HHS Amends HIPAA Privacy Rule Regarding Reproductive Health Care

The Department of Health and Human Services recently issued a final rule amending HIPAA’s Privacy Rule to address reproductive health-care privacy.  The final rule was prompted by the Supreme Court’s 2022 ruling in Dobbs v. Jackson Women’s Health Organization, which concluded that the U.S. Constitution does not prohibit states from regulating or banning abortion.  The final rule provides guidance to business associates and covered entities, including employer-sponsored group health plans, on handling requests for protected health information (PHI) related to reproductive health care.

The final rule prohibits the use or disclosure of PHI for criminal, civil, or administrative investigations or proceedings against individuals involved in lawful reproductive health care, and also prohibits using PHI to identify such individuals and health care providers.  Group health plans may disclose PHI related to reproductive health care with an attestation from the individual or their representative (contents of the attestation are outlined in the final rule.

ASR will be assisting our clients to comply with this final rule by the effective dates stated therein.  Specifically, we will be sending updated Business Associate Agreements and an updated Notice of Privacy Practices to reflect these reproductive health-care privacy changes, as well as existing rules on the confidentiality of medical records for individuals with substance use disorders.  Plan administrators may want to review their internal HIPAA Privacy policies and procedures to ensure compliance with the final rule and train their staff accordingly.

If you have questions on the new HIPAA Privacy requirements, call ASR Health Benefits at (616) 957-1751 or (800) 968-2449.