New HIPAA Final Rule: Key Changes to Reproductive Health Care Privacy

Epstein Becker Green

 The U.S. Supreme Court’s 2022 decision in Dobbs v. Jackson Women’s Health Organization to eliminate the federal constitutional right to abortion continues to alter the legal landscape across the country.

On April 26, 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights published a final rule entitled the “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” (the “Final Rule”).

The Final Rule—amending the Standards for Privacy of Individually Identifiable Health Information (the “Privacy Rule”) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as well as the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009—strengthens privacy protections related to the use and disclosure of reproductive health care information. HIPAA’s Privacy Rule limits the disclosure of protected health information (PHI) and is part of HHS’s efforts to ensure that patients will not be afraid to seek health care from, or share important information with, health care providers.

What are the key takeaways from the Final Rule?

• New Definition of PHI: The Final Rule redefines PHI regarding reproductive health care, prohibiting disclosures for investigations or liability based solely on the seeking or provision of such care.

• Conditions for Disclosure: Covered entities must confirm that the reproductive health care in question is lawful in the respective state or federally protected, ensuring compliance with legal standards.

• Legal Presumption: Reproductive health care is deemed lawful unless there's evidence to the contrary or actual knowledge of illegality under the given circumstances.

• Attestation Requirement: Entities must obtain a signed attestation from requesters of PHI related to reproductive health care, requiring clear identification and affirmations regarding the lawful purpose of the request.

• Policy Updates: Covered entities are mandated to revise their Notices of Privacy Practices to align with the new regulations and clearly communicate the prohibitions and attestation requirements.

• Major Regulatory Impact: The Office of Management and Budget has classified the Final Rule as a major rule due to its significant projected economic impact, exceeding $100 million annually on affected entities.

More Information, How to Register