With the overturn of Roe v. Wade, Justice Samuel Alito went on for pages and pages and pages in his written decision about abortion. It is going to create unbelievable amounts of pain and suffering for women and for the doctors who are attempting to care for them. However, the right on which Roe was decided, and Dobbs acted to disrupt, was a right to privacy.
This is not an article about abortion. It is an article about the right to privacy, and its discontents. I believe there is an opportunity created by the court’s “bull in a china shop” approach to jurisprudence. The overturn of Roe might be the legal precedent to reclaim privacy, both for women, and for all of us. This argument begins with Dobbs, takes a sharp turn at the Change Healthcare cyber attack, and ends up restoring our freedoms after arguing…and I can't believe I'm saying this…in favor of United Healthcare’s rights to get off scott free from a catastrophic HIPAA breach.
That is Doctor Junior Constitutional Law Scholar, to You!
A brief summary of my understanding, as a physician (and not a lawyer), of the legal rationale for a right to privacy in the first place:
There is a lot of focus, particularly in Samuel Alito’s Dobbs decision, on the due process clause of the 14th amendment. I’m gonna rewind us a little bit further, because I think it’s important to anchor this for general audiences—you know, the kind of general audiences who are really interested in the intricate details of constitutional law as interpreted by people who have no training in that field.
There was significant debate among the founding fathers about the necessity or lack thereof of having a bill of rights. They eventually, of course, chose to have one. The first 10 amendments enumerate (e.g. call out by name) specific rights that they wanted to make sure they wrote down in the constitution so that no one would miss them. But the 9th and 12th amendments to the constitution are, to me, the most important.
Article the ninth... The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people. (Emphasis mine).
Article the twelfth... The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people. (Again, emphasis mine).
Our founders were reasonably paranoid, and one of the reasons they didn’t want to write down enumerated rights had to do with not wanting anyone to assume any other rights didn’t exist if they weren’t enumerated. This is why we have a bill of rights not in the constitution itself. But the 9th and 12th amendment basically say that there are a bunch of other rights that the government doesn’t control at the federal level.
More rights exist and are presumed than were explicitly written down at the time of the crafting of this extraordinary document.
This is why, when the Supreme Court made the original Roe vs. Wade decision, it rested upon the interpretation of the constitution that took the due process clause of the 14th amendment and reasoned that this due process clause applied to the unenumerated-as-of-yet right to privacy. This, in turn, allowed them to decide that individual states could not pass laws that would abridge this right. Among these rights was the right to decide on medical care privately, explicitly abortion.
This thought process, no matter whether you’re a constitutional scholar or not, it is basically how “Supreme Court deciding” works. We have a basic scaffold which is both the constitution itself and the rights written down in it and it’s amendments, and the justices are essentially resolving “edge cases” iteratively. Their job isn’t really to say what is or is not a right, its to determine whether the question in front of them has to do with a right that is covered in the scope of the constitution. In the case of some right that is not covered by the constitution, that means throwing it in the bucket of things to be decided by the states, or (sadly, much less frequently) in the bucket of things to be decided by the people themselves. M.C. Hammer’s “You Can’t Touch This” has a similar unavoidable logic.
I’d Like to Enumerate the World a Coke
I have a really basic example which I hope makes this more clear: Let’s say I am really thirsty, and I’d like a Coke. Were I to be prevented from purchasing a Coca-Cola from a vending machine, I could, assuming I was extremely litigious, file a lawsuit.
Let’s say this vending machine is magic and there is no way in which it has any interaction with any interstate commerce. It is in the same state as Coke is manufactured. It is not hooked up to the internet or anything.
I have a right to have my thirst quenched. I know you don’t see the cool satisfaction of a Coke on a hot day in the constitution. There is no presumed legal review necessary to drink a Coke. Coca-Cola is not under the domain of due process. This is an example of a right enumerated to the states or to me as an individual by the 12th amendment.
Now, join me for an insane thought experiment: Imagine I have decided to become a public health zealot and pass a law that permits me to put to death any individual with an abrupt spike in blood sugar resulting from the drinking of a Coca-Cola. To make it even more punitive, any abrupt spike in blood sugar will be presumed to be due to the delicious and thirst quenching— but, regrettably, sugar-soaked—beverage. That spike in blood sugar will be evidence used to put an individual to death for the violation of the No Refreshing Coke Act of 2022. In the state of New York, you can bet that previous administrations would have gone to this length if only they were allowed. I’m looking at you, Bloomberg (j/k).
This sounds insane. But this is actually the situation we are now in with healthcare in America. No one wants to be put to death for getting their thirst quenched, or any other need for that matter. This brings us to the most misunderstood law in healthcare, which we presume has something to do with privacy, and we even more frequently misspell:
The Health Insurance Portability and Accountability Act
In 1996, HIPAA was passed as a federal law. It allowed for both the protections of personal health information and the disclosure of that same personal health information by covered entities. Importantly, this does not include everyone. This is really really really really really important. The following groups are considered covered entities under HIPAA, meaning that they have to comply with this federal law:
Healthcare providers: Every healthcare provider, regardless of the size of their practice, who electronically transmits health information in connection with certain transactions. These transactions include:
Claims:
Benefit eligibility inquiries.
Referral authorization requests.
Other transactions for which HHS has established standards under the HIPAA Transactions Rule.
You’re gonna notice something specific about the above. It applies to all healthcare providers who process transactions as enumerated. That is not all transactions. It’s just transactions that interface with traditional health insurance through benefit eligibility inquiries, authorization requests, and other HIPAA transactions. It doesn’t mean everybody, only the providers who handle those specific transactions.
Let’s say you have a medical practice and you take no insurance whatsoever, you never check benefits eligibility, and you only ever get paid in ways that are not specified. In that case, you would not be considered a HIPAA-covered entity.
This means that the entirety of the law, including the protections around specific health information and the requirements for others to be able to access that information do not apply to this practice. They do not apply to the patients that go to this practice. They do not apply to the health technology this practice uses. They do not apply to the medical records that this practice keeps. Now, in all practicality, there was almost no reason, previously, for anyone to engineer non-compliance solutions.
Until now…