S. 4920: Secure Access for Essential Reproductive Health Act of 2026

This bill would add specific privacy protections for health information related to pregnancy termination or loss, including abortion, miscarriage, stillbirth, and ectopic pregnancy.

What it would do

• It would generally bar health care providers, health plans, and their contractors from disclosing “pregnancy termination or loss information” in federal, state, local, tribal, civil, criminal, administrative, legislative, or other proceedings unless the person’s valid authorization is obtained.
• It defines this information broadly to include data that could reveal someone had or sought abortion care or care related to pregnancy loss, including requests for or receipt of services, counseling, education, or referrals.
• It would create limited exceptions allowing disclosure:
  • when needed to defend a professional liability or malpractice case against the covered entity or business associate, and
  • when needed to investigate physical harm done to the individual by another person directly related to the pregnancy loss or termination, if the individual cannot consent because of death or incapacity.

Changes to health IT rules

• The bill would direct the Department of Health and Human Services to revise HIPAA/HITECH regulations so that refusing to access, exchange, or use electronic health information, when necessary to comply with this privacy rule, would not count as “information blocking” for pregnancy termination or loss information.
• It would also require certified health IT developers to build in data-segregation practices that help separate this type of information so it can be handled in a way that complies with the bill.

State law and preemption

• The bill would override state laws that conflict with its rules.
• At the same time, it would allow states to keep or enact stronger privacy protections for this information.
• It would also revise HIPAA preemption rules so that, for this category of information, only the exception allowing stronger state privacy protections would remain.

Implementation

• HHS would have to issue an interim final rule within 90 days of enactment.
• After public comment, HHS would have to issue a final rule within 270 days after the interim rule is published.
• HHS would also have to run an outreach campaign to inform covered entities, business associates, the public, and affected individuals about the new rules.

Relevant Companies

• EPIC (Epic Systems is privately held; no public ticker)
• ORCL — Oracle, through its health IT and data systems business, may need to support new data-segregation and privacy compliance features.
• ATHN — athenahealth is privately held; no public ticker
• GEHC — GE HealthCare may be affected if its software products used in clinical settings need compliance-related updates.
• ELV — Elevance Health, as a large health insurer, could need to adjust how it handles and discloses related protected health information.
• UNH — UnitedHealth Group, through its insurance and health data operations, could face similar compliance changes.