Summary
Next Level Center Management Solution (Next Level CMS) is a data management company that operates to gather data from anti-abortion centers (AACs) and then streamline, integrate, and share that data with other AACs globally and then streamline, integrate, and share that data with other AACs globally or broadcast this data to “stakeholders” in the anti-abortion movement.
Next Level CMS is an offshoot of the massive global AAC network Heartbeat International. Heartbeat International president Jor-El Godsey announced the formation of Next Level CMS at Heartbeat’s annual conference in 2017, calling it a “game changer” in the global anti-abortion movement. Connecting AACs across the world to each other and enabling them to share data, trends, and practices, Next Level CMS is an explicit manifestation of how the anti-abortion movement is a well-funded, highly coordinated global movement, rather than a grassroots movement of people genuinely concerned about real pregnancy care.
There are serious concerns about data privacy – or lack thereof – in the data that Next Level CMS collects and disseminates. Next Level CMS collects a large amount of private health information from individuals, including sensitive data like “name, address […] living arrangement […] income source, alcohol, cigarette, and drug intake, medications, medical history, sexual transmitted disease history, name of the referring person/organisation […] pregnancy history, medical testing information,” and more.
Because most AACs are not licensed medical providers, most AACs are not covered by HIPAA in a meaningful or enforceable way, even if they pretend to be. Accordingly, there is nothing preventing AACs from using Next Level CMS to share private health information about pregnant people without their knowledge or consent. Non-consensual sharing of information is concerning and dangerous, especially so in a post-Roe landscape. This information could potentially be weaponized against pregnant people or those who support them in seeking abortion care in places where it is increasingly criminalized.
The data privacy concerns surrounding Next Level have prompted congressional inquiry. With the backing of the massively well-funded Heartbeat International, Next Level CMS should be taken as a serious privacy threat in our current landscape of anti-abortion actors.
Extremism
Next Level CMS Alleges Compliance With HIPAA, But There Is No Way To Ensure Safety For Those Whose Data Has Been Captured By Heartbeat International
Next Level’s Self-Alleged Compliance To HIPAA Is Questionable. “How are clients’ private health information (PHI) protected? Next Level provides encrypted end-to-end communication between your Center and clients and no data is stored at the local level on external devices, making our software compliant with these HIPAA standards. We recommend that your Center familiarizes itself with HIPAA guidelines and takes the appropriate actions to comply with those guidelines.” [Next Level Center Management Solution, accessed 4/23/24]
Next Level’s Mobile App, MyHelpLink, Saves Encrypted Texts To An Internally Managed Client Record. “Next Level provides end-to-end encrypted messaging between your Center and clients. All of these messages are saved to the client record, but not on the client’s mobile device, making Next Level compliant with HIPAA. Secure messaging requires the client to use Next Level’s mobile web-app, MyHelpLink.” [Next Level Center Management Solution, accessed 4/23/24]
[Next Level Center Management Solution, accessed 4/23/24]
…Yet Next Level Voluntarily Opts Into Business Associate Agreements With AACs. “Is a Business Associate Agreement (BAA) available? HIPAA regulations define a ‘business associate’ as ‘a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity.’ As such, Next Level can enter into a (Heartbeat International provided) business associate agreement (BAA) with your pregnancy help organization, if applicable. Ensuring your clients’ private health information (PHI) is of utmost importance for Next Level, and we are committed to working with your organization to meet this crucial goal.” [Next Level Center Management Solution, accessed 4/23/24]
Influence
Concerns About Next Level’s Privacy (Or Lack Thereof) – Especially In The Post-Roe World – Prompted A Congressional Inquiry
