Executive Summary

  • As states go head-to-head on abortion access, medical and financial recordkeeping requirements endanger abortion providers and funders, even in states with strong abortion shield laws.

  • States that protect reproductive rights must strengthen laws that prohibit abortion-related data disclosure and protect telemedicine abortion access.

  • These laws are under test as Texas sues a New York doctor in a first, extraordinary attempt to enforce a state abortion ban beyond state lines.

  • In the coming years, we will likely see growing weaponization of these records to prosecute telemedicine abortion access and out-of-state patient care.

I.              Introduction

Nineteen states have effectively shuttered all abortion clinics.[1] Growing numbers of doctors in more conservative jurisdictions have to choose between delivering needed obstetrical care and potentially losing their licenses or even their liberty.[2] This bleak landscape is driving abortion seekers to travel out of state for abortions, and, increasingly, to seek telemedicine abortion care from out-of-state providers. But even doctors offering this vital care from progressive places face ominous threats.

Penalties for providing abortions range from fines and medical license revocation to imprisonment—Louisiana, for example, mandates one to ten years of hard labor.[3] Not only do many states impose onerous penalties on abortion providers, Texas, in a first, is attempting to enforce its penalties out of state: in December 2024, it sued a New York doctor for allegedly providing telemedicine abortion support to a Texas patient.[4] This case tests the power of New York and other progressive states to protect abortion access.[5] And additional challenges to telemedicine abortion loom. Texas legislators recently proposed targeting medication abortion “distribution networks” and funders with broad criminal conspiracy liability.[6] Abortion opponents are urging the incoming Trump administration to enforce a dead letter law that could shut down telemedicine abortion entirely.[7] Drug-sniffing dogs already practice rooting out medication abortion pills in Jackson, Mississippi post offices.[8] Come January, anti-abortion forces can be expected to redouble these efforts.

To map out current and emerging threats to telemedicine and interstate abortion access, S.T.O.P. interviewed numerous telemedicine providers operating under state shield laws that protect abortion providers (“shield clinics”); abortion funders in states that effectively ban abortion; and a representative of an abortion information text line. Additional insights came from Julie F. Kay, executive director of the Abortion Coalition for Telemedicine Access (“ACT Access”); Kat Green, a cybersecurity expert who supports abortion clinics under attack; Susanna Birdsong, General Counsel and Vice President of Compliance at Planned Parenthood of the South Atlantic; and Jolynn Dellinger, a legal scholar focused on privacy law and reproductive justice.[9]

II.            Background: Federal and State Abortion Access Protections

In April 2021, the Food and Drug Administration (“FDA”) dramatically improved access to abortion medication. The agency permitted medical professionals to remotely prescribe and dispense mifepristone, an abortion medication that blocks a hormone needed for pregnancy development.[10] The previous in-person pick-up requirement needlessly increased patients’ risk of becoming ill with COVID-19: after 20 years on the market, the drug’s safety was beyond dispute.[11] Since then, medication abortions have risen to account for nearly two-thirds of all abortions in the US.[12]

The FDA’s changes took on vital new import for out-of-state telemedicine providers when the U.S. Supreme Court overturned Roe v. Wade the next year. With sweeping state abortion bans in place, clinic closures, and out-of-state clinics difficult to reach, medication abortion often became the only realistic abortion option.[13] Following Roe’s repeal, eight states passed shield laws aiming to protect medical practitioners providing telehealth medication abortions to patients in states that criminalize abortion.[14] These laws typically pledge to preserve practitioners’ medical licenses and malpractice insurance; prohibit local cooperation with out-of-state prosecutions, including blocking data sharing; refuse to extradite medical practitioners; and protect practitioners from subsequent legal judgments.[15]

This has been enough to embolden four shield clinics to defy abortion bans and serve, via telemedicine, patients who cannot obtain abortions in their home states. The process is safe, affordable, and easier than a clinic visit. Patients use video calls, phone, or secure text messaging to determine eligibility and get medication instructions.[16] As with in-person appointments, providers screen patients for known risk factors for the medications, which are rare.[17] Shield clinics prescribe and discretely ship pills to patients, allowing them to self-manage their abortions at home, before scheduling a follow-up call.[18] Shield clinics now serve thousands of patients in states that effectively ban abortion each month:

Telemedicine providers from shield states are providing 12,000+ abortions a month to women and pregnant folks in states where abortion is banned, restricted, or inaccessible.
— ACT Access Executive Director Julie F. Kay [19]

III.          Required Reporting Creates Federal and State Abortion Registries

Shield clinics and abortion funds are painfully familiar with abortion surveillance. They know that prosecutors mine pregnant people’s data—their messages, internet search histories, online purchases—for abortion evidence.[20] They know that anti-abortion extremists stalk, dox and threaten clinicians, tracking down abortion patients and their families.[21] They are painfully aware that shield laws’ protections are limited, and so far unproven, even as Texas’s abortion ban and New York’s shield law go head to head.  

