Senators Once Again Ask HHS to Update HIPAA, Citing Patient Privacy Concerns

Spearheaded by US Senator Patty Murray (D-WA), a group of 30 Senators urged HHS and the Biden Administration to strengthen HIPAA protections in order to further safeguard patient privacy in the wake of the Dobbs decision, which endangered abortion rights.

The letter marks the second time in a few short months that Senators have expressed frustration over HIPAA’s limitations. In July, Senators Michael Bennet (D-CO) and Catherine Cortez Masto (D-NV) also wrote to HHS asking it to better defend reproductive rights by updating the HIPAA Privacy Rule.

The HHS Office for Civil Rights (OCR) released guidance shortly after the Supreme Court decision was announced with the goal of clarifying how patient privacy is protected under the HIPAA Privacy Rule, but many providers still feel that the provisions are inadequate and unclear.

“Stakeholders have told us about providers who have felt uncertain about whether they must turn over personal health information to state and law enforcement officials, including cases where providers believed they had to turn over information when doing so is only permitted—but not required—under the HIPAA Privacy Rule,” the most recent letter stated.

“In other cases, providers did not know that certain disclosures are actually impermissible. Stakeholders have even described clashes between providers and health care system administrators on whether certain information must be shared. Many of these issues seem to arise from misunderstandings of what the HIPAA Privacy Rule requires of regulated entities and their employees.”

The Senators predicted that these problems would persist, especially as state lawmakers continue to enact a patchwork of laws that restrict abortion access. Although the Senators commended HHS for releasing helpful guidance after the decision, they also suggested that HHS had the power to do more.

“To safeguard the privacy of women’s personal health care decisions and ensure patients feel safe seeking medical care, including reproductive health care, we urge you to quickly initiate the rulemaking process to strengthen privacy protections for reproductive health information,” the letter continued.

“In particular, HHS should update the HIPAA Privacy Rule to broadly restrict regulated entities from sharing individuals’ reproductive health information without explicit consent, particularly for law enforcement, civil, or criminal proceedings premised on the provision of abortion care.”

The group of Senators proposed a few key steps that HHS could take to “improve awareness and enforcement” of the HIPAA Privacy Rule.

First, the Senators recommended that HHS bolster its efforts to educate the healthcare community about covered entities’ obligations under HIPAA. These efforts could include webinars, listening sessions, FAQs with specific examples of permissible and required disclosures, and ways for covered entities to seek confidential advice, the Senators suggested.

In addition, the group urged HHS to expand upon its efforts to educate patients about their rights under HIPAA and ensure that cases involving reproductive health information receive timely attention when it comes to enforcement activities.

“Our nation faces a crisis in access to reproductive health services, and some states have already begun to investigate and punish women seeking abortion care,” the letter concluded.

“It is critical that HHS take all available action to fully protect women’s privacy and their ability to safely and confidentially seek medical care.”