HIPAA Privacy Rule Amended to Protect Reproductive Health Information

At the end of April 2024, the US Department of Health and Human Services (HHS) released final amendments to the Health Insurance Portability and Accountability Act (HIPPA) Privacy Rule. The amendments further protect the privacy of protected health information (PHI) related to reproductive health. The final amendments were published in the Federal Register on April 26, 2024, meaning the deadline for compliance with the new amendments will be late December 2024.

What Was the Impetus for the Change?

“The Supreme Court decision in Dobbs v Jackson Women’s Health Organization overturned precedent that protected a constitutional right to abortion and altered the legal and health care landscape,” wrote HHS in the Executive Summary of the final amendments. “This decision has far-reaching implications for reproductive health care beyond its effects on access to abortion. This changing legal landscape increases the likelihood that an individual’s PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect, including the trust of individuals in health care providers and the health care system.”

HHS also expressed concerns that if a health care provider does not trust that a patient’s PHI will be kept confidential, the provider may leave gaps or include inaccuracies when preparing medical records–creating a risk that future medical treatment could be compromised. In the amendments, HHS noted that it is trying to balance the interests of individuals and society. It recognized in the past that the relationship between a patient and a therapist is particularly sensitive. Thus, notes cannot be disclosed without the patient’s authorization (except in very limited situations). It noted that decisions about reproductive health also contain sensitive information that should be protected to maintain trust in the health care system.

“Individuals are increasingly concerned about the confidentiality of discussions with their health care providers,” noted HHS in the amendments. “As a result, some individuals are not confiding fully in their health care providers, increasing the risk that their medical records will not be complete and accurate, leading to decreases in health care quality and safety.”

What is Changing?

HHS is strengthening privacy rules surrounding reproductive health by finalizing a purpose-based prohibition against certain uses and disclosures of PHI. A person knowingly violating HIPAA and misrepresenting the intended use of the PHI is subject to criminal penalties. The final rule prohibits certain uses and disclosures of PHI to investigate or impose liability on a person for seeking, obtaining, or providing lawful reproductive care. It will require certain requestors to attest that they are not seeking the PHI for prohibited purposes.

The Bottom Line

The amended HIPAA rule will protect PHI from being used to punish women for the mere act of seeking or obtaining reproductive health care and cannot be used to identify women who have done so. For your own legal protection, do not disclose PHI without a patient’s consent or without checking with an attorney first.

Reference

HIPPA Privacy Rule to Support Reproductive Health Care Privacy Act. 42 USC. 1302(a); 42 USC 1320d-1320d-9; sec 264, Pub L 104-191, 110 Stat 2033-2034 (42 USC. 1320d-2 (note); 5 USC 552; secs 13400-13424, Pub L 111-5, 123 Stat 258-279; and sec 1104 of Pub L 111-148, 124 Stat 146-154.