So, these organizations prioritize privacy. They limit data collection, retention, and publication. As a lawyer who works with abortion funds told S.T.O.P., “the most important move that funds can make is just not collecting that data in the first place, particularly when it comes to callers but also for themselves.”[22] They embrace robust data compartmentalization: when privacy expert Kat Green works with abortion providers, for example, she tells them to “compartmentalize all of their critical workflows,” including keeping financial data on servers separate from human resources data, which “includes job descriptions, and describes where employees live and how to contact them.”[23] Providers migrate to hardened platforms, like secure messaging apps. Even then, they protect employees by providing information on a need-to-know basis. As the director of an abortion information service told S.T.O.P., “by the time our text line messages get onto [the next platform], none of the volunteers know the identifying information or phone number of the texter.”[24]

But by law, abortion providers and funders must generate, retain, and report a wide range of data. In a world where every pill bottle is potential evidence, prescriptions still must be accurately labeled.[25] Patient records must be retained, often for years.[26] And abortion records must be reported to central authorities, creating an effective registry of abortion patients. In 46 states and Washington, DC, abortion providers must report barely deidentified data on individual abortion recipients, including patients’ characteristics (e.g., age, city, race) and the gestational stage of their pregnancies to the state department of health.[27] Other states add additional details like patients’ reasons for seeking an abortion, which, like gestational stage, can be weaponized by anti-abortion litigators; some also add patients’ payment methods, implicating abortion funders.[28] Anti-abortion zealots from Seattle to Pennsylvania have repeatedly attempted to force health departments’ abortion records into the open using public records requests.[29] In some places, it is freely available: Florida’s health department features abortion data aggregated by patients’ reasons for terminating their pregnancies on its “Most Requested Data” page.[30] Worse yet, should the next federal administration choose to target abortion seekers, they can get nearly all the data they need from the Centers for Disease Control and Prevention (“CDC”)—almost all states voluntarily share their abortion data with the CDC, and there are efforts underway to mandate abortion and pregnancy tracking at the national level.[31]

In a different line of attack, Louisiana has intensified abortion surveillance by classifying medication abortion drugs as controlled substances.[32] Texas may soon follow suit—legislators there have filed a bill mirroring Louisiana’s law.[33] Prescriptions for scheduled drugs must be tracked through a state Prescription Drug Monitoring Program, which the Drug Enforcement Association (“DEA”) maintains in all 50 states and which law enforcement can access, sometimes with less than a subpoena.[34] Originally intended to combat the opioid crisis, the Prescription Drug Monitoring Program’s prescription registries collect identifying data for prescribers and patients, including names, addresses, birth dates, and even photo ID (drivers’ licenses).[35]

These databases are not passive repositories of prescriber and patient information. Sophisticated surveillance software ranges over their data, analyzing prescribing practices, looking for patterns, and pushing alerts on “high-risk” prescribers and patients to oversight and regulatory entities.[36] At present, almost all states share their prescription registries with neighboring states and the federal government.[37] Should more anti-abortion states schedule medication abortion drugs, their investigators’ broad access to states’ scheduled-drug registries could drive telemedicine shield clinics into extinction.

This is not a novel scenario: states already surveil individuals seeking gender-affirming care through scheduled-drug registries. Individuals who take testosterone are subject to surveillance by all fifty states’ Prescription Drug Monitoring Programs because testosterone is a controlled substance.[38] Because testosterone is scheduled, patients’ access to the drug is also in limbo: providers’ ability to prescribe the drug via telemedicine is only assured through the end of 2024.[39] The incoming federal administration could easily prevent many people from accessing gender-affirming and abortion care by barring telemedicine providers from prescribing controlled substances. 

IV.          Required Financial Surveillance Threatens Abortion Access

Payment is the one issue we haven’t figured out. If there is a way to anonymously buy something on the internet, I don’t know what it is
— Anonymous Shield Clinic Provider [40]

Clinics do everything in their power to make abortion financially accessible. They ask patients to pay according to their means, accepting as little as $0 to $5 from each.[41] To collect these payments and supporters’ donations, they partner with online payment processers and maintain bank accounts. But opening these essential accounts subjects a clinic to comprehensive financial surveillance, as required by law—and to the possibility that its financial records will be used against it or its patients.

