On April 17, 2023, OCR published a proposed rule (the Proposed Rule) that would expand protections for reproductive health information under the Health Insurance Portability and Accountability Act (HIPAA). The Proposed Rule would prohibit regulated entities from using or disclosing an individual’s protected health information (PHI) for the purpose of conducting a criminal, civil, or administrative investigation into or proceedings against a person in connection with seeking, obtaining, providing, or facilitating reproductive health care where the health care provided was lawful under state or federal law. The Proposed Rule would also prohibit a regulated entity from disclosing PHI to identify an individual for purposes of initiating an investigation into a person who obtained, sought, provided or received lawful reproductive health care services.
The Proposed Rule is one of many actions being taken by federal government agencies to address changes in laws governing reproductive health and abortion. On July 8, 2022, President Biden issued an Executive Order instructing certain agencies to take steps to protect access to reproductive health care services in the wake of the Dobbs v. Jackson Women’s Health Organization Supreme Court decision.
The stated purpose of the Proposed Rule is to protect an individual’s ability to seek lawful reproductive health care in a safe environment that protects patient-provider communications. Reproductive Health Care would be based on the existing HIPAA definition of “health care” and broadly defined as “care, services, or supplies related to the reproductive health of the individual.” Examples of “reproductive health care” include pregnancy and prenatal related products and services, infertility treatments, miscarriage management, pregnancy screening and termination. The Proposed Rule would limit the use and disclosure of PHI that is sensitive reproductive health information in situations where there is an investigation occurring: (1) outside of the state where the health care provided was lawful; (2) inside the state where the health care provided was lawful; and (3) when the health care provided was lawful under federal law such as when emergency care is provided under Emergency Medical Treatment and Active Labor Act.
The Proposed Rule would revise the “public health” exemption to expressly exclude any surveillance activities that are related to civil, criminal, and administrative investigations into obtaining, providing, or seeking lawful reproductive health care. To implement the Proposed Rule, a regulated entity that receives a request for information potentially related to reproductive health information would be required to obtain an attestation from the requestor confirming that the information sought is not for prohibited purposes.
The Proposed Rule would allow a regulated entity to disclose protected reproductive health information if the primary purpose is not to investigate a person or to impose liability on a person for seeking, obtaining, or providing reproductive health care. A covered health care provider would continue to be able to lawfully disclose PHI to defend itself in a professional liability matter if it was related to reproductive health care. Similarly, a health oversight agency would be able to use or disclose PHI related to an investigation into an entity providing reproductive health care that was allegedly not provided or improperly billed. Individuals would also maintain their right to access their PHI.
The Proposed Rule is available here. Public comments are due by June 16, 2023. A Tribal consultation will be held on May 17, 2023 from 2:00 p.m. to 3:30 p.m. (ET) with advanced participant registration available here. For more information about the Proposed Rule, see the HHS Fact Sheet.
