HHS issues final reproductive privacy rule

The U.S. Department of Health and Human Services (HHS) issued a final rule on April 22, 2024, regarding the privacy of individuals’ reproductive health.

The rule, entitled HIPAA Privacy Rule to Support Reproductive Health Care Privacy, amends the Health Insurance Portability Act of 1996 (HIPAA) privacy rule by prohibiting the disclosure of protected health information (PHI) related to lawful reproductive health care in certain circumstances.

The HIPAA privacy rule requires most health care providers, health plans, health care clearinghouses, and business associates (collectively, “regulated entities”) to safeguard the privacy of PHI and sets limits and conditions on the uses and disclosures of such information.

The final rule:

• Prohibits the use or disclosure of PHI when it is sought to investigate or impose liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate reproductive health care that is lawful under the circumstances in which such health care is provided, or to identify persons for such activities.
• Requires regulated entities to obtain a signed attestation that certain requests for PHI potentially related to reproductive health care are not for these prohibited purposes.
• Requires regulated entities to modify their Notice of Privacy Practices to support reproductive health care privacy.

This applies where regulated entities have reasonably determined that one or more of the following conditions exists:

• The reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided.
  • If, for example, a resident of one state traveled to another state to receive reproductive health care that is lawful in the state where such health care was provided.
• The reproductive health care is protected, required, or authorized by federal law, including the U.S. Constitution, regardless of the state in which such health care is provided.
  • If, for example, use of the reproductive health care, such as contraception, is protected by the Constitution.
• The reproductive health care was provided by a person other than the regulated entity that receives the request for PHI was lawful.

The final rule is scheduled to be published in the Federal Register on April 26, become effective 60 days after that, and regulated entities must comply 240 days after publication.

Employers that sponsor group health care plans should be familiar with this change, work with their brokers on any related changes, and be ready for questions from employees.

Key to remember: HIPAA-regulated entities have more protection under a final rule regarding reproductive health care but should retrain those who work with PHI to understand when it may be disclosed and to whom.