Financial institutions must comply with federal regulations authorizing comprehensive surveillance of financial transactions in the United States. To comply with the Bank Secrecy Act (1970), they must actively surveil all transactions that they facilitate and file “suspicious activity reports” on any that may break the law, which banks could interpret as including transactions related to acts of medical civil disobedience.[42] And it’s worse than that: post-9/11, surveillance of financial transactions intensified in an attempt to identify money-laundering for terrorism. Section 314(a) of the USA Patriot Act of 2001 encourages law enforcement (including state and local police) to send the names of suspicious individuals and organizations to the U.S. Treasury, which vets those lists and pushes them to “37,000 points of contact at more than 16,000 financial institutions” with the expectation that they flag transactions involving the listed parties.[43] Should the incoming federal administration target shield clinics or abortion funds, they’ll be subject to nationwide financial dragnets. Because their patients and donors can’t make anonymous purchases online, they will be caught up in the dragnet as well.

Once targeted, abortion providers and funders have little or no expectation of privacy in their financial records. In 1976, the Supreme Court ruled that that since the Fourth Amendment doesn’t protect documents that a person voluntarily shares with another party—in this case, their bank—checks, deposit slips and other bank records don’t require a warrant for access.[44] Congress dialed back warrantless access to bank records with the Right to Financial Privacy Act (1978), but the law leaves ample leeway for law enforcement access: a subpoena from a judge in an anti-abortion state will unlock records that implicate clinicians, funds, patients, and donors.[45]

Financial Deplatforming

That is when financial institutions don’t shut down telemedicine abortion clinics entirely by dropping them as clients. Financial surveillance laws like the Bank Secrecy Act impose hefty penalties for non-compliance: in addition to “civil money penalties,” individuals and organizations can be criminally charged for facilitating activity that they know or should know is illegal.[46] Financial institutions have responded by taking the easy way out. Instead of managing risk, they systematically close the accounts of abortion clinics, humanitarian organizations in conflict zones, sex workers, and other clients deemed to pose more risk than their business is worth.[47] This eagerness to drop clients has created a potent weapon against financial access for shield clinics, who are routinely dumped from payment platforms. “We’ve been kicked off of Square, off of Stripe, for breach of contract,” a shield clinic doctor told S.T.O.P.[48] One platform cited “vague legal concerns,” even after the doctor reached the company’s upper management. Another wrongly claimed that she was selling marijuana.

Cut off from Abortion Funding

Meanwhile, financial surveillance fears prevent abortion funders who want to subsidize telemedicine abortion from contributing. Shield clinics don’t yet receive much funding from abortion funds. As Kay explained, “the major abortion funds are not providing significant funding for telemedicine, either in-state or across state lines.” Half of the problem is that abortion funds in states that restrict abortion can’t risk it: violating local abortion laws could shut down an entire fund. As the co-chair of one abortion fund told S.T.O.P., its undocumented clients need abortion services that come to them—which is to say, they need medication abortion—because they reside in a region whose border control checkpoints on highways create a locked zone for undocumented people. But all of the fund’s monies must go toward out-of-state abortions, lest the organization give the attorney general a reason to investigate. Another abortion fund director described a similar dilemma: because the state prohibits telehealth for abortion, the fund simply can’t subsidize it, no matter the need.[49] In yet another state, an abortion information service described being unable to connect minors to funding offered by out-of-state abortion funds for fear of violating the law.[50]

“If Texas succeeds in its attempt to enforce Texas law in New York, other states will join the effort to block abortion access.”

V.             Recommendations: Expand Shield Law Protections and Fund Shield Clinics

If Texas succeeds in its attempt to enforce Texas law in New York, other states will join the effort to block abortion access. Unless and until reproductive rights are constitutionally enshrined again, states that support reproductive rights must counter these efforts by bolstering and broadening their shield laws, and by funding telemedicine abortion adequately.  

All shield laws should explicitly cover medication abortion delivered by telemedicine. Medication abortion is the predominant form of abortion in the United States, making up 63% of abortions.[51] It is the only form of abortion readily available to residents of states that ban or restrict abortion. But while more than a dozen states have some form of shield laws protecting providers from liability when performing abortions in-state, only California, Colorado, Maine, Massachusetts, New York, Rhode Island, Vermont, and Washington protect shield clinics by shielding abortion providers regardless of patient location.[52]

States with shield laws should offer one another reciprocity, the mutual recognition and respect of their abortion laws and privileges.[53] In interviews with S.T.O.P., shielded clinicians uniformly reported avoiding travel to or through states that restrict abortion, given the risk of being detained and investigated. The risk is reduced but real when they visit other shield states: can clinicians who practice shield law telemedicine in New York safely cross the river to New Jersey, whose shield law doesn’t cover out-of-state clinicians or telemedicine? This is a live question as Texas pits its abortion ban against New York’s telemedicine shield law. States should amend and clarify their shield laws to assure shielded clinicians that they can travel out of state without risking their medical practices or their freedom.

