New Rules Bolster Reproductive Health Care Privacy Under HIPAA

WASHINGTON — The Biden administration is bolstering existing HIPAA health care privacy rules to provide added protection to women lawfully exercising their right to terminate a pregnancy. The rules will also extend to a woman’s family members and doctors.

The Department of Health and Human Services said it issued the new rule, entitled the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, after hearing from communities that changes were needed to better protect patient confidentiality and prevent medical records from being used against them.

According to the department, the new rule will strengthen patient-provider confidentiality and help promote trust and open communication between individuals and their health care providers or health plans.

“Many Americans are scared their private medical information will be shared, misused and disclosed without permission,” said Health and Human Services Secretary Xavier Becerra in a written statement.

“This has a chilling effect on women visiting a doctor, picking up a prescription from a pharmacy, or taking other necessary actions to support their health,” he said, adding, “With reproductive health under attack by some lawmakers, these protections are more important than ever.”

The announcement of the new rule never explicitly uses the word abortion, the administration preferring the term “lawful reproductive health care” or “lawful reproductive health care under certain circumstances.”

However, the intent of the new rule is clear.

Becerra, for instance, refers to “providing stronger protections to people seeking lawful reproductive health care regardless of whether the care is in their home state or if they must cross state lines to get it.” 

As HHS Office of Civil Rights Director Melanie Fontes Rainer explained in a statement, “Since the fall of Roe v. Wade, providers have shared concerns that when patients travel to their clinics for lawful care, their patients’ records will be sought, including when the patient goes home. 

“Patients and providers are scared, and it impedes their ability to get and to provide accurate information and access safe and legal health care,” Rainer said. 

“Today’s rule prohibits the use of protected health information for seeking or providing lawful reproductive health care and helps maintain and improve patient-provider trust that will lead to improved health outcomes and protect patient privacy,” she added.

Rainer’s office administers and enforces the HIPAA Privacy Rule, which requires most health care providers, health plans, health care clearinghouses, and other regulated entities to safeguard the privacy of personal health information and sets limits and conditions on its uses and disclosure. 

The HIPAA Privacy Rule also gives individuals certain rights over their personal health information. 

The Office of Civil Rights published its proposed modifications to HIPAA in April 2023 to address changes in the legal landscape affecting reproductive health care privacy.

In the end, that publication led to the submission of nearly 30,000 comments from the public, all of which were reviewed and considered before the final rule was drafted.

The new rule:

• Prohibits the use or disclosure of personal health information when it is sought to investigate or impose liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate reproductive health care that is lawful under the circumstances in which such health care is provided, or to identify persons for such activities.

• Requires a regulated health care provider, health plan, clearinghouse, or their business associates, to obtain a signed attestation that certain requests for personal health information potentially related to reproductive health care are not for these prohibited purposes.

• Requires regulated health care providers, health plans, and clearinghouses to modify their Notice of Privacy Practices to support reproductive health care privacy.

The new rule will go into effect 60 days after it is published in the Federal Register. The department advises women and their families who feel their privacy or other rights have been violated to file a complaint with the HHS Office for Civil Rights at: https://www.hhs.gov/hipaa/filing-a-complaint/index.html.

Dan can be reached at [email protected] and at https://twitter.com/DanMcCue