On Monday, April 12, 2023, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) issued a notice of proposed rulemaking (NPRM) to modify the HIPAA Privacy Rule to address the release of reproductive health care information to third parties for the purposes of civil, administrative, or criminal proceedings for care that is lawfully obtained.

OCR has also released a fact sheet on this NPRM. The NPRM included: (1) the addition of new protections with respect to certain information related to reproductive health care; (2) a new obligation for regulated entities to obtain “attestations” (which are different from HIPAA’s traditional authorization) before responding to requests for certain PHI related to reproductive health care; and (3) the modification of the definition of “person,” and the addition of several new definitions.

Impetus for Proposed Changes

OCR cited the Supreme Court decision in  Dobbs v. Jackson Women’s Health Organization, 142 S. Ct. 2228 (U.S. 2022) as a significant motivation for its proposed changes to the Privacy Rule, noting that the general privacy standards promulgated under HIPAA adequately protected information related to reproductive health care prior to Dobbs because Federal constitutional law protected access to reproductive health care nationwide.

OCR also expressed concern that, post-Dobbs, individuals might not seek necessary care for fear of disclosure of PHI related to the care, even in circumstances where services are provided lawfully. For similar reasons, OCR explained that, in the wake of the Dobbs decision, health care providers may decide to purposefully omit certain information in a patient’s medical record in order to protect the patient and the provider from potential investigation, which could ultimately lead to lower quality care due to of the creation of an incomplete medical record.

Finally, the agency became aware of the possibility that providers, in the context of reproductive health care, might purposefully not present a patient with the full panoply of clinical options or recommendations  for fear that a future inquiry into certain reproductive health treatment could be tied back to the provider.

OCR believes that the proposed changes to the Privacy Rule would benefit individuals in various ways, including by: (i) increasing the likelihood that individuals would seek lawful health care by improving their confidence in the confidentiality of their PHI; (ii) safeguarding the mental health of pregnant individuals; and (iii) preventing increases in maternal mortality and morbidity. Additionally, OCR expects that the proposals will increase certainty for, and therefore reduce the burden on, regulated entities implementing the Privacy Rule. 

Proposed Changes

The NPRM provides for numerous modifications to the Privacy Rule. We have summarized the most noteworthy proposals below:

Prohibition on Disclosures of PHI Related to Reproductive Health Care. OCR proposed changes to the Privacy Rule to prohibit disclosure of PHI where the disclosure is primarily for the purpose of investigating or imposing liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care. OCR limits this prohibition on disclosures of PHI where the reproductive health care was lawfully provided, either pursuant to applicable state law, or under federal law (e.g., EMTALA).

Attestation to be Signed by Requestor. OCR proposed requiring covered entities to obtain a written and signed attestation from the requestor that the use or disclosure is not for a prohibited purpose. OCR included specific elements that would be required in a valid attestation.

Revisions to and Addition of Definitions. OCR proposed to revise or clarify certain definitions and terms that apply to the Privacy Rule and other HIPAA rules to operationalize these proposed modifications.

  1. Revision of “person.” The revised definition of “person” would be rewritten to align the definition with other definitions of “person” used under federal regulations, in which “person” is not inclusive of a fertilized egg, embryo, or fetus.
  2. Addition of “reproductive health care.” OCR has proposed to establish a new defined term. “Reproductive health care” is proposed to mean “care, services, or supplies related to the reproductive health of the individual.” The definition is intentionally broad, is not location-specific (e.g., not specific to a hospital, physician office, etc.), and includes reproductive health care and services furnished by both health care providers and other persons, including the provision of both prescription and non-prescription supplies.

Inability to Use Authorization to Permit Disclosure. Fearful that individuals might be coerced by law enforcement or other third parties to sign an authorization for disclosure of PHI related to reproductive health care, OCR has proposed to add an express statement that a HIPAA authorization cannot be used to bypass the proposed prohibition on disclosure.

Updates to Notice of Privacy Practices. OCR has proposed that covered entities revise their Notice of Privacy Practices to, if applicable, include a description of each type of use and disclosure that would be prohibited under the NPRM.

The changes contemplated under the NPRM would significantly impact how HIPAA-regulated entities are permitted to disclose PHI related to reproductive health care, and attempt to address many of the concerns raised by stakeholders related to the potential conflict between state law and HIPAA permitted disclosures. OCR is encouraging all stakeholders, including health care providers, associations, insurers, patients, and others to submit comments on the NPRM. Comments are due by June 16, 2023, and can be submitted online or by mail.

Reed Smith continues to track developments related to this proposed rulemaking. Should you have any questions about the proposed modifications to the HIPAA Privacy Rule, would like assistance with preparing comments on the proposed rule, or have other health care compliance concerns, please do not hesitate to reach out to the authors of this post or the other health care attorneys at Reed Smith.