HIPAA and the New Rules Regarding Reproductive Health Care
Conference Panel
by Mark R. Brengelman, JD, MA Attorney at Law
Frankfort, Kentucky
About Mark R. Brengelman
• Holds Bachelor's and Master's Degrees in Philosophy from Emory University, Atlanta, Georgia
• Earned a Juris Doctorate from the University of Kentucky College of Law, Lexington, Kentucky
• Served out a successful twenty-year career with state government in Kentucky, including…. now in private practice since 2012
• Was a former Assistant Attorney General assigned to multiple state licensure boards in health care and other professions – General Counsel and Prosecuting Attorney
• Has presented Continuing Education for over 50 national and state organizations and private companies, including the Kentucky Office of the Attorney General, the Kentucky Bar Association, the National Attorneys General Training and Research Institute, the Federation of Associations of Regulatory Boards, and eight of its member associations in psychology, physical therapy, dentistry, nursing, veterinary medicine, emergency medical services, state licensed contractors, and athletic trainers
• Has represented all three branches of state government and a local municipality in governmental ethics and now a state licensure board in health care.
About Mark R. Brengelman
Represents:
• licensees before state boards and in other professional matters
• a state licensure board
• parents and kids in confidential child abuse and neglect cases, termination of parental rights, and adoption proceedings
I help health care practitioners, kids/parents, and government agencies navigate the law and ethics and make the rules understandable as applied to them
HIPAA and the New Rules
Based upon the content of this program, you will be able effectively to identify:
• The basics of HIPAA privacy requirements
• An introduction to exceptions to HIPAA privacy for law enforcement purposes for civil and criminal matters
• State authority of licensure boards and agencies to exploit HIPAA exceptions against health care practitioners under investigation regarding abortion
• Applicable implementation dates you need to know
• Change in definitions
• Prohibition and Rule of Applicability
• Presumptions made – rebuttable or not?
• Attestations required
• Update to notices of privacy practices
• Disclosures for law enforcement purposes – how this changes everything
HIPAA and the New Rules
Goals of the content of this program – what this does and does not cover:
• Does provide a broad overview of HIPAA confidentiality issues as related specifically to reproductive health records
• Does not cover everything about HIPAA confidentiality, or HIPAA as applied to any specific health care profession
• Does educate the person attending to ask the right questions in their own state, health care facility, and profession about compliance with HIPAA confidentiality and the new rules based on any given situation as they relate to reproductive health records
HIPAA and the New Rules
The basics of HIPAA requirements for patient records – federal right of privacy:
• State law privacy rights
• Medical confidentiality as found in state licensure laws, especially in mental health, less in physical medicine (such as physical therapy)
• Medical confidentiality found in national and state codes of ethics (most usually non-binding!)(see Elvis Presley impersonator’s code of ethics)
• State rules of evidence for privileged communications
HIPAA and the New Rules
An introduction:
• This webinar starts with some basic HIPAA privacy requirements and then diverts to initiate an introduction to a review of the law enforcement exceptions that allow state civil investigative agencies and criminal prosecutors to exploit HIPAA rules for various law enforcement purposes to obtain medical records of abortion
• The federal government has now tightened these law enforcement exception loopholes and resolved various conflict of laws issues between the states – where one state may outlaw abortion and the other state may allow it
• Key question: Can one travel back and forth for abortion care?
• Our goal is to have a basic understanding of HIPAA and how state agencies and law enforcement investigate for alleged violations of law, which now include a woman’s right to choose in states where abortion is illegal
• In the post-Roe vs. Wade healthcare world, healthcare practitioners must understand how HIPAA privacy applies to their medical records of abortion, as well as the law enforcement exceptions that may swallow the rule
• Attempting to close these loopholes, new federal HIPAA protections are in place for medical records regarding reproductive health care, including abortion
• Let’s ask: do these new federal rules answer all the pending questions?
• Let’s ask: do these new federal rules close all the loopholes that may exist between competing state laws?
