On April 22, 2024, the Office for Civil Rights at the U.S. Department of Health & Human Services (HHS) issued a final rule[i] to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to support the privacy of reproductive health care information.[ii] The final rule follows the Supreme Court decision in Dobbs v. Jackson Women’s Health Organization that overturned Roe v. Wade, eliminating the federal right to abortion under the U.S. Constitution. In response, many states took action to ban or restrict abortion and other reproductive health care. The federal government has issued this final rule to expand reproductive health care privacy protections out of concern that these new state laws may have a chilling effect on patients seeking reproductive health care and health care providers providing reproductive health care alike.
The current patchwork of state reproductive health care laws can leave individuals living in more restrictive states with the choice of either having limited-to-no access to reproductive health care services or having to travel to states that offer adequate reproductive health care services. Such travel can be prohibitively expensive, especially for individuals in states landlocked by other states that have similarly restrictive state laws. The federal government has expressed concern that state health care officials could pursue legal action against individuals for seeking reproductive health care in another state. The final rule aims to protect the privacy of individuals legally seeking reproductive health care in other states, making it more difficult for state law enforcement to prosecute such individuals under their home state’s laws. Likewise, the final rule protects the privacy of health care providers who legally provide reproductive health care. The final rule also provides heightened confidentiality protections to communications between patients and their health care providers regarding reproductive health care.
The final rule prohibits health care providers from using or disclosing protected health information (PHI) for the following activities:
- Conducting criminal, civil or administrative investigation into or imposing criminal, civil or administrative liability on any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided (the Legality Requirement), or
- Identifying a person to conduct such investigation or impose such liability.
Subject to the Legality Requirement, covered entity health care providers are not required nor permitted to acknowledge that an individual received reproductive health care. Additionally, reproductive health care is presumed to be lawful under the circumstances in which it was provided unless the health care provider has actual knowledge that the reproductive health care was not lawful under the circumstances in which it was provided. (i.e., the care was provided by an unlicensed person or was provided in a state that does not permit reproductive health care).
Seeking, obtaining, providing or facilitating reproductive health care includes, but is not limited to any of the following: expressing interest in, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, administering, authorizing, providing coverage for, approving, counseling on, assisting or otherwise taking action to engage in reproductive health care or attempting any of the same.
Health care providers may, however, continue to use or disclose PHI for purposes otherwise permitted under the HIPAA Privacy Rule where the request for use or disclosure of PHI is not made to investigate or impose liability on any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care. Such purposes could include, for example, billing for health care services, health care operations or defending a medical malpractice claim by the individual.
Attestation Requirement
The final rule requires health care providers that receive a request for PHI relating to reproductive health care to obtain a signed attestation that the use or disclosure is not for any of the following prohibited purposes:
- Health oversight activities
- Judicial and administrative proceedings
- Law enforcement purposes
- Disclosures to coroners and medical examiners
HHS plans to publish model attestation language.
Notice of Privacy Practices
Health care providers are required to revise their notices of privacy practices to inform individuals that their PHI may not be used or disclosed for a prohibited purpose by February 16, 2026. Providers that are also subject to the confidentiality rules for substance use disorder information at 42 C.F.R. Part 2 (Part 2 Rules) must also update their notices of privacy practices by February 16, 2026, to address other required changes to the Part 2 Rules.
Compliance Dates
Health care providers are required to comply with the new rules beginning on December 23, 2024, except for the changes to the Notice of Privacy Practices, which must be made by February 16, 2026.
Next Steps
In addition to updating their notices of privacy practices, health care providers should:
- Consider what information the health care provider holds that is reproductive health care information,
- Determine how to identify and segregate reproductive health care information from patient medical records so that it may be excluded from any requests for PHI by law enforcement for prohibited purposes,
- Require any reproductive health care information that is part of a health information exchange to be subject to “break the glass” protections,
- Create policies regarding obtaining attestations,
- Update policies and procedures regarding disclosures to third parties and business associates and
- Update business associate agreement templates to prohibit business associates from using or disclosing any reproductive health care information that may violate the new rules.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions.
© 2024 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
[i] Federal Register: HIPAA Privacy Rule To Support Reproductive Health Care Privacy
[ii] The term “reproductive health care” is defined as health care that affects the health of the individual in all matters relating to the reproductive system and to its functions and processes. 45 C.F.R. 164.103.