On April 12, 2023, the U.S. Department of Health and Human Services (HHS), through its Office for Civil Rights (OCR), issued a Notice of Proposed Rulemaking (NPRM) to strengthen Health Insurance Portability Accountability Act (HIPAA) Privacy Rule protections. The proposed rule is specifically aimed at prohibiting the use or disclosure of protected health information (PHI) to investigate or prosecute patients, providers, or others involved in legal reproductive healthcare, including abortion care. This action comes in response to calls from patients, providers, and organizations that represent thousands of individuals that this change is needed to safeguard patient-provider confidentiality and prevent the use and disclosure of private medical records to prosecute people for seeking, obtaining, providing, or facilitating lawful reproductive healthcare.
After the Supreme Court’s decision overturning Roe v. Wade, President Biden signed Executive Order 14076, which directs HHS to strengthen the protection of sensitive information related to reproductive healthcare services and patient provider confidentiality. The NPRM is in line with this Executive Order and coincides with the third meeting of President Biden’s Task Force on Reproductive Healthcare Access. The aim is to protect women’s access to reproductive healthcare.
The proposed rule is meant to safeguard the trust between patients and providers and ensure that private medical records will not be disclosed and used against those seeking lawful care.
The NPRM includes safeguards that have been designed to help protect women who receive legal reproductive healthcare in a state where there are no restrictions, from being prosecuted by a state that has placed restrictions on abortions and other types of reproductive health. The proposed rule also shields women and providers located in a state that has placed restrictions on reproductive healthcare, so long as the care they receive or provide is permitted by state and federal law. For example, state prosecutors cannot attempt to access an individual’s PHI, if that individual has complied with the state’s eight-week abortion ban.
HHS is also taking action to provide clarity to healthcare providers and patients with the submission of this NPRM. The proposed rule defines but does not limit reproductive healthcare to include: prenatal care, abortion, miscarriage management, infertility treatment, contraception use, and treatment for reproductive-related conditions such as ovarian cancer. Furthermore, the OCR has stated that noncompliance with the proposed rule will become an enforcement priority.
While the proposed rule provides clarity and extends privacy protections, it does have its limitations. The rule will only apply to covered entities as defined by the HIPAA rules 1) health plans, 2) healthcare clearinghouses, and 3) healthcare providers who electronically transmit any health information in connection with transactions from which HHS has adopted standards. Furthermore, if a state wants to investigate or prosecute an individual or provider, they can use other methods to gather evidence, such as search histories, text messages, and geo-location tracking. The proposed rule only protects PHI.
While HHS is undertaking the rulemaking, the current Privacy Rule remains in effect. Under the existing Privacy Rule, it is permitted but not required to make certain disclosures to law enforcement and others, subject to the specific conditions.
The NPRM can be viewed at: https://public-inspection.federalregister.gov/2023-07517.pdf
A link to the fact sheet from OCR can be found at: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/hipaa-reproductive-health-fact-sheet/index.html
OCR guidance on disclosure of reproductive healthcare information: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/phi-reproductive-health/index.html
© Copyright 2023. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
