In the wake of the Supreme Court’s decision to overturn Roe v. Wade, which interpreted a right to abortion in the Constitution through the 14th Amendment, the Department of Health and Human Services (HHS) Office of Civil Rights (OCR) issued new guidance to address patient privacy under the Health Insurance Portability and Accountability Act (HIPAA) for those seeking reproductive health care services. The guidance states that HIPAA allows providers to disclose certain protected health information (PHI), which includes information relating to one’s abortion or other reproductive care, without patient authorization only in specific circumstances that are “narrowly tailored to protect the individual’s privacy and support their access to health services.” Additional key takeaways from the guidance include:

1. A provider would violate HIPAA by disclosing information about a patient’s reproductive services, including abortion treatment, without express consent; requirement by law would not allow a provider to forego consent unless the law expressly requires reporting such information to law enforcement.

2. Even if law enforcement initiates a request for PHI, without a mandate enforceable by law, a provider would violate HIPAA by disclosing information about a patient’s reproductive services without express consent.

3. Disclosure to law enforcement regarding a patient’s intent to seek abortion care would not be permitted as a means of preventing or lessening a “serious or imminent” threat under the HIPAA Privacy Rule.

Disclosures Required by Law

OCR explains that the HIPAA Privacy Rule does not require, only permits, covered entities to disclose PHI without patient authorization when such disclosure is required by law. This is limited to “a mandate contained in law that compels an entity to make a use or disclosure of PHI and that is enforceable in a court of law.” A natural conclusion from this clarification is that HIPAA would not force a provider to disclose information about a patient’s reproductive care to law enforcement without an express requirement to report within the law. Moreover, HHS clarifies that the absence of such an express reporting requirement would render a disclosure to law enforcement impermissible and thus a breach of unsecured PHI.

Disclosures for Law Enforcement Purposes

In certain circumstances, a provider may respond to a law enforcement request for information. OCR clarifies that the HIPAA Privacy Rule does not require, only permits, covered entities to disclose PHI about an individual for law enforcement purposes “pursuant to process and as otherwise required by law.” This may come in the form of a court order or court-ordered warrant. In the absence of a mandate enforceable in a court of law, the HIPAA Privacy Rule’s permission to disclose PHI for law enforcement purposes does not permit a disclosure to law enforcement. Put simply, some degree of legal enforcement measures must be at play, and a provider or provider’s workforce member cannot simply choose to disclose PHI to authorities without such measures, even if law enforcement (without court order) initiated the request. Even when such a court order is presented, HIPAA would only permit, not require, such a disclosure.

Disclosures to Avert a Serious Threat to Health or Safety

The HIPAA Privacy Rule does not require, only permits, a covered entity to disclose PHI if the covered entity believes in good faith that the use or disclosure is necessary to prevent or lessen a “serious and imminent” threat to the health or safety of a person or the public, and that the disclosure is to a person who could prevent or lessen the threat. In the guidance, OCR clarifies that disclosures to law enforcement related to a patient’s reproductive treatment, in some cases, would not qualify as necessary to prevent or lessen a threat. For example, if a pregnant patient in a state that bans abortions informs their provider that they intend to seek abortion care in another state, that provider would not be permitted to disclose this to law enforcement because the facts would not qualify as “serious and imminent.”

Conclusion

To date, HHS has only provided clarification regarding disclosures to law enforcement and no new rules have been promulgated. Troutman Pepper Health Sciences attorneys will continue to monitor for any changes to the existing rules.