On August 7, Massachusetts Governor Maura Healey signed into law a new Shield Law (S.2543) – the Shield Act 2.0 – that restricts providers’ ability to disclose information in certain health care-related investigations, among other provisions.  Like the Washington Shield Law that was enacted in 2023, the Shield Act 2.0 covers gender-affirming treatment in addition to reproductive health care.  The passage of the Shield Act 2.0 follows Massachusetts’s enactment, in 2022, of a Shield Law that provided protections for Massachusetts healthcare providers from sanctions for providing or assisting in the provision of legally protected reproductive healthcare services or gender-affirming healthcare services in the state.

In particular, Section 6 of the Shield Act 2.0 is relevant to Massachusetts-based providers that may be subject to out-of-state legal process.  Section 6 is scheduled to take effect 90 days from the date of enactment, or November 5, 2025.  Below we summarize some key aspects of Section 6:

• Prohibition:  This provision prohibits a business entity that “operates in” Massachusetts and provides “electronic communication services” or “remote computing services” from disclosing, in response to a civil or criminal legal request, “information or assistance that the business entity knows relates to a resident, health care provider or business entity in the commonwealth in connection with legally-protected health care activity.”  “Legally-protected health care activity” is defined under the original Shield Law to include reproductive health or gender-affirming care that is lawful in Massachusetts, such as abortion care. 

• Exceptions:  The prohibition on disclosure in Section 6 does not apply if:  (1) the disclosure is required under applicable federal law, or (2) the requestor provides an attestation, signed under penalty of perjury, certifying that the legal request does not seek documents, information, or testimony relating to an investigation into or the enforcement of another state’s law that imposes civil or criminal liability for the provision or receipt of legally-protected health care activity that is lawful in Massachusetts.

• Applicability:  As noted above, Section 6 applies to Massachusetts businesses providing electronic communication services (“ECS”) or remote computing services (“RCS”).  “Electronic communication services” is defined as “any service which provides to users thereof the ability to send or receive wire or electronic communications” — in other words, the same definition found in the federal Stored Communications Act (“SCA”).  Courts interpreting the SCA have generally understood this term to refer to services that facilitate user-to-user communications.  Section 6 similarly defines “remote computing service” to incorporate the definition of this term under the SCA (i.e., “the provision to the public of computer storage or processing services by means of an electronic communications system”).  Generally, businesses typically qualify as an RCS if they provide storage services to the public, such as a cloud storage services.

• Penalties: The Attorney General may bring a civil action against covered businesses to compel compliance with this requirement, and any person who submits a false attestation is subject to a statutory penalty of up to $50,000 per violation.