Employer Tip - New HIPAA Reproductive Health Care Privacy Rule

HIPAA Privacy Rule for Reproductive Health Care

Following the U.S. Supreme Court's decision in Dobbs v. Jackson Women's Health Organization, the Department of Health and Human Services (HHS) has issued a new final rule that amends the HIPAA Privacy Rule to afford greater protection to protected health information (PHI) that is related to reproductive health care.

Before the new rule, covered entities and business associates were permitted to disclose PHI for certain public policy-related reasons, including law enforcement.

Under the new rule, such entities will be prohibited from disclosing PHI related to lawful reproductive health care in certain situations.

The Final Rule continues to permit covered health care providers, health plans, or health care clearinghouses (or business associates) to use or disclose PHI for purposes otherwise permitted under the Privacy Rule where the request for the use or disclosure of PHI is not made to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.

A Few Important Notes from the Final Rule Fact Sheet

Because of the recent final rule issued by HHS, all group health plans (as well as other covered entities and business associates) have until December 22, 2024, to comply with the new rule, but will have until February 16, 2026, to update their HIPAA Notice of Privacy Practices accordingly.

Notice of Privacy Practices (NPP)

The Final Rule requires covered health care providers, health plans, and health care clearinghouses (covered entities) to revise their NPPs to support reproductive health care privacy.

Attestation

To implement the prohibition, the Final Rule requires a covered health care provider, health plan, or health care clearinghouse (covered entities and/or business associates), when it receives a request for PHI potentially related to reproductive health care, to obtain a signed attestation that the use or disclosure is not for a prohibited purpose. This attestation requirement applies when the request is for PHI for any of the following:

Health oversight activities.

Judicial and administrative proceedings.

Law enforcement purposes.

Disclosures to coroners and medical examiners.

^{While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.}