HIPAA and the New Rules
The basics of HIPAA law enforcement exceptions for patient records:
• Many exceptions for law enforcement officials to obtain records or for law enforcement purposes as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests (administrative subpoenas for state agencies involved in investigations), or to identify or locate a suspect, fugitive, material witness, or missing person
• Except for the above, covered entity may not disclose PHI without the written consent of the patient – written consent required or notification to the patient and time to object
• This was not new to mental health practitioners; lots of continuing education on HIPAA and changes
• Individual patient rights to limit release of PHI; example: to be called on work phone instead of home phone; patient rights to be provided in writing
HIPAA and the New Rules
The basics of HIPAA exceptions for law enforcement purposes – these are different from public health exceptions:
• Many exceptions for law enforcement officials to obtain records for law enforcement purposes as required by law (including court orders, court-ordered warrants, subpoenas), or to identify or locate a suspect, fugitive, material witness, or missing person
• Law enforcement exceptions can be for either criminal or civil purposes – these will both apply here
• Many exceptions for law enforcement officials to obtain records in administrative requests (administrative subpoenas for state agencies involved in civil investigations) such as state licensure boards
• Except for the above law enforcement exceptions (or other applicable exception), a covered entity may not disclose PHI without the written consent of the patient – written consent required or notification to the patient and time to object
HIPAA and the New Rules
Overview of Dobbs v. Jackson Women’s Health Organization, United States Supreme Court, June 24, 2022;
• Upheld Mississippi law banning abortion after 15 weeks of gestation – vote 6 to 3 to uphold that law
• Overruled Roe v. Wade, United States Supreme Court, January 22, 1973, and Planned Parenthood v. Casey, United States Supreme Court, June 29, 1992 – the vote was 5 to 4 to overrule these precedents
• Holding: no federal constitutional right to an abortion; returned the issue to the states under state laws and state constitutions
• Opinion: they got what they wanted – overturning a federal, constitutional privacy right to abortion and returning the issue to the states; Note current legislative and state constitutional efforts underway
• Opinion: we are living in a two-tiered United States with a woman’s right to reproductive choices
• New HIPAA law was designed to clarify those boundaries between the states
• Comment: This is the first time a prior Supreme Court case was overruled to limit personal freedoms
• Comment: the inherent right to privacy in the federal constitution is not found to apply to abortion; it does apply to many other personal rights (interracial marriage, contraception, sexual conduct between consenting adults, gay marriage)
• Comment: “Watch out – you’re next”; The majority took great pains to say this applied only uniquely to abortion; but Justice Clarence Thomas issued a concurring opinion “watch out – you’re next” taking aim at contraception, sexual conduct between consenting adults, and gay marriage……..
• ……..but not interracial marriage; why, I wonder?
What is the reaction of the legal profession?
HIPAA and the New Rules
• “I’m A Health Care Attorney. Here are the Dangers my Doctors Face now that Roe is Gone.” Huffington Post, July 6, 2022; from a hospital attorney: “The police are in the emergency department demanding information about one of our patients. They are threatening our staff with jail if they fail to provide copies of medical records. They don’t have a warrant or subpoena. Should we give them the records and likely violate the privacy law known as HIPAA, or is there another course of action?”
• Answer: “Our providers turn to attorneys because they are looking for a black and white answer to the problem they are facing. Occasionally, I get to tell them that there is, in fact, a law that is directly on point given the facts of the situation. But those situations are rare. We are working through gray, and when we do finally create an action plan, we are sometimes left with lingering questions about whether it was the right thing to do, morally, ethically and sometimes legally.”
• “‘Sea Change In The Law’: Inside One Firm’s Post-Roe Practice, Law360, August 16, 2022
• “The U.S. Supreme Court’s nullification of the constitutional right to abortion has ushered in ‘transformative’ changes for health care attorneys and become one of the rare events to which entirely new practice groups can be devoted[.]”
• Entire new practice groups or sub-groups are created: “Those [health care and reproductive] topics are vast and varied, spanning digital health, workplace issues at hospitals and pharmacies, the privacy of personal medical records concerning pregnancy, new compliance obligations underlying health care reimbursement, and potential criminal charges against individuals and organizations involved in abortion care.”
