to understand that these requests require extra scrutiny and that a standard HIPAA authorization may not permit the disclosure of the requested information.
In addition, providers should be sure that they have a good process for managing third-party requests for information, generally. See Providers of Care and Defenders of Privacy: Strategies to Protect Patient Privacy After the Reversal of Roe v. Wade.
How do providers handle request for records related to a court or other proceeding with a just a standard HIPAA authorization?
When the request is accompanied by a HIPAA-compliant authorization, but there is no explicit consent to release reproductive health care services information, providers have a few options. The first option is to contact the patient and ask if the patient would like those records disclosed and, if so, obtain written confirmation and consent from the patient.
A second option is to redact or withhold the reproductive health care services information when responding to the request. This approach likely will prompt follow-up from the requestor. Providers should be prepared to respond without releasing information. For example, it would be problematic to respond that the authorization was not sufficient for the release of abortion related records. Instead, be prepared with a more generic response such as, “under state law, explicit consent is required for the release of certain information. The authorization you provided did not provide the required level of consent.”
As a final option, the provider could contact the requesting party and explain that explicit written consent is required. Be mindful of the issue noted above about disclosing too much information. Some providers use a standard response sheet to respond to requests that lack an appropriate authorization. Providers could add to or modify that response to read: “The authorization sent with your request did not provide the level of consent required by law for the release of all or some of the requested information.”
Communicating with the patient directly is most often the best option.
How will PA 22-19 impact a patient’s request to access their own records for use in a court proceeding?
It will not affect a patient’s right of access to their own information, even if it is for a court, legislative or administrative proceeding. A patient retains the right to access to the patient’s record subject only to limited exceptions. Providers should have detailed policies on a patient’s right of access and should follow those policies in responding to patient requests or directives to send information.
What else does the Connecticut law address?
First, the law expands access to abortion services by permitting APRNs, physician assistants and nurse-midwives to perform medication or aspiration abortions. These providers can also now consult with patients on the decision to terminate a pregnancy. Previously, state law permitted only physicians to perform such services.
Notably, the new law also imposes significant limitations on the assistance that Connecticut courts, lawyers and public agencies can provide in out of state cases related to reproductive health care services that are legal in Connecticut. This includes limitations on subpoena powers and on compelling individuals to testify in an out of state criminal matter under certain circumstances.
Additionally, the law restricts the Governor’s discretion to extradite individuals for acts performed in Connecticut that result in crimes in other states. Lastly, for individuals sued in another state for providing or assisting with reproductive health care services as permitted under Connecticut law, the law creates a cause of action that allows such person to recover damages.