On April 22, 2024, the Office of Civil Rights issued a Final Rule titled HIPAA Privacy Rule to Support Reproductive Health Care Privacy (2024 Final Privacy Rule). The 2024 Final Privacy Rule is a narrowing of the general Health Insurance Portability and Accountability Act (HIPAA) disclosure rule that allows covered entities to disclose protected health information (PHI) in specified instances. Although other laws may require additional disclosures, to comply with the 2024 Final Privacy Rule, a covered entity is only required to disclose PHI to the individual the PHI belongs to and to the individual’s personal representative. All other disclosures are permissive. This Final Rule is one of many actions taken by the U.S. Department of Health and Human Services (HHS) to protect access to and privacy of reproductive healthcare after the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization that has led to state abortion bans and other restrictions.
This article proposes that covered entities only make the required HIPAA disclosures and discusses compliance hurdles that covered entities may face when refusing to provide requested information in permissive circumstances. This discussion and the suggestions are restricted to the context of reproductive healthcare.
Two weeks after, and in response to, the Dobbs decision, President Biden signed Executive Order 14076, Protecting Access to Reproductive Healthcare Services. The Executive Order set forth a plan for the federal government to “protect healthcare service delivery and promote access to critical reproductive healthcare services, including abortion,” in line with the Biden Administration’s pro-choice policy. In addition to protecting access itself, one of the components of the Executive Order was the protection of privacy, safety, and security, including patient data related to reproductive healthcare services.
The Executive Order directed the Secretary of HHS and the Director of the Gender Policy Council to create an Interagency Task Force on Reproductive Healthcare Access in furtherance of the goals presented. One of the steps taken to “protect and strengthen access to contraception” was the modification of HIPAA to strengthen privacy protections by prohibiting physicians, other providers, and health plans from using or disclosing individuals’ PHI related to lawful reproductive healthcare.
The 2024 Final Privacy Rule amended 45 CFR 164.512 (and other provisions on the use and disclosure of PHI) by:
Since Dobbs v. Jackson Women’s Health Organization overturned Roe v. Wade in 2022, 22 states have enacted abortion bans or restrictions. In 14 of those states, abortion is banned in almost all circumstances. The remaining seven states have gestational limits, banning abortion after a designated number of weeks of pregnancy. The most restrictive of these, Florida, Georgia, Iowa, and South Carolina, all enforce six-week gestational limits. Nebraska and North Carolina prohibit abortions after 12 weeks of pregnancy, Arizona after 15 weeks, and Utah after 18 weeks.
These bans impose significant criminal liabilities and civil penalties. For example, Texas’s Human Life Protection Act makes the performance, inducement, or attempt of an abortion a felony of either the second degree (if the fetus survives) or the first degree (if the abortion is completed); violators are subject to a civil penalty of not less than $100,000 for each violation as well as attorney’s fees and costs; and the appropriate licensing authority shall revoke the license of the abortion provider who violated the ban.
In addition to criminalizing abortion and creating civil penalties that can be brought by state attorneys general, Texas has created a private right of action for individual citizens to sue abortion providers and individuals who assist patients seeking an unlawful abortion. Civil liability extends to those who “knowingly engag[e] in conduct that aids or abets the performance or inducement of an abortion, including paying for or reimbursing the costs of an abortion through insurance or otherwise.” If the claimant wins their suit, they are awarded injunctive relief to prevent future violations by the defendant, statutory damages not less than $10,000 for each abortion performed or aided by the defendant, and costs and attorney’s fees. The statute provides two affirmative defenses, limited only to individuals accused of aiding or abetting who reasonably believed that the abortion provider had or would comply with the subchapter. There are no affirmative defenses for the providers themselves, and arguments on the constitutionality of the law are explicitly not defenses since state officials are not directly or indirectly involved in the law’s enforcement.
Under 45 CFR 164.524, the HIPAA Privacy Rule, individuals and their personal representatives have access to PHI. Healthcare facilities and other covered entities are required to provide such information within 30 days of receiving a request from an individual. On August 1, 2022, HHS announced the imposition of a civil monetary penalty of $115,200 for failure to provide timely access to patient records. This civil monetary penalty marks the Office of Civil Rights’ (OCR) 49th HIPAA right of access enforcement action.
There are two categories of information that are expressly excluded from an individual’s right of access. These are:
This right of access is extended to “personal representatives” of the individual. If a personal representative requests the information, the 30-day time limit also applies to such request. In addition, the 30-day limit is not tolled while the covered entity reviews the validity of the claim of being a personal representative. An individual’s personal representative is a person with authority under applicable state law to make healthcare decisions for the individual.
In addition to being required to disclose PHI to individuals and personal representatives, the privacy rule permits covered entities to disclose PHI without the individual’s written authorization or an opportunity to agree or object under specified circumstances. This article only discusses those permitted instances that relate to law enforcement or judicial processes.
Under 45 CFR 164.512:
Unlike the required disclosure to the individual and the individual’s personal representatives, this provision of the HIPAA Privacy Rule is permissive, and the healthcare facility or covered entity is not required by HIPAA to disclose the information.
