Summary

There are two important updates with respect to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). First, on September 17, 2014, the U.S. Department of Health and Human Services (HHS) issued guidance to aid covered entities in interpreting HIPAA regulations with respect to same-sex marriages in light of the Supreme Court decision in U.S. v. Windsor. Second, the deadline for those covered entities and business associates who already had business associate agreements in place prior to the release of the so-called Omnibus Rule in January, 2013 must have updated business associate agreements executed no later than September 22, 2014.

In U.S. v. Windsor, the Supreme Court ruled Section 3 of the federal Defense of Marriage Act unconstitutional. Section 3 had provided that federal law would recognize only opposite-sex marriage. In its guidance document, the HHS analyzed the portions of the HIPAA regulations impacted by the Supreme Court ruling. HHS reviewed the HIPAA regulatory definition of “family member,” which includes the words “spouse” and “marriage.” The HHS guidance states that these terms apply to individuals who are legally married, whether or not the individuals live or receive services in a jurisdiction that recognizes their marriage. Legally married same-sex couples are considered family members for purposes of the HIPAA regulation that allows covered entities to share protected health information with family members under certain circumstances. Further, the prohibition on health plans using information regarding the genetic tests of a family member includes the genetic tests of a same-sex spouse.

The HHS guidance document is available here.

The other important HIPAA item for covered entities and business associates is the September 22, 2014 deadline to execute updated business associate agreements. Covered entities who entered into business associate agreements after January 25, 2013 have been required to utilize an Omnibus-compliant form of agreement since September 23, 2013. HHS, however, had allowed an extra year for those covered entities who had entered into valid business agreements prior to January 25, 2013 to bring the agreements into compliance. Covered entities and business associates who have not updated their existing business associate agreements for Omnibus compliance must do so by September 22, 2014.