HHS Extends Protections for Reproductive Privacy Under HIPAA

On April 22, 2024, the U.S. Department of Health and Human Services’ Office for Civil Rights announced its final “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” (the “Final Rule”). The Final Rule strengthens privacy protections under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) for reproductive health care-related protected health information (“PHI”).

The Final Rule modifies the HIPAA Privacy Rule to limit the circumstances in which PHI about reproductive health care can be used or disclosed for certain non-health care purposes, where the uses or disclosures could be detrimental to “the privacy of the individual or another person,” or “the individual’s trust in their health care providers.”

Specifically, the Final Rule prohibits covered entities and their business associates from using or disclosing PHI for the purpose of:

• Conducting a criminal, civil or administrative investigation into any “person” (i.e., any natural person (a human being who is born alive), trust or estate, partnership, corporation, professional association, or other entity, public or private) or imposing criminal, civil or administrative liability on any person for seeking, obtaining, providing or facilitating lawful reproductive health care; or
• Identifying any person for the purpose of conducting such investigation or imposing such liability.

Under the Final Rule, a covered entity or business associate in receipt of a request for PHI potentially related to reproductive health care must obtain a signed attestation from the requestor representing that the requested use or disclosure of such PHI is not intended for a prohibited purpose. The Final Rule continues to allow covered entities and business associates to use or disclose PHI for purposes otherwise permitted under the Privacy Rule where the request for the use or disclosure of PHI is not made to investigate or impose liability on any person for seeking, obtaining, providing or facilitating reproductive health care.

The Final Rule will become effective on June 25, 2024 (i.e., 60 days after publication in the Federal Register).

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts