HHS OCR Finalizes HIPAA Privacy Changes for Reproductive Health Care

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published a ruleon April 26, "Health Insurance Portability and Accountability Act Privacy Rule to Support Reproductive Health Care Privacy." The rule finalizes revisions to the Health Insurance Portability and Accountability Act of 1996 (HIPAA, P.L. 104-91) regulations to expressly protect the privacy of information regarding lawful reproductive health care.

Specifically, the OCR finalized policies that prohibit the use or disclosure of protected health information concerning reproductive health care by HIPAA-covered entities for either a criminal, civil, or administrative investigation into or proceeding against any person, including patients and providers, in connection with lawful care, or the identification of any person for the purpose of initiating such investigations or proceedings. Notably, in response to comments by the AAMC [refer to Washington Highlights, June 23, 2023] and other stakeholders, the rule allows a regulated entity to generally presume the legality of reproductive health care that the entity itself did not provide, for purposes of disclosing protected health information related to that care.

The rule is effective June 25, 2024.