HHS Proposes HIPAA Changes to Protect Reproductive Health Information

By elizABeth neAl PitmAn And Ashley l thomAs

The U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) recently published a Proposed Rule proposing amendments to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to strengthen privacy protections for reproductive health information. According to OCR, the Proposed Rule is intended to strengthen patient-provider confidentiality and facilitate full exchange of healthcare information between healthcare providers and patients.

As a result of certain state laws passed and pending following the Dobbs v. Jackson Women’s Health Organization decision, there have been growing concerns that law enforcement and others are increasingly likely to request protected health information (PHI) from healthcare providers and others, such as technology vendors, for use against individuals, healthcare providers and others, solely because such persons sought, obtained, provided or facilitated lawful reproductive healthcare services. Developments in the aftermath of Dobbs have made information related to reproductive healthcare more likely to be of interest for punitive non-healthcare purposes. Furthermore, OCR believes that additional privacy protection would reduce the risks that medical records relating to legal reproductive healthcare would be inaccurate or incomplete.

OCR has determined, in accordance with other federal agencies, that information about reproductive healthcare is particularly sensitive and requires heighted protections, similar to the nature and treatment of mental healthcare in psychotherapy notes. OCR acknowledges, that in most cases, information about an individual’s reproductive healthcare includes the kind of highly sensitive information that patients would be reluctant to share if they knew it could be disclosed and used against them, thus leading to inaccurate and incomplete medical records.

OCR set out a proposed definition for reproductive health information (RHI), as a subset of PHI, but recognized the need to establish a shield against certain uses of RHI rather than creating a protected category of information. The proposed restrictions on disclosure are purpose-based as opposed to category-based.

OCR intends to interpret “reproductive healthcare” to include, but not be limited to:

• contraception, including emergency contraception

• pregnancy-related healthcare, including but not limited to miscarriage management, molar or ectopic pregnancy treatment, pregnancy termination, pregnancy screening, products related to pregnancy, prenatal care and similar or related care

• fertility- or infertility-related healthcare

• other types of care, services or supplies used for the diagnosis and treatment of conditions related to the reproductive system

Prohibitions in Disclosures of RHI

Under the Proposed Rule, disclosures of PHI would be prohibited when RHI is sought for the purpose of con- ducting a criminal, civil or administrative investigation into or proceeding against an individual, a healthcare provider or other person in connection with seeking, obtaining, providing or facilitating repro- ductive healthcare that 1) is provided outside of the state where the investigation or proceeding is authorized and where such healthcare is lawfully provided, 2) is protected, required or authorized by federal law, regardless of the state in which such healthcare is provided, or 3) is provided in the state in which the investigation or proceeding is authorized and that is permitted by the law of that state.

The Proposed Rule would also prohibit a covered entity from using or disclosing an individual’s PHI for the purpose of identifying an individual, healthcare provider or other person for