Proposed HIPAA Privacy Rule Change to Strengthen Privacy Related to Reproductive Health
In the wake of the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, the Department of Health & Human Services Office for Civil Rights (“OCR”) has issued a Notice of Proposed Rulemaking to modify the Health Insurance Portability and Accountability Act’s (“HIPAA”) Privacy Rule to prohibit the use or disclosure of protected health information (“PHI”) to investigate or prosecute patients and providers involved in the provision of legal reproductive health care.
The Privacy Rule currently permits certain disclosures of PHI to law enforcement authorities and others. This provision will remain in effect while HHS solicits comments on its proposed rule change. The proposal seeks to prohibit the disclosure of reproductive health care PHI to state law enforcement authorities for use in bringing criminal, civil, or administrative actions against patients for obtaining reproductive health care, including abortions, and against their health care providers for rendering the care.
Specifically, 45 C.F.R. §164.502 would be amended to prohibit the use or disclosure of PHI by a regulated entity for either of the following purposes:
- A criminal, civil, or administrative investigation into or proceeding against any person in connection with seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided.
- The identification of any person for the purpose of initiating such investigations or proceedings.
The new rule would apply where the relevant criminal, civil, or administrative investigation or proceeding is in connection to: (1) reproductive health care sought, obtained, provided, or facilitated in a state where the health care is lawful and outside of the state where the investigation or proceeding is authorized; (2) reproductive healthcare that is protected, required, or authorized by federal law, regardless of the state in which such health care is provided; or (3) reproductive healthcare provided in the state in which the investigation or proceeding is authorized and that is permitted by the law of that state.
The proposal also would add a new section 45 C.F.R. §164.509, which would require a regulated entity, upon receipt of a request for PHI related to reproductive healthcare, to obtain a signed attestation that the use or disclosure of such PHI is not for a prohibited purpose. The attestation requirement would apply when the request is for PHI pursuant to health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners.
OCR Director Melanie Fontes Rainer commented on the proposal stating: “Today’s proposed rule is about safeguarding this trust in the patient-provider relationship, and ensuring that when you go to the doctor, your private medical records will not be disclosed and used against you for seeking lawful care.”
The proposed rule was published in the Federal Register on April 17, 2023, with public comments due by June 17, 2023.
For more information and regulatory guidance, please contact Robert Braumuller or Zaina S. Khoury, at RBraumuller@bpslaw.com or ZKhoury@bpslaw.com.