HHS Issues Final Rule on HIPAA Privacy for Reproductive Health
April 22, 2024
The federal government has released a new final rule that seeks to strengthen patient privacy protections, prohibiting the disclosure of protected health information (PHI) related to lawful reproductive health care.
The final rule, announced this morning, comes after 30,000 public comments, and seeks to “protect patient confidentiality and prevent medical records from being used against people for providing or obtaining lawful reproductive health care.”
It follows uncertainty around reproductive health care access and disclosure following the 2022 Dobbs ruling in the U.S. Supreme Court.
“Today’s rule prohibits the use of protected health information for seeking or providing lawful reproductive health care and helps maintain and improve patient-provider trust that will lead to improved health outcomes and protect patient privacy,” Office for Civil Rights Director Melanie Fontes Rainer said in a statement.
Federal officials held a press conference this morning to announce the updates to the federal privacy rules.
The final rule:
- Prohibits the use or disclosure of PHI when it is sought to investigate or impose liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate reproductive health care that is lawful “under the circumstances in which such health care is provided, or to identify persons for such activities.”
- Requires a regulated health care provider, health plan, clearinghouse, or their business associates, to obtain a signed attestation that certain requests for PHI potentially related to reproductive health care are not for these prohibited purposes.
- Requires regulated health care providers, health plans, and clearinghouses to modify their Notice of Privacy Practices to support reproductive health care privacy.
The Health Insurance Portability Act of 1996 (HIPAA) Privacy Rule sets limits and conditions on the uses and disclosures of protected health information. The updates in this final rule are effective in 60 days, and the compliance date is in eight months. Individuals subject to the regulation must comply with the applicable requirements of 45 CFR 164.520 in the final rule by February 16, 2026.
The final rule and a press release are available online.