Digital payments are the standard for millions of women of childbearing age. So what will their credit and debit card issuers and financial app providers do when prosecutors request their transaction details during abortion investigations?
It’s a hypothetical question that is almost certainly inevitable in the wake of Roe v. Wade’s overthrow last week. With abortion illegal in several states, detectives will soon be looking for evidence to prosecute those they believe have broken the law.
Medical records are probably the most definitive proof of what is now a crime, but officials who can’t get them can look elsewhere for evidence. The payment process probably has a high priority.
This seems to be quite new territory for banks and other payment companies on the receiving end of criminal investigations. Card issuers have become accustomed to requesting user data in investigations into terrorism, money laundering and illegal trade. None of these have provoked the kind of political, legal and emotional backlash that abortion studies are likely to provoke.
The Fourth Amendment protects individuals from government interference. But that protection weakens once individuals voluntarily share information with a third party, legal experts say. That means law enforcement officers can generally ask financial institutions to hand over customer data with a simple subpoena.
Even sensitive health and medical details can be fair game. The Health Insurance Portability and Accountability Act, known as HIPAA — which governs the privacy of a patient’s medical records — allows medical and billing information to be released in response to a warrant or subpoena.
“There is a very broad exception to HIPAA law enforcement protections,” said Marcy Wilder, a partner and co-head of the global privacy and cybersecurity practice at Hogan Lovells, a law firm. But Ms. Wilder added that the information shared with law enforcement officers should not be too broad or unrelated to the request. “That’s why it’s important how companies and health insurers interpret this.”
Card issuers and networks like Visa and Mastercard generally don’t have itemized lists of everything people pay for when they buy drugs or other medications online, or when they buy services from health care providers. But proof of patronage from, say, a pharmacy that only sells abortion pills can give someone away.
At the same time, according to lawyers and privacy experts, if a researcher has collected other data about a person’s travels, being charged, say, an out-of-state Planned Parenthood for an amount much higher than a standard check would be helpful evidence. , depending on the laws in play and how they develop over the coming months. The same goes for a patient living in a state where abortion pills are illegal, who seeks them out through a telehealth visit with an out-of-state doctor.
Some financial institutions are preparing to push back requests for this data.
Amalgamated Bank, based in New York, is one.
“Amalgamated Bank will carefully investigate all subpoenas for information related to the prosecution of women for exercising their right to choose and object,” the bank said in a statement. It plans to notify customers of these subpoenas unless investigators manage to force the bank not to disclose the subpoena’s existence.
Law enforcement officers can also pursue subpoenas from companies that issue debit cards onto which flexible spending dollars are loaded. Many employers offer such health care expense accounts.
HealthEquity, a leading administrator of these accounts, said it was reluctant to disclose transaction data. The company “will not comply with requests for medical expense data — including from law enforcement and other government agencies — unless we are specifically compelled by law to do so,” Jon Kessler, its CEO, said in an email. “We try to apply the strictest interpretation of what is required and would vigorously oppose any request to search broadly on member data.”
The New York Times reached out to about two dozen major financial companies — including several that have announced plans to reimburse workers for abortion-related costs — to ask how they would address data privacy around abortion.
American Express, Citigroup, Coinbase, Frost Bank, JPMorgan Chase, Mastercard, 1199 SEIU Federal Credit Union, Visa and USAA declined to comment.
“I can’t speculate about the situations you describe,” said Bill Day, a spokesperson for Frost, which is based in San Antonio and is one of the 50 largest banking companies in the United States. “They’re all hypothetical at this point.”
USAA also declined to discuss how and whether it instructs bank employees to handle customer conversations. It is based in Texas, where a new state law authorizes residents to file lawsuits against anyone who helped facilitate an abortion.
“Since the ruling came out only late last week, it is premature to understand the full impact at the state level,” Brad Russell, a spokesperson for the USAA, said via email. “However, USA will always comply with all applicable laws.”
American Airlines Credit Union, Bank of America, Capital One, Discover, Goldman Sachs, Prosperity Bank USA, Navy Federal Credit Union, US Bank, University of Wisconsin Credit Union, Wells Fargo, and Western Union failed to return at least two messages asking to comment.
American Express, Bank of America, Goldman Sachs, JPMorgan and Wells Fargo have all announced their intention to reimburse employees for expenses when they travel to other states for abortions. So far, no one has commented on how they would respond to a subpoena to obtain the transaction details of the employees who would be eligible for a refund from the employer.
It is not surprising that so many financial service providers are silent. Like almost everyone else, they scramble to navigate a landscape that has completely changed. The American Bankers Association also declined to comment.
Then there are the digital payment services that cross the line between technology and finance: Apple Pay; PayPal and its Venmo offering; and Square and its Cash app.
None of the companies responded to at least two messages requesting comment.
Alejandra Caraballo, a clinical instructor at Harvard Law School’s Cyberlaw Clinic, read these companies’ user agreements with her students for a recent course. “We came to realize that they are all essentially bad,” she said. “They have all said they will comply with the legal process and hand over documents through a warrant or subpoena.”
Tech companies have more experience deliberating whether or not to resist subpoenas for users’ private data. In comparison, financial services firms have generally not experienced as much complexity as new forms of payment are not nearly as common as new forms of communication, many of which introduce new legal questions and the potential for outrage from consumers and others.
Abortion rights and privacy activists prepare for battle.
“I think everyone, including these companies, is trying to figure out what can be done,” said Dana Sussman, acting executive director at the National Advocates for Pregnant Women. “One thing we hope to do is put public pressure on them to fight these subpoenas. If they do, it will be a lot harder for these prosecutors, who have limited resources and a lot of work to do in their community with other cases.”
Amie Stepanovich, vice president of U.S. policy at the Future of Privacy Forum, a nonprofit focused on data privacy and protection, said warrants and subpoenas can come with gag orders, preventing companies from even warning their customers that they are being examined .
“They can choose to challenge the use of gag orders in court,” she said. “Sometimes they win, sometimes they don’t.”
In other cases, prosecutors can’t say exactly what they’re investigating when they ask for transaction details. In that case, it is up to the financial institution to request more information or find out for itself.
Paying for abortion services with cash is a possible way to avoid detection, even if it is not possible for people who order pills online. Many abortion funds pay on behalf of people in need of financial assistance.
But cash and electronic money transfers aren’t completely foolproof.
“Even if you pay cash, the amount of residual information that can be used to reveal health and pregnancy status is quite significant,” said Ms. Stepanovich, referring to possible breadcrumbs such as using a retailer’s loyalty program or location tracking on a cell phone. when making a cash purchase.
In some cases, users can inadvertently provide sensitive information themselves through apps that track and share their financial behavior.
“Purchasing a pregnancy test on an app where financial history is public is probably the biggest red flag,” said Ms. Stepanovich.
Other proponents mentioned the possibility of using prepaid cards in fixed amounts, such as the kinds that people can buy from a rack in a drugstore. Cryptocurrency, they added, usually leaves enough traces that achieving anonymity is a challenge.
One thing every expert emphasized is the lack of certainty. But there’s an emerging gut feeling that companies will be in the spotlight at least as much as judges.
“Now these payment companies are leading the way,” said Ms. Caraballo.