HHS PROPOSED REPRODUCTIVE HEALTHCARE RULE

On April 12, 2023, the Department of Health and Human Services’ (“HHS”) Office for Civil Rights (“OCR”) released a proposed rule (the “Rule”) that would modify the HIPAA Privacy Rule to include stricter standards for the use or disclosure of PHI to investigate or prosecute patients, providers, and others receiving, providing, or involved in reproductive health care. 

Following Dobbs v. Jackson Women’s Health Organization, the Supreme Court decision that overturned Roe v. Wade in June 2022, OCR issued additional guidance for providers regarding disclosing PHI related to reproductive health care. Currently, the HIPAA Privacy Rule permits, but does not require, providers to disclose PHI when (1) required by law; (2) for law enforcement purposes; and (3) averting serious threats to health and safety. Guidance issued soon after the Dobbs decision clarified that providers may only release information in these permitted circumstances, such as in response to a court order, but that they were not explicitly required by the HIPAA Privacy Law to do so. 

However, the Rule would enhance protections for PHI related to reproductive health care by prohibiting “the use or disclosure of PHI for the criminal, civil, or administrative investigation of or proceeding against an individual, regulated entity, or other person” who may have received or been involved in the provision of such services. Additionally, the Rule would create a new category of PHI, defining “reproductive health care” as “care, services, or supplies related to the reproductive health of the individual.” This definition is broad enough to include fertility treatments. 

The Rule would specifically prohibit disclosing PHI in three situations: 

1. Reproductive health care is “sought, obtained, provided, or facilitated in a state where the health care is lawful and outside of the state where the investigation or proceeding is authorized. For example, if a patient’s state of residence prohibits a procedure and they travel into another state that allows that procedure, healthcare providers are prohibited from releasing PHI as a result of any investigation occurring in the patient’s home state. 

2. When reproductive health care is “protected, required, or expressly authorized by federal law, regardless of the state in which such health care was provided.” This provision refers to reproductive care mandated under the Emergency Medical Treatment and Labor Act (“EMTALA”), which requires providers to stabilize a pregnant person experiencing an emergency medical condition. 

3. Reproductive health care is “provided in the state where the investigation or proceeding is authorized and is permitted by law of the state in which such health care is provided.” In states where reproductive health care is legal, including abortion services, providers may not disclose PHI to any law enforcement. 

OCR reports that the Rule has been proposed in response to providers nationwide seeking clarification of their legal rights and responsibilities. The Rule’s comment period closes June 16, 2023. OCR is expected to publish a final rule after that time.