U.S. Department of Health and Human Services Issues Final Rule to Support Reproductive Health Care Privacy Under HIPAA
On Monday, April 22nd, the U.S. Department of Health and Human Services released a final rule, entitled the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to Support Reproductive Health Care. The rule prohibits the use or disclosure of protected health information to investigate or prosecute patients or providers who have obtained or provided legal reproductive health care services. Notably, the rule only applies where the care provided is lawful, meaning it does not apply to abortions provided in states where the procedure is banned. However, the rule does protect patients who live in states where abortion care is banned and travel out of state to obtain an abortion.
The new rule also requires a regulated health care provider, health plan, clearinghouse, or their business associates to obtain signed attestations that certain requests for protected health information potentially related to reproductive health care are not for purposes prohibited by the rule. Moreover, these regulated entities must modify their notice of privacy practices to support reproductive health care privacy consistent with the new rule.
The rule was adopted in direct response to the U.S. Supreme Court’s landmark decision in Dobbs v. Jackson, in which the Court held there is no constitutional right to abortion. The Dobbs decision overturned nearly fifty years of legal precedent, namely the protections established by Roe v. Wade, which recognized a woman’s right to abortion based on the right to privacy contained in the Fourteenth Amendment.
According to the Guttmacher Institute, the number of individuals who have crossed state lines to obtain abortion care has more than doubled since 2020, with more than 92,000 patients traveling out of state for abortions in the first six months of 2023, compared with 40,600 patients in half of 2020. This increased travel has been largely driven by abortion bans and restrictions adopted by state legislatures in the wake of Dobbs. Indeed, since the Dobbs decision in 2022, fourteen states have enacted near total abortion bans, in turn increasing the likelihood that that protected health information may be disclosed in ways that cause harm to the interests HIPAA seeks to protect.
“Many Americans are scared their private medical information will be being shared, misused, and disclosed without permission. This has a chilling effect on women visiting a doctor, picking up a prescription from a pharmacy, or taking other necessary actions to support their health,” said Health and Human Services Secretary Xavier Becerra. “The Biden-Harris Administration is providing stronger protections to people seeking lawful reproductive health care regardless of whether the care is in their home state or if they must cross state lines to get it. With reproductive health under attack by some lawmakers, these protections are more important than ever.”
The new rule will be effective 60 days after its publication in the Federal Register. If you have questions about the new rule, Parker Daniels Kibort can help. Give us a call at 612.355.4100.
