On April 12, 2023, OCR issued a Notice of Proposed Rulemaking (“NPRM”) to strengthen HIPAA’s protections around reproductive health care privacy. The NPRM responds to President Biden’s Executive Order 14076, which directed HHS to consider ways to strengthen privacy protections for reproductive health care services, following the Supreme Court’s rule in Dobbs v. Jackson Women's Health Organization, overturning Roe v. Wade and ultimately resulting in renewed concern over patient privacy and reproductive healthcare.
Under the NPRM, the use or disclosure of PHI would be prohibited for a criminal, civil, or administrative investigation into, or proceeding against, any person seeking, obtaining, providing, or facilitating lawful reproductive health care, in the following circumstances.
The prohibition would apply where reproductive health care is sought, obtained, provided, or facilitated in a state where health care is lawful, and outside of the state where an investigation or proceeding is authorized, e.g., if a resident of one state traveled to another state to receive a legal abortion. Additionally, it applies where reproductive health care is protected, required, or expressly authorized under federal law, such as miscarriage management required under EMTALA. Finally, the prohibition would apply where reproductive health care is lawfully provided in the state where the investigation or proceeding is authorized.
OCR clarified that the proposed rule would continue to allow uses and disclosures of PHI permitted by HIPAA, with the caveat that the request for PHI is not made to investigate or impose liability in connection with seeking, providing, or facilitating health care. A regulated entity would be required to sign an attestation when receiving a request to disclose PHI for: health oversight activities; judicial and administrative proceedings; law enforcement purposes; and disclosures to coroners and medical examiners.
The NPRM is a robust indicator of OCR’s intent to broadly extend additional privacy protections for reproductive health care for all genders. HHS has defined reproductive health care to include, but not be limited, to treatment related to prenatal care, abortion, miscarriage management, infertility treatment, contraception use, and treatment for reproductive-related conditions such as ovarian cancer. HHS encouraged all stakeholders to submit public comments on the NPRM. The fact sheet regarding the NPRM can be accessed here.
If you have any questions about HIPAA or the NPRM, please contact a member of the Sheppard Mullin Healthcare Team.