HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Head of House Select Investigative Panel Calls for HIPAA Investigation into Abortion Clinic PHI Disclosures

Last week, the head of the House Select Investigative Panel tasked with investigating the trade of baby body parts by abortion clinics wrote to the director of the Department of Health and Human Services’ Office for Civil Rights requesting an investigation into violations of the Health Insurance Portability and Accountability Act (HIPAA).

It is alleged that Planned Parenthood – Planned Parenthood Mar Monte (PPMM) and Planned Parenthood Shasta Pacific (PPSP) – and Family Planning Specialists Medical Group (FPS) improperly disclosed the protected health information (PHI) and personally identifiable information (PII) of female patients to StemExpress.

In her June 1 letter to Jocelyn Samuels, Rep. Marsha Blackburn explains that employees of StemExpress were provided with details of the abortions that were scheduled to take place on each day and were also given access to the medical files of patients who would be likely to provide fetal tissue donations. Blackburn claims that StemExpress employees were allowed inside of clinics and were given permission to interview patients in order to obtain consent for tissue donations.

Blackburn said the abortion clinics are guilty of systemic violations of the HIPAA Privacy Rule from 2010 to 2015, while StemExpress used invalid consent forms; a violation the Code of Federal Regulations (45 CFR 46.)

Get The Checklist

Free and Immediate Download
HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Blackburn explains that the abortion clinics would not be permitted to disclose PHI under 45 CFR § 164.512(h) – the uses and disclosures for cadaveric organ, eye or tissue donation purposes standardbecause tissues were not being used for transplantation. She also points out that the disclosure of PHI to StemExpress did not meet the requirements of standard 45 CFR § 164.512(h) – Uses and disclosures for research purposes – as no approval form was obtained from an Institutional Review Board, and therefore the disclosure of PHI without authorization was not permitted. Blackburn also pointed out that the PHI was not of deceased individuals, and that PHI was not solely used to prepare research protocols.

Blackburn said that no evidence was uncovered to suggest that consent had been provided by patients prior to the sharing of their PHI with StemExpress, and that even if consent had finally been provided by the patient for tissue samples to be donated, a HIPAA Privacy Rule violation had still occurred.

Blackburn also claims that when providing PHI to StemExpress, the data were not limited to the minimum necessary amount to facilitate the procurement of tissue samples from aborted infants.

Blackburn also explained that StemExpress is not a HIPAA business associate of the abortion clinics and was therefore was not permitted access to the PHI of abortion clinic patients.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.