Is Idaho pregnancy center keeping patient data private? Complaint asks AG to investigate

In our Reality Check stories, Idaho Statesman journalists seek to hold the powerful accountable and find answers to critical questions in our community. Read more. Story idea? Tips@idahostatesman.com.

A Washington, D.C.-based ethics watchdog group has filed a complaint against an Idaho pregnancy center urging the state attorney general’s office to investigate the center’s use of private health data.

The Campaign for Accountability filed complaints in five states about pregnancy centers, including Sage Women’s Health Center in Twin Falls. The Idaho complaint said Sage mimics the offices of physicians and collects “sensitive personal and health information” typically protected by federal data privacy law — but the facility is not bound to comply with that privacy law.

The complaints said the pregnancy centers — all of which are affiliated with anti-abortion rights networks — claim to comply with “HIPPA,” a misspelling of the abbreviation for the Health Insurance Portability and Accountability Act.

While the Idaho complaint, which was filed April 23, doesn’t allege any misuse of medical information by Sage Women’s Center, it asks the attorney general’s consumer protection division to delve deeper into what the nonprofit does with patient data.

“We are deeply concerned about the way that women are being deceived about where they are and what might happen with their data,” Campaign for Accountability Executive Director Michelle Kuppersmith told the Idaho Statesman in a phone interview.

Sage Women’s Center did not respond to requests for comment on the complaint. The Attorney General’s Office told the Statesman Tuesday morning that it does not comment on pending investigations.

Idaho facility claims, then denies HIPAA adherence

On its website, Sage Women’s Center asks its patients for information about their menstrual periods, contraceptive use, pregnancy status and more using patient intake forms and other documentation it receives as an affiliate of Care Net, a Christian nonprofit that opposes abortion rights. The Campaign for Accountability told the Statesman all the facilities it filed complaints about are affiliates of Care Net.

Care Net did not respond to a request for comment.

Sage is one of more than a dozen pregnancy resource centers — also called crisis pregnancy centers — in Idaho, and one of more than 1,200 affiliated with Care Net. Such businesses have long drawn criticism from abortion rights advocates and medical associations, which say the centers deceive pregnant patients into appointments, then dissuade the patients from abortion, sometimes with medical misinformation.

Several other Idaho facilities are also affiliated with Care Net or its partner organization Heartbeat International, including Lifeline Pregnancy Care Centers in Nampa and Caldwell, Compassion & Hope Pregnancy Center in Pocatello and more in Central and North Idaho.

Sage’s website says it provides pregnancy testing and ultrasounds. A ”pregnancy options” tab on the website lists parenting, adoption and abortion. Though Sage does not offer abortions, which are illegal in Idaho now in most instances, its website invites pregnant women to make an appointment to talk about the procedure.

Sage Women’s Center is not recognized by the Idaho Department of Health and Welfare as a medical facility, but the Campaign for Accountability said Sage’s appointment process and attestations to medical privacy appear similar to those at doctors’ offices.

On several pages of its website, Sage says it is “HIPPA” compliant, though its privacy policy notes that the nonprofit is not actually beholden to the law, which requires certain health care providers and businesses to inform patients and get their consent before disclosing medical information to third parties.

“Because we are a medical care provider that does not engage in any transactions that invoke coverage of the HIPAA privacy act, the privacy practices and terms described in this notice are voluntarily undertaken,” the policy states.

The Campaign for Accountability complaint said Sage’s privacy policy is much harder to find on its website than its promises of HIPAA compliance, making it difficult for patients to know how their personal data could be used.

Kuppersmith said invoking HIPAA is a direct nod to the idea of privacy.

“HIPAA is sort of a shorthand for protection of your data,” Kuppersmith told the Statesman. “People see that and they think it means that their data can’t be shared.”

Instead, the policy informs patients that they can request limitations on how or where Sage Women’s Center shares their health information.

“We will consider your request, but we are not legally bound to agree to the restriction,” the facility’s privacy policy states.

Idaho AG quiet on possible investigation

The Campaign for Accountability complaint asks the attorney general’s office to look into potential conflicts between Sage’s practices and the Idaho Consumer Protection Act, which bans “unfair or deceptive” advertising and other business practices. The watchdog group said Sage is violating that law by promising to comply with HIPAA, only to reveal in other documents that it does not.

The complaint also says it’s not clear what Sage is doing with the data it collects from patients. The group told the attorney general that it’s possible Sage is sharing patient information it has “misrepresented as confidential.”

Kuppersmith pointed out that Sage Women’s Center and other facilities may be trying to follow federal privacy requirements, but there’s no way to be sure they’re doing so effectively. The U.S. Department of Health and Human Services oversees HIPAA compliance, but it does not look at facilities that are not legally obligated to follow its rules.

“That means that no one is checking if these centers are actually HIPAA compliant,” Kuppersmith said. “So they might be, in their own mind, voluntarily complying with HIPAA regulations that exist, but there is no audit or anyone regulating whether or not they are actually complying.”

The Campaign for Accountability said late last week that it had not received any communication from the office of Attorney General Raúl Labrador — a Republican who opposes abortion rights — regarding its complaint or the possibility of an investigation. Attorney General’s Office spokesperson Dan Estes told the Statesman the office sent a letter of acknowledgment late last week.

Kuppersmith told the Statesman the watchdog group hopes to see Sage Women’s Health remove language guaranteeing health care data privacy from its website.

“We think, at the very least, the center should not be allowed to continue to deceive women in this manner,” she said.

This story has been updated to include comments from the Idaho Attorney General’s Office.