2 min read
New HIPAA Rule enhances protections for reproductive health information
Caitlin Anthoney Dec 19, 2024 8:43:50 PM
Effective December 23, 2024, a new HIPAA Privacy Rule requires healthcare providers, covered entities, and business associates to adopt policies safeguarding reproductive health information. The new Rule prohibits disclosures for investigative purposes related to reproductive healthcare when such care is legal in the state where it occurred.
What happened
The Department of Health and Human Services (HHS) finalized the “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” earlier this year. It addresses concerns following the Supreme Court’s Dobbs v. Jackson Women’s Health Organization decision, which overturned Roe v. Wade.
The Rule will prevent states from accessing protected health information (PHI) to investigate individuals who seek legal reproductive healthcare in other states. Covered entities must obtain specific attestations before disclosing reproductive PHI and update their policies and workflows to comply with the new requirements.
The backstory
The Dobbs decision overturned nearly five decades of federal abortion protections, granting individual states the authority to determine abortion's legality within their borders. As a result, several states restricted or banned abortion outright, some of which also allowed criminal or civil investigations into individuals seeking abortions elsewhere.
In response, the Biden Administration moved to address the potential misuse of health information in such investigations. The new HIPAA Rule prioritizes reproductive health privacy, marking it one of the federal government’s strongest post-Dobbs actions.
Read more: Reproductive health: Rules, rights and compliance
Going deeper
The new Rule broadly defines reproductive PHI as information concerning “healthcare that affects the health of an individual in all matters relating to the reproductive system,” including:
- Contraception and abortion
- Pregnancy and IVF
- Menopause and endometriosis
- Mammography and erectile dysfunction
Furthermore, the Rule states that reproductive PHI cannot be disclosed for purposes such as:
- Health oversight activities.
- Judicial or administrative proceedings.
- Law enforcement investigations.
- Death investigations conducted by coroners or medical examiners.
The new attestation requirement mandates that covered entities secure a signed attestation from any requestor confirming that the requested PHI will not be used for prohibited purposes.
Lastly, it mandates updates to HIPAA policies, procedures, and Notices of Privacy Practices by 2026. So, covered entities must modify internal policies, workflows, and staff training programs to maintain compliance.
Why it matters
The new Rule directly addresses fears that patients seeking legal reproductive healthcare could be criminalized based on their health information. The Rule also enforces stricter controls over reproductive PHI, helping covered entities mitigate risks of misuse while aligning with federal privacy standards.
The bottom line
Healthcare providers, business associates, and other HIPAA-covered entities must update policies, secure attestations for RPHI disclosures, train staff, and revise Notices of Privacy Practices to comply with the new Rule.
FAQs
Who does HIPAA apply to?
HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.
Does HIPAA protect information about abortions?
Yes, HIPAA safeguards any information about reproductive healthcare, including abortion, as part of a person’s protected health information (PHI).
Can healthcare providers share patients’ abortion information without their consent?
Generally no, healthcare providers cannot share information about an individual’s abortion or other medical treatments without their explicit permission, unless required by law.
Related: Fighting for reproductive rights among people with chronic conditions.