HHS Proposes Revisions to HIPAA Privacy Rule Addressing Concerns about Reproductive Health Care

On April 12, 2023, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) issued a Notice of Proposed Rulemaking (the “NPRM”), proposing modifications to the HIPAA Privacy Rule intended to strengthen certain protections related to reproductive health care, which the Proposed Rule would define as, “care, services, or supplies related to the reproductive health of the individual.”

The Proposed Rule seeks to enhance privacy protections by prohibiting the use or disclosure of protected health information (“PHI”) relating to reproductive health care by a covered entity or a business associate (referred to collectively within the NPRM as “regulated entities”) for the purpose of either: (i) a criminal, civil, or administrative investigation into or proceeding against any person in connection with seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided; or (ii) the identification of any person for the purpose of initiating such investigations or proceedings related to reproductive health care.

The above prohibition applies in the following three scenarios:

1. If the reproductive health care is sought, obtained, provided, or facilitated in a state where the reproductive health care is lawful and outside of the state in which the investigation or proceeding is authorized. This addresses scenarios in which a resident of a state where abortion is illegal travels to another state to obtain an abortion legally;
2. If the reproductive health care provided is protected, required, or expressly authorized by federal law, regardless of the state in which the reproductive health care is provided. OCR provides an example of miscarriage management, which is required under the Emergency Medical Treatment and Labor Act (“EMTALA”) to stabilize the health of the mother; and
3. If the reproductive health care is provided in the state where the investigation or proceeding is authorized and the reproductive health care is permitted by the law of the state in which the reproductive health care is provided.

Despite these new protections, however, the Proposed Rule provides no new or additional protections with respect to disclosures of PHI for the purpose of an investigation or proceeding when the reproductive health care was provided unlawfully. So, for example, a provider of unlawful reproductive health care would not be able to use these new prohibitions as a reason for refusing to provide PHI.

The Proposed Rule would require a regulated entity to obtain a signed attestation from the person making the request that the PHI will not be used or disclosed for a prohibited purpose when the request is for PHI related to health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosure to a coroner or medical examiner. Additionally, the Proposed Rule would require covered entities to update their Notices of Privacy Practices to include a description, including at least one example, of the types of uses and disclosures prohibited under the Proposed Rule and the types of uses and disclosures for which an attestation is required.

The NPRM is scheduled to be published in the Federal Register on April 17, 2023. The public inspection copy is available here. Public comments are due within 60 days of the publication. If the proposed rule is finalized, it will become effective 60 days following the publication of the final rule. HIPAA covered entities and business associates will then have 180 days from the effective date to establish and implement policies and procedures to achieve compliance.

As the issue of abortion continues to be litigated in the Federal Courts, it would not be surprising to see more action taken by Congress or Federal agencies with respect to the rights of women to receive reproductive health services. See our Dobbs Resource Center  for coverage of the ongoing developments with respect to reproductive health services.