States must also ensure that shield laws cover all parties necessary to provide, fund, and publicize the availability of shield clinics’ services. Abortion funders are critical: requests for assistance to funds rose nearly 40% in the year after Roe was overturned.[54] Demand outstrips funds’ resources. But most abortion funds in shield states do not fund telemedicine abortion—a safe, convenient, less expensive alternative to transporting patients across state lines—in part due to inertia, interviewees told S.T.O.P., but also because it is not clear that shield laws will protect them. Pro-abortion states must include abortion funds in their scope of protection, so that funds can subsidize telemedicine for out-of-state patients.

States should amend or clarify their shield laws to cover pharmacies. Shield clinics purchase medication in bulk, repackage it, and distribute it to patients—a role delegated everywhere else in the U.S. medical system to pharmacies. Honeybee Health appears suited and potentially willing to assume this role for shield clinics: in an amicus brief to the U.S. Supreme Court, it describes itself as “the largest mail-order pharmacy in the United States to deliver mifepristone to patients…almost uniformly in conjunction with those patients’ receiving telehealth services.”[55] But the pharmacy needs to know that its home state, California, will protect it under the state’s shield law if it distributes medication abortion pills to residents of abortion-restricting states.[56]

Shield laws should cover payment processors, advertising companies (including social media firms), website hosts, and other non-medical companies vital to telemedicine abortion. Shield clinics cannot operate sustainably unless they can collect patients’ modest payments, but they are routinely dropped without explanation by the country’s dominant payment processors. The rare financial organization that provides banking services for abortion clinics, like the Piggyback Funding Platform, should be encouraged and protected by shield law.[57]

Shield laws should protect website hosting and advertising companies. Shield clinics, abortion funds, and abortion information services struggle to share accurate and helpful information to patients about telehealth and medication abortions in the face of social media bans and website censorship. They are routinely blocked by social media platforms, including Facebook, Instagram, and TikTok, which remove their content or blur and disparage posts as possibly containing “graphic or violent content.” [58] (“Only the most persistent and tech savvy are able to find telemedicine abortion from shield states,” added Kay. “Plan C and AidAccess and others at times have been blocked from Google after being mischaracterized as doing something illegal. Once a tech company decides to block something, you might as well be dealing with Delta Airlines on a stormy night.”[59]) Clinics are even threatened for maintaining their own websites: Arkansas’s state attorney general challenged medication abortion providers for describing their services on their websites, leading a New York-based provider to alter its website to avoid possible penalties for, as the attorney general put it, “advertising the availability of abortion-inducing pills to Arkansans in contravention of [its] laws.”[60] Shield-law states can’t stop these reprehensible maneuvers, but they can give vendors in their own states legal cover to provide vital publicity services to shield clinics.

“Shield-law states can’t stop these reprehensible maneuvers, but they can give vendors in their own states legal cover to provide vital publicity services to shield clinics.”

Two states approach this standard and could serve as a model. California’s shield law prohibits electronic communication services companies like Facebook from complying “in California” with law enforcement investigations that they know or should know are related to abortion.[61] Washington state’s shield law goes a step further, prohibiting Washington-based companies from assisting out-of-state abortion investigations anywhere—i.e., regardless of whether their data is “in Washington” or elsewhere.[62]

Additionally, to ensure timely, safe, and affordable abortion access within states and across state lines, states must fund medication abortion delivered via telemedicine. Telemedicine is an integral part of abortion access in the US. It is equally underfunded. As Kay points out, “New York has $25 million going to abortion providers in the state. None of that is going to telemedicine.”[63] The same is true for most major abortion funds, whose “grant model needs to catch up to where the demand is.”[64]

Lastly, states must begin to comprehensively reevaluate different medical, financial, and travel recordkeeping requirements that are poised to be weaponized against abortion seekers, providers, and funders. While states cannot preempt federal recordkeeping mandates, they can dismantle their own mandates, ensuring that providers can better dispense this vital medication to those in need. It will take years to tear down the far-flung surveillance infrastructure that states have built up over decades to monitor our banks accounts and prescriptions, but this moment shows the urgent need to systematically roll back these readily abused systems and ensure that their jurisdictions can be a safe haven for those seeking care.

VI.          Conclusion

Shield clinics and abortion funds extend abortion access across the nation at considerable risk to their employees. They mitigate but cannot eliminate this risk through careful data practices. States that support reproductive rights must do more to harden abortion access by bolstering their shield laws and setting aside dedicated funding for telemedicine.

Social Media Graphics