Report: States strengthen shield laws to protect abortion and gender-affirming care data
AndreyPopov via Getty Images
As patients seeking reproductive and gender-affirming care increasingly are using telehealth to do so, states are increasing protections for patients’ and providers’ health care data.
As the reliance on telehealth services grows across the U.S. — and that care increasingly crosses state borders — a new report has found that states are creating policies to protect their residents’ sensitive health data. Whether such laws will be effective in interstate investigations or other legal proceedings has yet to be proven, one expert says.
As of last year, twelve states adopted or updated existing data protections to expand the scope and reach of shield laws, regulations aimed at protecting residents in one state from prosecution or disciplinary action from another, according to a report released last week from the Center for Democracy and Technology.
In recent years, particularly amid states’ increasing reliance on telehealth, “you're seeing states experiment, build and learn from each other based on their best practice,” when it comes to closing gaps in their shield laws, said Tom Bowman, policy counsel with CDT’s security and surveillance project.
As an example, he pointed to Massachusetts, which passed a bill passed in June that expands upon similar shield laws from other states. Six states already restrict businesses — such as medical facilities or providers of communication services — that are incorporated or have a place of business in the state from sharing or disclosing health care data, according to Bowman.
But Massachusetts’ bill extends data protections to also include entities “merely” conducting business in the state, establishing more comprehensive “limits on when you can collect, retain and redistribute” data related to reproductive or gender-affirming care, he explained.
“Frankly, a lot of shield laws are still in their infancy, and [states] are in a period of great exploration,” Bowman said. “Shield laws are quickly starting to grow from being these basic substantive protections to actual data regulation or data governance regimes.”
Nine states have updated their shield laws to explicitly apply to patients regardless of their location in relation to a provider from whom they receive virtual care, according to the report. That means if someone is a patient in a state with an abortion ban, and they seek abortion medication via telehealth in a different state, the latter jurisdiction “is at least going to attempt to cover [them] with their shield law,” Bowman said.
Several states have also imposed stricter limits on how public employees can interact with residents’ reproductive or gender-affirming care data, according to the report. Colorado, for example, enacted a law last April that restricts the collection and disclosure of patient data relating to abortion procedures by state- and local-level government agencies and regulated entities.
New Mexico passed a similar law earlier that month that amends its public records policy to exempt records containing identifying or sensitive information about medical providers who are employed by public entities and perform abortion-related services, the report stated.
Vermont also passed legislation in 2025 that exempts health data related to abortion and gender-affirming care from the state’s public records laws, and it “prohibits health plans, health plan clearinghouses and health care providers who transmit any health information in electronic form from disclosing protected health information that is identifiable or susceptible to reidentification and is related to a legally protected health care activity,” the report stated.
In general, recent policy trends suggest that states are making their shield laws more specific and comprehensive, which Bowman said he anticipates seeing more of in 2026 and beyond. However, it is still uncertain how these state-level shield laws will hold up when it comes to enforceability or legal challenges from other states or the federal government, he said.
But in the meantime, closing gaps in shield laws by making their language more specific and thorough can help alleviate apprehension among patients and providers who may otherwise refuse virtual reproductive or gender-affirming care if they are unsure whether such treatments could result in their legal consequences, Bowman said.
Ultimately, “the safest health data is data that never gets collected in the first place,” he said.
As state officials consider how to protect residents’ data on reproductive and gender-affirming health care, Bowman said policymakers should “highlight the need to have comprehensive medical privacy laws, comprehensive consumer privacy laws and comprehensive health data laws that really make sure that we can all access and exercise our right to health care.”