New HIPAA Privacy Rules and Key Issues for Group Health Plans: Challenges for Plan Sponsors and Administrators

BARBRI

This CLE webinar will provide employee benefits counsel and advisers an in-depth analysis of the U.S. Department of Health and Human Services' Office for Civil Rights' (OCR) final rule amending HIPAA privacy regulations. The panel will discuss the final rule's requirements for regulated entities and under what circumstances they are prohibited from disclosing reproductive healthcare information. The panel will also address the dilemma facing regulated entities when determining whether to comply with state laws requiring the disclosure of RHI or HIPAA's privacy prohibitions and offer best practices for compliance.

Description

The OCR recently published a final rule amending the HIPAA privacy rule that provides new protections for the privacy of reproductive healthcare information. The rule requires compliance by Dec. 23, 2024, with the exception of the notice of privacy practices provisions requiring compliance by Feb. 16, 2026.

The final rule restricts circumstances under which HIPAA-covered entities, health plans, and their business associates (regulated entities) may disclose reproductive healthcare information by prohibiting its use or disclosure to conduct a criminal, civil, or administrative investigation into a person or to impose civil, criminal, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive healthcare that is lawful under the circumstances in which it was provided.

Under the rule, regulated entities that receive requests for reproductive healthcare information related to law enforcement, judicial, or administrative purposes must obtain a signed attestation from the requestor to verify that the use or disclosure of the reproductive healthcare information is not prohibited as described in the rule. The rule allows for healthcare providers to presume the healthcare provided was lawfully under the circumstances it was provided unless they have actual knowledge or factual information to the contrary.

Regardless, the rule now puts regulated entities in the difficult position of deciding whether to comply with a state law requirement to disclose information or the HIPAA privacy prohibition.

In addition, regulated entities must revise their notice of privacy practices to reflect the rule changes and also to address proposed changes made in the NPRM for the Confidentiality of Substance Use Disorders which were finalized in connection with this rule.

Listen as our panel discusses the final rule's requirements for HIPAA-covered entities, health plans, and their business associates and under what circumstances they are prohibited from disclosing reproductive healthcare information.

More Information, How to Register