HHS Proposes HIPAA Privacy Rule on Confidentiality of Reproductive Healthcare

On April 12, 2023, the HHS Office of Civil Rights (OCR) issued a Notice of Proposed Rulemaking that will expand reproductive healthcare privacy under HIPAA.

The proposed rule prohibits the use or disclosure of PHI by individuals, covered entities (which includes group health plans), or their business associates (collectively, “regulated entities”) for either of the following purposes:

• A criminal, civil, or administrative investigation into or proceeding against any person in connection with seeking, obtaining, providing or facilitating reproductive healthcare, where such healthcare is lawful under the circumstances in which it is provided.
• The identification of any person for the purpose of initiating such investigations or proceedings.

The prohibition would apply where the relevant criminal, civil, or administrative investigation or proceeding is in connection with one of the following:

• Reproductive healthcare that is sought, obtained, provided or facilitated in a state where the healthcare is lawful and outside of the state where the investigation or proceeding is authorized.
• Reproductive healthcare that is protected, required or expressly authorized by federal law, regardless of the state in which such healthcare is provided.
• Reproductive healthcare that is provided in the state where the investigation or proceeding is authorized and is permitted by the law of the state in which such healthcare is provided.

Although the proposed rule places new restrictions on the disclosure of PHI, it will allow a regulated entity to use or disclose PHI for purposes otherwise permitted under the Privacy Rule. However, regulated entities can use or disclose PHI as long as the request for PHI is not made primarily for the purpose of investigating or imposing liability on any person for the mere act of seeking, obtaining, providing or facilitating reproductive healthcare.

When a regulated entity receives a request for PHI potentially related to reproductive healthcare, the proposed rule requires that entity to obtain a signed attestation that the use or disclosure is not for a prohibited purpose. This attestation requirement would apply when the request is for PHI in any of the following circumstances:

• Health oversight activities
• Judicial and administrative proceedings
• Law enforcement purposes
• Disclosures to coroners and medical examiners

Employers, particularly those with self-insured plans, should be aware of this proposed rule. Interested parties have 60 days from the date OCR published the proposed rule in the federal registry to submit public comments.

Proposed Rule »
Fact Sheet »
Guidance Relating to HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care »