The HIPAA Privacy Rule to Support Reproductive Health Care Privacy was recently announced as a final rule that becomes effective on June 25, 2024 (the “Final Rule”).
In addition to establishing certain requirements to protect reproductive health care, the Final Rule also includes requirements to modify Notices of Privacy Practices (“NOPP”) to address the confidentiality of substance use disorder treatment records.
What is prohibited?
The Final Rule prohibits the use or disclosure of Protected Health Information (“PHI”) by Covered Entities and Business Associates (“Regulated Entities”) for either of the following activities (each a “Prohibited Purpose”):
- To conduct a criminal, civil, or administrative investigation into, or impose criminal, civil, or administrative liability on, any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided.
- The identification of any person for the purpose of conducting such investigation or imposing such liability.
Such prohibitions are in effect if the Regulated Entity determines that one or more of the following conditions exists:
- The reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided (e.g., if a resident of one state traveled to another state to receive reproductive health care, such as an abortion, that is lawful in the state where such health care was provided).
- The reproductive health care is protected, required, or authorized by federal law, including the U.S. Constitution, regardless of the state in which such health care is provided (e.g., if use of the reproductive health care, such as contraception, is protected by the Constitution).
- The reproductive health care was provided by a person other than the Regulated Entity that receives the request for PHI and the Regulated Entity has no reason to believe that the reproductive health care would not be lawful.
What do regulated entities need to do?
To implement the prohibition, the following steps are required:
- Revise NOPPs. Regulated Entities that are required to have NOPPs must revise them to address the confidentiality of reproductive health care information, as well as to include language regarding the confidentiality of substance use disorder information.
- Revise Policy. Regulated Entities must revise policies to address when information regarding reproductive health care can be disclosed to law enforcement.
- Obtain attestation. If a Regulated Entity receives a request for information regarding reproductive health care and the request pertains to health oversight activities, judicial or administrative proceedings, law enforcement or disclosures to coroners or medical examiners, the Regulated Entity must obtain a signed attestation that the use or disclosure is not for a Prohibited Purpose.
When is compliance required?
Regulated Entities must comply with the Final Rule by December 23, 2024, except for compliance with the requirements regarding revisions to NOPPs, which must be fulfilled by February 16, 2026.
Should you have any questions regarding the above, please contact the authors, the Garfunkel Wild attorney with whom you regularly work, or email us at [email protected].