Under the 2024 Final Privacy Rule, prior to providing information to an individual’s personal representative or under any of the permissive provisions of 45 CFR 164.512, the covered entity is required to obtain an attestation that the PHI that is sought is not for the purposes of investigating or imposing liability on individuals merely for seeking, obtaining, providing, or facilitating lawful reproductive healthcare.
At the end of July, HHS OCR provided a Model Attestation Form for the Requested Use of Protected Health Information Potentially Related to Reproductive Health Care. The attestation reminds the person signing it that federal law prohibits any individual from improperly obtaining PHI. Knowingly obtaining PHI under false pretenses could result in a penalty of up to $100,000 and five years in prison.
A covered entity should adopt a policy to only provide PHI related to reproductive healthcare when required in response to a request from the individual to whom the PHI relates or a personal representative. The covered entity will be required to obtain a signed attestation form that is either the model or one that meets the requirements of the model to disclose the information to the personal representative but not to the individual. When requested to provide the information in the three permissive categories (cases of abuse, judicial or administrative proceeding or as required by law), the covered entity may refuse even with the completed attestation. What does that mean if the covered entity receives the request as part of a judicial or administrative proceeding?
The HIPAA Privacy Rule prohibits covered entities and their business associates from disclosing PHI in response to judicial and other administrative proceedings unless certain conditions are satisfied.
What does that mean when the covered entity receives a court order or a subpoena? Under the 2024 HIPAA Privacy Rule, a covered entity is not required to provide PHI that relates to seeking, obtaining, providing, or facilitating lawful reproductive healthcare. Providing that PHI is permissive when responding to a subpoena or court order. The 2024 Final Privacy Rule requires that the covered entity obtain an attestation that the PHI that is sought is not for the purposes of investigating or imposing liability on individuals merely for seeking, obtaining, providing, or facilitating lawful reproductive healthcare.
What should the covered entity do when receiving a subpoena or court order? If the covered entity is named as a party to the litigation (e.g., that plaintiff or defendant), the covered entity should notify its attorney. PHI may be disclosed during litigation subject to the “minimum necessary rules” of HIPAA. If the covered entity is not a party, then the attorney for the covered entity should determine if the court or agency has jurisdiction over the covered entity. For example, if an individual who is a resident of Texas seeks an abortion in California, a subpoena or court order issued from Texas to the California provider would not have jurisdiction over that provider. If the subpoena or court order is issued to a health plan sponsored by an employer with offices in Texas, then a Texas court may have jurisdiction over that health plan. If it is determined that there is jurisdiction, then the covered entity may not ignore the subpoena or court order without risk of contempt even though HIPAA limits such disclosure without the attestation.
If the request for PHI is for the purposes of investigating or imposing liability on Texas individuals for seeking, obtaining, providing, or facilitating lawful reproductive healthcare and the attestation is not provided, then the covered entity may petition the court for a protective order or move to quash the subpoena or court order. The covered entity should contact an attorney immediately if the PHI is requested and the required attestation is not provided. The attorney may recommend that the covered entity seek a protective order.
On September 4, the State of Texas filed an action seeking declaratory and injunctive relief again enforcement of the 2024 Final Privacy Rule. In addition, the suit seeks to challenge the portion of the original HIPAA privacy rule (the 2000 Privacy Rule) that limits disclosures to state investigators. The 2024 Final Privacy Rule cites 45 CFR 160.104 as the authority to adopt Part 164. Under that provision, the Secretary has the right to adopt modifications to a standard or implementation specification adopted under subchapter C (Administrative Data Standards and Related Requirements). The statutory basis for the Part 164 (Security and Privacy) is enumerated in 45 CFR 164.102. Part C of title XI of the Act, section 264 of Public Law 104-191 requires that HHS promulgate final regulations containing standards and the expectation was that these would have been submitted to Congress and also that the Secretary would have consulted with the National Committee on Vital and Health Statistics and the attorney general.
The Texas suit claims that the HIPAA statute explicitly preserved state investigative authority and did not give the defendants any authority to “promulgate how regulated entities may share information with State governments.” Texas requests that the court invalidate both the 2024 Final Privacy Rule and the 2000 Privacy Rule on the basis that the rules “significantly harm the State of Texas’s investigative abilities because covered entities frequently cite the 2000 Privacy Rule as a reason that they cannot comply with a valid investigative subpoena for documents and have already begun invoking the 2024 Privacy Rule for similar purposes.”
To ensure compliance with the 2024 Final Privacy Rule’s heightened privacy protections over reproductive healthcare information, covered entities should limit disclosure of such reproductive healthcare PHI to required disclosures and stop making permissive disclosures. Covered entities will need to review and amend their internal HIPAA policies and procedures related to providing reproductive healthcare information with and without authorizations. Covered entities and business associates should review the 2024 Final Privacy Rule and create a compliance plan with respect to updating policies and procedures, health plan documents, business associate agreements, and privacy notices. Staff must receive training on the new requirements. If a covered entity adopts the recommendation to not provide PHI in response to those above listed permissive categories even with a signed attestation, the covered entity will need to engage counsel if there is a challenge.
