April 26, 2024

The U.S. Department of Health and Human Services (HHS) published a final rule intended to strengthen protections under the HIPAA Privacy Rule by prohibiting the use or disclosure of protected health information (PHI) to investigate or prosecute patients, providers, and others involved in the provision of reproductive health care, including abortion care. The HIPAA Privacy Rule establishes national standards that health plans, health care clearinghouses, and health care providers that conduct certain electronic health care transactions must implement to protect PHI and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s prior authorization.

HHS notes that as a result of the U.S. Supreme Court’s recent decision in Dobbs v. Jackson Women’s Health Organization (Dobbs), which overturned the constitutional right to an abortion previously established in Roe v. Wade, some states have already imposed criminal, civil, or administrative liability for: (1) individuals who obtain certain reproductive health care, including abortion care; (2) the health care providers who furnish such reproductive health care; and (3) other persons who facilitate the furnishing or receipt of certain reproductive health care. HHS asserts that if individuals believe that their PHI may be disclosed without their knowledge or consent to initiate criminal, civil, or administrative investigations or proceedings against them or others related to legal reproductive health care, it can create damaging and chilling effects on individuals’ willingness to seek appropriate and lawful health care for medical conditions that can worsen without treatment. 

As a result, HHS is amending the HIPAA Privacy Rule to prohibit the use or disclosure of PHI for either of the following purposes: (1) to conduct a criminal civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, including abortion care, where such health care is lawful under the circumstances in which it is provided; and (2) the identification of any person for the purpose of conducting such investigation or imposing such liability. This prohibition applies where a covered health care provider, health plan, or health care clearinghouse has reasonably determined that one or more of the following conditions exist: (1) the reproductive health care is lawful under the law of the state in which such health care is provided and under the circumstances in which it is provided; (2) the reproductive health care is protected, required, or authorized by federal law, including the U.S. Constitution, regardless of the state in which such health care is provided; and (3) the reproductive health care was provided by a person other than the covered health provider, health plan, or health care clearinghouse that receives the request for PHI.

To implement this prohibition, HHS requires that health plans, health care clearinghouses, and health care providers obtain a signed form of attestation from a PHI requestor stating that use or disclosure of PHI is not for a prohibited purpose as defined in this rule prior to release of the PHI. This attestation requirement would apply when the request is for PHI related to any of the following: (1) health oversight activities; (2) judicial and administrative proceedings; (3) law enforcement purposes; and (4) disclosures to coroners and medical examiners.

© 2024 Signatory Wall and Ceiling Contractors Alliance (SWACCA). All rights reserved.