HIPAA Rule Prohibiting Reproductive Care Disclosure Takes Effect This Month

A new rule prohibiting the disclosure of protected health information related to lawful reproductive health care will go into effect this month.

The rule, which the Biden administration finalized in April, comes as a response to the reversal of Roe v. Wade, which has complicated the reproductive health landscape.

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy rule, health care providers were allowed, but not required, to provide reproductive health information—which may include contraception use, pregnancy-related health care (including miscarriage and abortions), and infertility treatment—to law enforcement. The new rule, titled HIPAA Privacy Rule to Support Reproductive Health Care Privacy, prohibits the disclosure of protected health information related to lawful reproductive health care in certain circumstances. It’s important information for employers, who are considered covered entities under HIPAA.

The rule takes effect June 25, and those subject to the regulation must comply with the applicable provisions of the rule by Dec. 23.

SHRM Online gathered up additional news and information on the final rule.

Rule Does Not Cover Where Services Were Not Legal

The rule does not offer protection of reproductive health information in instances where the services were not legal. It also does not cover information outside of HIPAA such as a patient’s location data or health information stored on their phone. The rule applies when reproductive health care has been lawfully provided in a state where the care is legal.

(Fierce Healthcare)

A Result of Roe v. Wade Reversal

The administration said it issued the rule after hearing that changes were needed to better protect patient confidentiality and prevent medical records from being used against people for providing or obtaining lawful reproductive health care after Roe v. Wade was reversed in June 2022. As a result of that decision, some patients have traveled to obtain reproductive care as some states issued abortion bans and other restrictions on reproductive care.

“Since the fall of Roe v. Wade, providers have shared concerns that when patients travel to their clinics for lawful care, their patients’ records will be sought, including when the patient goes home. Patients and providers are scared, and it impedes their ability to get and provide accurate information and access safe and legal health care,” said Office for Civil Rights Director Melanie Fontes Rainer.

(U.S. Department of Health and Human Services (HHS) press release)

Part of an Ongoing Effort of Administration

The HIPAA rule is part of an ongoing effort by the Biden administration to protect access to reproductive health care after the overturning of Roe v. Wade, according to HHS Secretary Xavier Becerra.

“Each and every American still has a right to their privacy, especially when it comes to their very private, very personal health information,” Becerra said. “Under federal law, you have rights to your privacy. That’s what today is about—making sure that Americans who convey very personal, private health information to a provider know that they have rights.”

(CNN)

Attestation Information

Under the rule, when a HIPAA-covered entity, which includes group health plans, receives a request for protected health information potentially related to reproductive health care, it must obtain a signed attestation that protected health information will not be used for a prohibited purpose. This attestation needs to be provided on a standalone basis—not connected to or accompanied by other documents—in the following circumstances:

• Health oversight activities.
• Judicial and administrative proceedings.
• Law enforcement purposes.
• Disclosures to coroners and medical examiners.

The final rule provides details on content and distribution requirements for the attestation, as well as what makes it valid. The Office for Civil Rights intends to publish a model attestation form prior to the Dec. 23 compliance date.

(WTW)