Seven U.S. Senators Penned A Letter Prompting A Congressional Inquiry Into The Protection Of Private Health Information, With Next Level CMS As A Central Cause For Concern. “Heartbeat International explicitly states that its vision ‘is to make abortion unwanted today and unthinkable for future generations.’ To accomplish that goal, it invested in data collection and in 2017 created a database called the ‘Next Level [Center] Management Solution’ (Next Level CMS) to keep track of people that contact Heartbeat International or any affiliate CPCs. Next Level CMS’ website states that it ‘harnesses the power of big data’ to ‘[make] sure that no client ever falls through the cracks from the moment you say “Hello.”’ […] Next Level CMS is a one-stop shop for storing that data, and you promote services such as a Client Risk Tracker, which ‘keep[s] [CPCs] up to speed on each individual woman’s anticipated risk level’ for obtaining an abortion. […] Patient data privacy has become a significant concern in the aftermath of the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, with advocates worried that, in state that have banned or severely restricted abortion, ‘the CPC industry is now functioning as surveillance infrastructure for the anti-abortion movement, amassing data that could be used in pregnancy- and abortion-related prosecutions post-Roe.’” [Senator Elizabeth Warren, 9/19/22]
These Senators Noted The Lacking HIPAA Enforcement For AACs Since They Are Not Licensed Medical Providers. “Because your organization and its affiliate CPCs are not legitimate medical providers, they are not subject to federal health data privacy laws like HIPAA, which protects ‘sensitive patient health information from being disclosed without the patient’s consent or knowledge.’ Heartbeat International – which is explicitly opposed to abortion rights – appears to be in a position to collect a significant amount of personal information from women about their pregnancies and potential plans for managing their care, but it is not under any legal obligation to maintain the confidentiality of this information, or keep it out of the hands of abortion bounty hunters.” [Senator Elizabeth Warren, 9/19/22]
- The Inquiry Noted How AACs Even Use Tactics Meant To Mimic HIPAA Compliance And Protection, While They Actually Mean Nothing. “While your organization and many of its affiliate CPCs claim to adhere to HIPAA to protect patients’ health information, it does not disclose how it is using the data it collects, whether it is keeping personal information secure, and whether it intends to do so in the future. Heartbeat International promotes websites that have inaccurate claims, including that CPCs ‘use intake forms as a type of confidentiality agreements, which grants the woman confidentiality protections like she would receive under HIPAA. In other words, they “resemble” HIPAA forms because they act like HIPAA forms.’ But these forms do not offer the same protections as HIPAA. This is deeply concerning, especially as recent reports by privacy experts have highlighted the threats posed by abortion bounty hunter laws and emphasized that ‘pregnant people’s digital lives will be under the microscope.’” [Senator Elizabeth Warren, 9/19/22]
In Response To This Inquiry, Next Level CMS’s Parent Organization, Heartbeat International, Claimed The Letter Was Religious Targeting – Doubling Down On The Fact They Are Not Real Medical Providers, But Rather Religious Proselytizers. “First Liberty questioned whether Warren and the other senators had legal authorization to investigate Heartbeat as a private, religious non-profit, or to compel Heartbeat to answer their questions. ‘Rather, your letter appears to be an unwarranted effort to investigate a private organization which holds to a religious and ideological opinion with which you disagree,’ the legal group said.” [Pregnancy Help News, 10/6/22]
- Heartbeat International Responded By Flippantly Dismissing The Inquiry’s Privacy Concerns. “[T]his letter is nothing more than a political stunt. […] Thank you, Senators, for this PR opportunity.” [Heartbeat International, accessed 4/23/24]
Heartbeat International Was Audited By The Private Organization Modern Compliance Solutions; However, Third-Party HIPAA Seals Of Compliance Are Not Conferred By The U.S. Department Of Health And Human Services And Are Not Legally Binding In Any Way.
Financial
As An Offshoot Of Heartbeat International, Next Level CMS Presumably Receives Some Level Of Funding From Its Extremely Well-Funded Parent Organization
Heartbeat International Is Incorporated In Ohio As A 501(c)(3) Nonprofit, With Revenue Of $9,754,794, Expenses Of $10,040,245, And Net Assets Of $1,865,066, According To Its 2023 Form 990.
Next Level Receives Some Portion Of Their Funding From Paid Subscriptions For Their Services
Next Level CMS Receives Some Amount Of Their Funds From User Subscription Costs. “Next Level is purchased as a monthly or annual subscription at the following price points (tiers). These tiers are based on the total number of unique client, donor, and staff name records in the Next Level database. Each of these unique names have unlimited entries such as forms, notes, and documents associated with them at no additional cost. There is a one-time $150 start up fee when onboarding with Next Level.” [Next Level Center Management Solution, accessed 4/23/24]
[Next Level Center Management Solution, accessed 9/24/24]
