Offering abortion benefits at your company? Here’s how to protect employees

In states with restrictive abortion laws, law enforcement may require employers to disclose information about employees who have used travel benefits to obtain an abortion, Shah said. This information may be extracted and accessed by law enforcement and used against the employee; There is a concern that the individual holding this information – whether at the company providing the benefit or a third party entrusted with managing it – could misuse it in a state such as that promised by private citizens in Texas. At least $10,000 in compensation From every charge you bring against a person who performs or assists in an abortion.

Employers may not have this information readily available, as they may not be providing travel benefits themselves.

“If an employer maintains a third-party self-insured health plan — and the employer is not transparent about the services covered individuals use in the health plan and has no involvement in any claims decisions within the plan — we have no data that government officials can necessarily go to.” Said Shah, a third-party company may be asked for information on this occasion.

For employers who choose to administer these benefits in-house, Shah added, some critical questions include: “How much information is the employer asking from employees to justify payment? Is the employer asking about the medical services received, where the services were received?”

But even some information held by employers can be useful to law enforcement, if they can combine it with information from other sources.

“An organization can send a subpoena on a company to find out what health plans they have—that’s a starting point,” says Shoba Pillai, a partner at Jenner & Block, whose practice includes data privacy and cybersecurity. The organization provides reproductive health care to corporate clients post-natally.Dobbs.

“From some third-party technology companies and providers, they may seek locational information about an employee’s personal website emails and personal phone usage that is not linked to specific employer information,” Pili said.

Federal and state laws restrict the disclosure of health information

Under federal and state laws governing medical and health information, there are few circumstances in which a party holding an individual’s information is legally permitted to disclose it without the individual’s consent, attorneys say, which is key for employers to understand.

Soon after the release of the Supreme Court Dobbs Comment, the Department of Health and Human Services has issued guidance explaining privacy protections. The Health Insurance Portability and Accountability Act, better known HIPAA

The provisions restrict various parties from disclosing an individual’s health information without their consent. Those bodies atInclude health plans, health care clearinghouses, most health care providers, and their “business associates” such as brokers, third-party administrators, or management software providers.

While employers in general are not covered by HIPAA, Sarah Rae, a partner at McDermott Will & Emery who leads the firm’s multidisciplinary reproductive health care group, says the law “generally applies to ERISA welfare plans—so most employer plans cover health care, reproductive health care benefits like abortion travel benefits or Providing medical travel benefits. Those plans are all subject to HIPAA.

Related: Dobbs and Abortion: The Benefits The world struggles to cope with a new reality.

“The most common way we’ve seen employers offer these abortion benefits is to include them in their existing ERISA health plans, in this case [the plans] It will be subject to HIPAA,” Rai added.

HHS outlines three circumstances under which a HIPAA-covered entity may disclose an individual’s information without their consent: when such disclosure is required by other law; Responding to a law enforcement request through legal process, such as court orders, subpoenas, or subpoenas; When such disclosure is necessary to prevent or reduce a serious threat to a person or the public.

Just because HIPAA-covered entities can choose to disclose information under these exceptions does not mean they must:He is H.H.S.

If a covered entity is served with a court order, subpoena or subpoena to provide information related to an employee’s access to abortion services, for example, and there is a law specifically requiring the reporting of abortion procedures, “then the covered entity is permitted but not required to disclose them,” she said in Data Privacy. And Madeleine Finley, a partner at Jenner & Block who focuses on cybersecurity, said. “And if the covered entity chooses to disclose, they must limit disclosure to the information required by law.”

“The actual requirements for disclosing information under HIPAA are extremely limited,” Finley added.

Many states may have additional restrictions on the disclosure of medical and health information.

For example, California has a medical information confidentiality law. These laws may cover information not limited by HIPAA, Finley said. “So if an employer receives a request for information that affects health information, it’s important to think not only about federal law, but about any state law that may impose additional restrictions or obligations.”

Best practices

While employers who offer abortion-related travel benefits may be tempted to announce the policy publicly or internally, RAI advises corporate clients to be careful about how much they say, as it can put a target on their back.

“We’ve been consulting with employers on how to accurately articulate the benefits, but at the same time try to minimize the risk of being pursued by states that want to aggressively enforce these laws,” Rai said.

Shah agreed, employers should try to withhold as little information as possible about how many employees have access to abortion services, so they have less information to provide government officials.

Read more: Restrictive legal landscape for new employer benefits: Abortion travel assistance

Shah recommended that employers simply provide additional vacation or sick days without requiring employees to communicate a specific reason for taking time off and to use third-party benefits managers.

For employers who do the latter, this is a good time to “review their business associate agreements and ask their TPAs ​​to make sure they are HIPAA compliant.” [third party administrators] How and when to disclose information about a TPA policy to law enforcement, especially when multiple overlapping state and local laws apply,” said Jessica Agostinho, a partner at Hunton Andrews Curt who specializes in employee benefits law.

She suggests reviewing the company’s IT systems to ensure they are adequately protecting health data.

Finally, Finley said, “this is a good time to think about your data retention policy.”

“It’s very cheap to store data,” she continued. But the cost of getting that data can be prohibitive. If it arrived without permission, turned out to be something you wanted to get rid of because you didn’t need it some time ago, and now you’ve received a request for it, and you still have it—that puts you in a difficult situation.