On April 22, 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a Final Rule under the Health Insurance Portability and Accountability Act (HIPAA) to support reproductive health care privacy. The Final Rule modifies the Standards for Privacy of Individually Identifiable Health Information (known as the Privacy Rule) under HIPAA, and is intended to protect the privacy of information concerning reproductive care, including abortion, in vitro fertilization and birth control. HHS explained that the Final Rule “strengthens privacy protections for medical records and health information for women, their family members, and doctors who are seeking, obtaining, providing, or facilitating lawful reproductive health care.”
Key provisions of the Final Rule include: (1) “prohibiting the use or disclosure of protected health information (PHI)” when sought to investigate or impose liability on individuals, health care providers, or others “seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided”; (2) requiring a regulated health care provider, health plan, clearinghouse, or their business associates to obtain a signed attestation that certain requests for PHI potentially related to reproductive health care are not for the prohibited purposes; and (3) requiring regulated health care providers, health plans, and clearinghouses to modify their Notice of Privacy Practices to support reproductive health care privacy. This privacy rule applies only where the covered entity or business associate in possession of the information has reasonably determined that the reproductive health care is lawful under either state or federal law where the care is provided. Information subject to the new privacy protections may be disclosed if the requesting party provides an attestation that the use or disclosure of the information does not violate the rule.
The Final Rule is scheduled to be published in the Federal Register on April 26, 2024. The new regulations are effective 60 days after publication in the Federal Register and entities covered by HIPAA must update their privacy policies no later than February 16, 2026.
AHA News adds: “The rule will take effect 60 days after publication in the Federal Register and require covered entities to comply within 240 days. As requested by the AHA, OCR plans to issue a model attestation form before the compliance date.”