Seeking to strengthen reproductive healthcare privacy in the wake of the 2022 Supreme Court opinion in Dobbs v. Jackson Women’s Health Organization, which overruled Roe v. Wade, the Department of Health and Human Services’ Office for Civil Rights issued a Notice of Proposed Rulemaking to modify the HIPAA Privacy Rule in April of last year.
This April, HHS issued a Final Rule, the HIPAA Privacy Rule to Support Reproductive Healthcare Privacy. In a press release accompanying the Final Rule, HHS reports that “The Final Rule strengthens the Health Insurance Portability Act of 1996 (HIPAA) Privacy Rule by prohibiting the disclosure of protected health information (PHI) related to lawful reproductive healthcare in certain circumstances.”
Are Covered Entities and Business Associates Required to Make Immediate Changes?
No. The law does not go “on the books” (become official) until June 25, 2024. The earliest time the Final Rule will be enforced is December 23, 2024.
What Does the Final Rule Do?
The Final Rule modifies the existing Privacy Rule by changing the definition of the term “person.” The Final Rule adds definitions for the terms “public health” and “reproductive healthcare.”
According to a Fact Sheet accompanying the Final Rule, the Final Rule “strengthens privacy protections by prohibiting the use or disclosure of protected health information (PHI) by a covered health care provider, health plan, or health care clearinghouse—or their business associate—for either of the following activities:
To conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive healthcare, where such health care is lawful under the circumstances in which it is provided.
The identification of any person for the purpose of conducting such investigation or imposing such liability.”
What Are Permitted Uses or Disclosures of PHI?
Per the Fact Sheet, “The Final Rule continues to permit covered health care providers, health plans, or health care clearinghouses (or business associates) to use or disclose PHI for purposes otherwise permitted under the Privacy Rule where the request for the use or disclosure of PHI is not made to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive healthcare,” or where the request is not made to identify someone for the purpose of conducting such an investigation or imposing such liability.
Other Final Rule Requirements: Attestations and Notices of Privacy Practices (NPPs)
The Fact Sheet reports that the Final Rule “requires a covered health care provider, health plan, or health care clearinghouse (or business associates), when it receives a request for PHI potentially related to reproductive healthcare, to obtain a signed attestation that the use or disclosure is not for a prohibited purpose.”
The Fact sheet also reports that the Final Rule “requires covered health care providers, health plans, and health care clearinghouses to revise their Notices of Privacy Practices (NPPs) to support reproductive healthcare privacy.”
What Other Changes Does the Final Rule Make to the Notice of Privacy Practices (NPP) Requirement?
The Final Rule requires covered entities to revise their Notices of Privacy Practices to cover patient rights with respect to the confidentiality of substance use disorder records under 42 CFR Part 2. This requirement will not be enforced until February 16, 2026, at the earliest.
What Else Should I Know About The Final Rule?
The rule is subject to being challenged in court; we will include information regarding legal proceedings in the Compliancy Group blog as this information becomes available.
The Final Rule itself can be viewed here. This document includes the actual changes to the Privacy Rule regulations, information relating to the impact of the regulatory changes, as well as HHS commentary and response to comments received. The actual text of the Final Rule begins on the page marked “33062” and ends on the page marked “33066”).
