CPC Data Breaches and Congressional Deepfakes

CfA Urges Louisiana Attorney General to Investigate Data Leak at Crisis Pregnancy Center

Many Americans are aware of the Health Insurance Portability and Accountability Act (HIPAA) as a law that protects their private health information, but they may not know that HIPAA typically only applies to providers who bill insurers for their services. Free clinics, such as anti-abortion crisis pregnancy centers (CPCs), have no obligation to comply with HIPAA’s standards—yet frequently deceive women into thinking any health data they share with them is protected under the law.

This week, CfA filed a complaint with Louisiana Attorney General Liz Murrill, urging her office to investigate a CPC called the Unexpected Pregnancy Center, which specifically told clients that they could file a claim with HHS if they felt their personal health information had been misused. The Center is affiliated with Heartbeat International, a multi-million-dollar anti-abortion organization that provides support to CPCs, including the use of its client management software, Next Level CMS, to help centers “engage” with their clients.

In May, journalist Jessica Valenti reported that a Heartbeat employee with access to Next Level posted a training video which appeared to display the names and sensitive health information of at least 13 Louisiana women who had visited The Unexpected Pregnancy Center.In response, CfA took the Center’s advice and filed an HHS complaint on behalf of the 13 women. Months later, however, HHS said it was unable to investigate the complaint—confirming that it had no authority over the Center, or Heartbeat International acting as its “business associate” in this capacity. With this written confirmation, there should no longer be any question that the Center’s claim of clients’ data being protected by HIPAA was false.

Now, CfA is asking Murrill’s office to determine if the Center violated state laws related to consumer protection and data breach notification. As CfA Executive Director Michelle Kuppersmith said, “This is not about abortion, but about consumers’ reasonable expectation that when a provider tells them their information is protected by HIPAA, it’s true."

Female Members of Congress Targeted by Nonconsensual Sexual Deepfakes

A new report by the American Sunlight Project has identified AI-generated nonconsensual sexual deepfakes of over two dozen senators and members of congress, trawling well-known deepfake sites to record over 35,000 “hits.” Of the 26 identified individuals, 25 were women, representing almost 16% of female members in the 118th Congress. The report’s authors note that female lawmakers can “reasonably expect” to be depicted in sexual deepfakes, while their male colleagues are spared this form of exploitation. The risk is elevated for younger women in Congress, as the volume of results was correlated with age.

Several weeks before the report was published, a bipartisan group of lawmakers sent letters to the CEOs of Apple and Google, asking them to share information about the strategies they employ to keep nonconsensual sexual deepfake generators out of their app stores. The letter cited reporting by 404Media’s Emanuel Maiberg, who found that certain AI apps were advertised for their ability to generate non-consensual intimate images (NCII); after clicking on an explicit advertisement, users were taken to innocuous-seeming pages in the iOS App Store. Though Apple removed three of the apps, the lawmakers expressed concern that the multi-billion-dollar tech company was unable to perform this basic oversight without 404Media’s research.

What We’re Reading

F.T.C. Sues Largest U.S. Alcohol Distributor for Illegal Pricing

A global update on bad actors in cryptocurrency

The criminal’s ‘go-to cryptocurrency’ has a new friend in the White House