05/06/2024 | News release | Distributed by Public on 05/06/2024 18:38
On April 26, 2024, the Office for Civil Rights ("OCR") at the U.S. Department of Health & Human Services ("HHS") published a final rule that modifies the Standards for Privacy of Individually Identifiable Health Information ("Privacy Rule") under the Health Insurance Portability and Accountability Act ("HIPAA") regarding protected health information ("PHI") concerning reproductive health. We previously covered the proposed rule (hereinafter, "the NPRM"), which was published on April 17, 2023. The final rule aligns closely with the NPRM.
OCR noted that the Supreme Court's ruling in Dobbs v. Jackson Women's Health Organization (holding that there is no constitutional right to abortion) created a legal landscape that "increase[s] the potential that use and disclosure of PHI about an individual's reproductive health will undermine access to and the quality of health care generally." According to OCR, the final rule aims to "continue to protect privacy in a manner that promotes trust between individuals and health care providers and advances access to, and improves the quality of, health care" by "limit[ing] the circumstances in which provisions of the Privacy Rule permit the use or disclosure of an individual's PHI about reproductive health care for certain non-health care purposes."
The final rule prohibits a regulated entity from using or disclosing an individual's PHI:
"Lawful under the circumstances in which it is provided" means that the reproductive health care is either:
The final rule includes a presumption that the reproductive health care provided by a person other than the regulated entity receiving the request was lawful. The final rule also imposes a new requirement that regulated entities must obtain an attestation from the requestor that a requested use or disclosure of PHI potentially related to reproductive health care is not for a prohibited purpose. OCR plans to publish a model attestation prior to the compliance date of the final rule.
The final rule does not prevent the use or disclosure of PHI for purposes otherwise permitted under the Privacy Rule. Notably, the final rule also does not prohibit the use or disclosure of PHI to investigate or impose liability on persons in situations involving reproductive health care that was unlawful when it was provided.
The final rule also modifies the Privacy Rule in the following ways:
The final rule goes into effect on June 25, 2024, and regulated entities must implement compliance measures by December 23, 2024. Regulated entities have until February 16, 2026, to comply with the provisions related to NPPs.