The HHS offers guidance that reflects the evolving legal landscape surrounding same-sex marriage and ensures that the Privacy Rule is consistent with the rights and recognition of individuals in same-sex marriages. This allows healthcare organizations to be fully aware of how protected health information (PHI) should be treated.
The term marriage includes all lawful marriages. A lawful marriage is any marriage sanctioned by a state, territory, or foreign jurisdiction, as long as a U.S. jurisdiction would also recognize the marriage performed in the foreign jurisdiction.
The term spouse includes all individuals who are in lawful marriages, without regard to the sex of the individuals. In other words, it encompasses legally married individuals, regardless of whether the marriage is between individuals of the opposite sex or the same sex.
The term family member includes lawful spouses and dependents of all lawful marriages. This definition applies to individuals who are legally married, regardless of where they live or receive health care services.
See also: Understanding HIPAA's Military Command Exception
The HIPAA Privacy Rule allows for certain permitted disclosures of protected health information (PHI) to individuals who are considered family members, spouses, or personal representatives. Covered entities can share an individual's PHI with family members or spouses under certain circumstances. For instance, a covered entity may disclose PHI to a family member or spouse who is involved in the individual's care for purposes such as assisting in the individual's treatment or arranging for their care.
Notifications about an individual's location, general condition, or death may also be shared with family members or spouses. Covered entities must treat an individual's personal representative as the individual for uses and disclosures of PHI and the exercise of the individual's rights under the Privacy Rule. A personal representative can access the individual's medical records, authorize disclosures of PHI, and exercise other rights on behalf of the individual.
If a state grants legally married spouses healthcare decision-making authority on behalf of one another, the Privacy Rule requires covered entities to recognize the lawful spouse of an individual as their personal representative, regardless of the sex of the spouses.
Related: HIPAA, disability, and caregiver rights
Health plans, except issuers of long-term care policies, are prohibited from using or disclosing genetic information for underwriting purposes. This means that information from genetic tests of a family member (including lawful spouse) or manifestations of a disease or disorder in a family member cannot be used to make underwriting decisions about an individual.
In the United States v. Windsor case, the Supreme Court declared section 3 of the Defense of Marriage Act (DOMA) unconstitutional. This particular section of DOMA had previously restricted federal recognition of marriages to only opposite-sex unions. The Supreme Court's decision in Windsor expanded federal recognition of rights for individuals in same-sex marriages. It marked a significant step towards equal treatment of same-sex couples under federal law. However, while this decision broadened federal recognition, it did not fully resolve the status of these rights under state law. The legal landscape for same-sex marriages became more complex as state-level recognition of such marriages continued to vary.
In the subsequent case of Obergefell v. Hodges, the Supreme Court went further to address the issue of same-sex marriage. The Court held that the Fourteenth Amendment to the United States Constitution requires states to both license and recognize marriages between two people of the same sex. This landmark decision established that same-sex marriages should be legally recognized and protected nationwide, ensuring equal treatment under the law for all couples, regardless of gender. Obergefell v. Hodges provided a clear and consistent standard for recognizing same-sex marriages across all states, ending the patchwork of legal disparities that had previously existed.
See also: HIPAA Compliant Email: The Definitive Guide