HIPAA and the New Rules
The limits of HIPAA as applied to other information:
• HIPAA does not apply to entities, businesses, and people outside of health care that might have access to a person’s medical information
• Example: If you told your friends you were going to the abortion clinic, if you posted it on social media, if you requested a vacation day from work – none of that information is protected by HIPAA
• Advocates for abortion rights and various companies are voicing concerns that law enforcement officials will move to subpoena app developers, website operators, wireless carriers and others that hold information which could be used to help determine an individual’s movements and the intent behind them
Applicable implementation dates you need to know:
HIPAA and the New Rules
• Issued April 22, 2024 (published April 26, 2024): federal Final Rule promulgated titled “HIPAA Privacy Rule to Support Reproductive Health Care Privacy”
• Basic rule: prohibits disclosure of PHI related to lawful reproductive health care in certain circumstances
• Final Rule issued after applicable federal notice and comment rulemaking process
• Why? Comments were filed by medical communities asserting changes were needed to protect better patient confidentiality and to prevent medical records from being used against people for obtaining or providing lawful reproductive health care
• Issued April 22, 2024 (published April 26, 2024)
• Effective date: June 25, 2024
• Compliance date: December 23, 2024 (date persons subject to this new federal regulation shall comply with the applicable requirements of this law, except for the Notice of Privacy Practices
• Compliance date: February 16, 2025 (date persons subject to this new federal regulation shall comply with its Notice of Priv Practices)
Change in definitions:
HIPAA and the New Rules
• “Public Health” as used in the terms “public health surveillance,’’ ‘‘public health investigation,’’ and ‘‘public health intervention,’’ means:
• Population-level activities to prevent disease in and promote the health of populations, including identifying, monitoring, preventing, or mitigating ongoing or prospective threats to the health or safety of a population, which may involve the collection of PHI
• Does not include those with any of the following purposes: (1) To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating health care. (2) To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating health care. (3) To identify any person for any of the activities described at paragraphs (1) or (2) of this definition
• “Reproductive Health Care” means health care, as defined in this section, that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes. This definition shall not be construed to set forth a standard of care for or regulate what constitutes clinically appropriate reproductive healthcare
• Why were these changes important?
• Clearly may encompass abortion, hormone and drug therapy for gender dysphoria, surgical procedures related to gender dysphoria, and gender experimentation or issues
HIPAA and the New Rules
Conclusions – top takeaways as set forth by Health and Human Services:
• “The Supreme Court’s overturning of Roe v. Wade has changed the legal landscape as several states have enacted laws banning or significantly restricting access to abortion”
• “This changing legal landscape increases the likelihood that an individual’s PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect, including the trust of individuals in health care providers and the health care system”
• “As a result, patients are increasingly concerned about the confidentiality of information they share with their health care providers out of fear that their information may be used by or shared with law enforcement”
• “The HIPAA Privacy Rule to Support Reproductive Health Care Privacy protects trust between individuals and health care providers by ensuring that PHI cannot be used or disclosed to investigate or impose liability on someone for the mere act of seeking, obtaining, providing, or facilitating legal reproductive health care”
HIPAA and the New Rules
Conclusions – top takeaways as set forth by Health and Human Services:
• “The new rule prohibits the use of PHI, keeps this information safe, and ensures people have access to highquality health care”
• “The new rule prevents the use or disclosure of PHI to investigate or impose liability on anyone for the mere act of seeking, obtaining, providing, or facilitating legal reproductive health care - among many things, this means that if a person lives in one state and travels to another state to receive lawful reproductive health care in that other state, neither that person’s health care provider nor health plan can share that information if someone tries to investigate that person for obtaining that lawful reproductive health care in the state where it was lawful”
HIPAA and the New Rules
Conclusions – top takeaways as set forth by Health and Human Services:
• “Protecting the privacy of patient health information is essential - The Supreme Court’s decision altered the legal and health care landscape and increased the likelihood that PHI about a person’s reproductive health may be used or disclosed in a way that undermines patient trust in the privacy of their communications with their providers”
• “A woman may leave her home state where abortion is significantly restricted or banned to receive lawful reproductive health care in another state - patients should feel confident in the privacy of their PHI and should not avoid obtaining lawful health care in another state or disclosing previous lawful health care to providers because they fear that their PHI will be disclosed”
• “The law will help ensure that patients can access the care they need without fear that their medical records will be used against them, their provider, or their loved ones—and help ensure that providers can speak freely with their patients and deliver high-quality care”
HIPAA and the New Rules
Conclusions – top takeaways as set forth by Health and Human Services:
• The law secures PHI in this way, keeps it safe, and ensures that people have access to high-quality health care
• The HIPAA Privacy Rule to Support Reproductive Health Care Privacy prevents the use or disclosure of PHI to investigate or impose liability on anyone for the mere act of seeking, obtaining, providing, or facilitating legal reproductive health care
• Conflict of laws resolution: Among many things, this means that if a person lives in one state and travels to another state to receive lawful reproductive health care, neither the patient or their health care provider nor health plan can share that information if someone tries to investigate a person for obtaining that lawful reproductive health care
• “No matter where you live, no one should have their medical records used against them, their doctor, or their loved one just because they sought or obtained lawful reproductive health care [in the state where it was lawful]”
Register Now
