HHS finalizes rule to strengthen reproductive health data privacy under HIPAA

The Biden-Harris administration, through HHS, issued a final rule to bolster patient privacy for those seeking and administering lawful reproductive healthcare. Entitled HIPAA Privacy Rule to Support Reproductive Health Care Privacy, the rule prohibits the disclosure of protected health information (PHI) when it is sought to hold patients or providers liable.

The final rule was informed by the nearly 30,000 comments that the HHS Office for Civil Rights (OCR) received in response to a Notice of Proposed Rulemaking (NPRM) issued in April 2023. When  Roe v. Wade was struck down in 2022, it opened patients and providers up to legal risks, prompting HHS to take action, officials stated.

“Since the fall of Roe v. Wade, providers have shared concerns that when patients travel to their clinics for lawful care, their patients’ records will be sought, including when the patient goes home. Patients and providers are scared, and it impedes their ability to get and to provide accurate information and access safe and legal health care,” said OCR Director Melanie Fontes Rainer.

“Today’s rule prohibits the use of protected health information for seeking or providing lawful reproductive health care and helps maintain and improve patient-provider trust that will lead to improved health outcomes and protect patient privacy.”

Specifically, the final rule forbids the use or disclosure of PHI “when it is sought to investigate or impose liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate reproductive health care that is lawful.”

Additionally, the final rule requires covered entities to obtain a signed attestation that certain requests for PHI related to reproductive healthcare are not for the aforementioned prohibited purposes. Under the final rule, covered healthcare providers, health plans, and clearinghouses must also modify their Notice of Privacy Practices to further support reproductive healthcare data privacy.

The final rule will be effective 60 days after its publication in the federal register, which is expected this week.

“Many Americans are scared their private medical information will be being shared, misused, and disclosed without permission. This has a chilling effect on women visiting a doctor, picking up a prescription from a pharmacy, or taking other necessary actions to support their health,” said HHS Secretary Xavier Becerra.

“The Biden-Harris Administration is providing stronger protections to people seeking lawful reproductive health care regardless of whether the care is in their home state or if they must cross state lines to get it. With reproductive health under attack by some lawmakers, these protections are more important than ever.”