When the Supreme Court effectively overturned Roe v. Wade in the summer of 2022, the political repercussions that followed were visible and high profile. Fierce ballot fights in Kansas, Ohio and Michigan; the election of a new liberal justice to the Wisconsin Supreme Court; court cases to prevent the dissemination of mifepristone; and proposed state legislation to prevent interstate travel have been well-publicized. 

What is probably less well-known, is just how much of an impact the overturning of Roe v. Wade will have on health and wellness marketing. Neither federal regulatory agencies nor states have been sitting quietly by in the wake of the Supreme Court’s decision; they’ve been making changes. 

And the rules around what even counts as health data, and how it can be used, are shifting rapidly. While marketers might make distinctions between health and wellness marketing, the traditional distinctions between the underlying data being used is being very blurred right now. And for health care marketers, it’s now more important than ever to pay attention to how quickly the rules are changing regarding what is and is not protected health data, and how it can and cannot be used. 

In the immediate aftermath of Roe, the White House directed regulatory agencies to start assessing what could be done to protect women's health care information or any proxy that could be used as such.  

Since then, Health and Human Services (HHS) has introduced new guidance around online tracking technologies, narrowing the scope of how HIPAA-covered entities can use consumer’s online data, and the Federal Trade Commission (FTC) has proposed a new rulemaking around something called the Health Breach Notification Rule (HBNR) to prevent unauthorized data sharing and further reign in the use of any health data not explicitly covered by HIPAA. 

States are not sitting on the sidelines. In 2023, Washington state passed the first state comprehensive health data privacy bill with its “My Health, My Data Act” or MHMDA. Worth highlighting, MHMDA contains a private right of action. While MHMDA was not the first discrete health data privacy bill ever passed by the states, to date it does appear to be the most far reaching and impactful for marketers. 

The bill drafters made it very clear that MHMDA was meant to respond to the Dobbs decision. Nevada also passed a similar bill, although a bit narrower in scope. New York passed a new law that, while more limited than Washington or Nevada, does specifically prohibit any geofencing around any “health care facility” within a defined radius. Some states, such as Connecticut, amended their existing comprehensive privacy law to include new protections for health data. Many states with comprehensive privacy laws have definitions of “sensitive” information that include aspects of health data. 

Already in 2024, new states have introduced bills dealing with health data. 

If there’s one takeaway to all this, it’s this: While Dobbs was very much the catalyst for the new wave of laws and regulations being seen around health data, it’s increasingly clear that consumer concerns around the use of health data go far beyond the divisive issue of abortion. 

Marketers should be aware of all the changes taking place right now around the use of health data but should also keep in mind the “Jurassic Park” rule—just because you can, doesn’t mean you should. 

While the intricacies of any application of the new laws, regulations and enforcement actions will be fact-specific to each use case, there are some high-level guideposts to keep in mind, namely:

• If your company hasn't yet started, start working on any needed compliance with state comprehensive privacy laws. There are already 15 different state comprehensive privacy laws passed, although they are not all yet in effect. If you’ve been employing the ostrich approach on dealing with anything privacy, this is a good place to start. There are plenty of quality third-party vendors and experts who can help.
• Pay close attention to definitions in the new laws and regulations, even if you already think you know what they mean. Definitions including “consumer health data,” “covered data,” “health care services” and “consent” can have shifting meanings in ways not previously seen. 
• Pay attention to and understand the new restrictions regarding geofencing restrictions around health care facilities—this is an area of heightened sensitivity. 
• Read the FTC’s enforcement actions in cases such as BetterHelp and GoodRx. The FTC is outlining a lot of specific concerns it has regarding the sharing of certain types of health data. 

The 4A’s and the Coalition for Healthcare Communication have recently released a joint paper, “Navigating the Health Data Privacy Landscape,” a guide to help our agency partners better understand the compliance space around health care and data privacy. 

Given the pace of change of the various new laws, regulations and enforcement actions in play, it will likely take some time before industry has a good idea of what compliance means. In the interim, erring on the side of ethics first, and guessing at the letter of the law second, is probably a good idea.