Following the Supreme Court opinion Dobbs v. Jackson Women’s Health Organization that overturned the longstanding Roe v. Wade and Planned Parenthood v. Casey, the constitutional right to abortion vanished. Almost immediately states began enacting and enforcing total or near total abortion bans. These bans threatened revocation of medical licensure for professionals who provided certain types of reproductive health care like abortions, as well as felony charges, fines, and other penalties for those that assist a pregnant person in obtaining reproductive health care. Some states also enacted laws that punish individuals who assist someone traveling out of state for reproductive health care. Although they are currently not being enforced, the specter of enforcement exists.

The rapid changes and uncertainty of those changes altered the delivery of reproductive health care in the United States. It also generated an inherent mistrust between health care providers and patients in states that have legal limits to seeking certain sexual and reproductive health services, primarily abortion. Patients who were seeking reproductive health care or who had already obtained reproductive health care would understandably be concerned and likely fearful about confiding in their providers with this information for fear of being reported to authorities for violating state law.

As a result, the HHS proposed to modify the original privacy rules to protect reproductive healthcare following the Dobbs decision. HHS felt it necessary to assure patients that their reproductive healthcare information would be safeguarded.

The standards for privacy of individually identifiable health information are regulated by the under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). Effective June 25, 2024, the Department of Health and Human Services’ (HHS) issued the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy (2024 HIPAA Privacy Rule). It has two components that prohibits entities and their business associates from the following:

• Using or disclosing protected health information (PHI) for the purpose of imposing or conducting an investigation to impose liability (civil, criminal, or administrative) for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care

• Disclosing PHI that may be used to identify any individual for the purpose of imposing liability for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care

In addition, the 2024 HIPAA Privacy Rule

• Creates a presumption that reproductive health care was provided lawfully unless certain circumstances exist
• Defines reproductive health care and provides a non-exhaustive list for what can be considered reproductive health care
• Requires covered entities and their business associates to obtain a valid attestation before they can disclose PHI potentially related to reproductive health care for certain uses

HHS defines reproductive health care broadly as health care “that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.”

Covered entities under HIPAA include health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form related to complete health care transactions. Business associates are those who assist covered entities with their health care functions such as medical transcriptionists and third party administrators.

Anyone requesting PHI related to reproductive health will have to submit an attestation that the PHI is for health care oversight activities; judicial or administrative proceedings; law enforcement purposes; or disclosures about decedents (e.g., coroners). This attention is made under penalty of perjury.

All covered entities must comply with the rule’s final requirements by December 23, 2024.

Resources:

HIPAA Privacy Rule To Support Reproductive Health Care Privacy

Final Rule HIPAA Privacy Rule to Support Reproductive Health Care Privacy

Reproductive Privacy Rule to Protect Both Patients and Physicians