On April 13, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) released a Notice of Proposed Rulemaking (NPRM) to amend the HIPAA Privacy Rule, 45 C.F.R. Part 160 and Part 164, Subparts A and E, to strengthen federal privacy protections for Protected Health Information (PHI) pertaining to reproductive health care. The NPRM, a response to the Supreme Court of the United States' decision in Dobbs v. Jackson Women's Health Organization, 597 U.S. ___, 142 S. Ct. 2228 (2022) (No. 1901392) (June 24, 2022), and the subsequent threats and potential impact of state-level prosecution and law enforcement actions related to the provision of reproductive health care, would prohibit the use and disclosure of such PHI in certain criminal, civil or administrative proceedings, impose new attestation requirements for certain uses and disclosures of PHI, require Notice of Privacy Practices (NPP) changes, and revise the law enforcement exception.
Proposed Changes Would Have Broad Impact Based on the Definition of "Reproductive Health Care"
To create heightened protection for PHI relating to reproductive health, OCR proposes an intentionally broad definition of "reproductive health care" to mean "care, services, or supplies related to the reproductive health of the individual." According to OCR, the term would include contraception, pregnancy-related health care (including miscarriage management, molar or ectopic pregnancy treatment, pregnancy termination, pregnancy screening, products related to pregnancy, and prenatal care), and fertility or infertility-related health care (including assisted reproductive technology), regardless of the individual's age or whether the care is pregnancy-related. The impact of this defined term is that most covered entities, rather than only providers of gynecological or fertility-related care, would be required to implement changes.
Proposed Prohibitions on the Use and Disclosure of Reproductive Health Care Related PHI
Although the proposed changes impact a broad category of PHI, the prohibited uses and disclosures of such information would be purpose-driven. OCR proposes to prohibit covered entities and business associates from identifying any person or using or disclosing PHI for investigations and prosecutions of covered entities and other persons related to seeking, obtaining, providing, or facilitating reproductive health care (Restricted Disclosures) that is either of the following:
- Provided lawfully...
