HIPAA Policy Becomes Focus of Abortion Debate
Discarded medical records and their disposal sites have become a new legal battleground between anti-abortion activists and clinics that provide abortion services, according to a recent investigation by ProPublica and National Public Radio.
The series of articles highlight an anti-abortion activist group called Operation Rescue that admits that it has searched waste disposal sites, such as dumpsters, looking for the medical records of patients who have had abortions. The activist groups say they are just trying to demonstrate that some clinics have poor privacy controls, and that they are looking to protect patients.
One former Kansas City clinic owner, Jeff Pederson, said Operation Rescue searched locked garbage bins on private property to obtain discarded records from his clinic. He later learned the waste management company used a common key which made it easier to breach, NPR reported. Operation Rescue—which was acting on a tip from someone sympathetic to their cause—then posted some of the records obtained during that dumpster dive on their website, with the patient names redacted.
Other times, unsecured health records from women’s health clinics are found accidentally and under circumstances in which clinics have shown negligence in disposing of files. In one case, in Overland Park, Kansas, a woman found a recycling bin outside of a closed clinic that was full of medical records with protected health information, such as names, dates, telephone numbers, and Social Security numbers.
HIPAA strictly prohibits this disposal method. According to the US Department of Health and Human Services’ HIPAA FAQ, covered entities may not dispose of records in dumpsters “unless the protected health information (PHI) has been rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed prior to it being placed in a dumpster. In general, a covered entity may not dispose of PHI in paper records, labeled prescription bottles, hospital identification bracelets, PHI on electronic media or other forms of PHI in dumpsters, recycling bins, garbage cans, or other trash receptacles generally accessible by the public or other unauthorized persons.”
Even in this case, however, Operation Rescue elected to post some examples of these files on their website, though identifying information was concealed.
“If it’s lying out on the curb, it’s a free-for-all, you know what I’m saying? That’s the way we look at it,” Cheryl Sullenger, senior policy adviser at Operation Rescue, told NPR.
Operation Rescue has had some success in getting legal sanctions for physicians who were revealed through the dumpster diving discoveries to be conducting illegal procedures and mis-prescribing abortifacient medications.