The HHS released the Notice of Proposed Rulemaking on reproductive health on 12 April 2023. This comes in response to the overturning of Roe v Wade, which has heightened the concern about the privacy of PHI relating to reproductive health.
What is the purpose of the Notice of Proposed Rulemaking on reproductive health?
The purpose of the (NPRM) on reproductive health is to propose modifications to HIPAA's Privacy Rule, issued under HIPAA. The Department of Health and Human Services (HHS) aims to strengthen privacy protections for individuals' protected health information (PHI) related to reproductive health care.
The existing provisions of the Privacy Rule may be used to request the disclosure of an individual's PHI as a pretext for obtaining reproductive healthcare information for nonhealthcare purposes. The NPRM seeks to address these concerns and avoid circumstances where PHI related to reproductive health care is disclosed in ways that may cause harm to individuals' interests.
Related: HHS Seeks to Strengthen HIPAA Privacy Rule for reproductive health care
What specific changes or regulations are being proposed in this rulemaking?
The proposed rulemaking aims to strengthen privacy protections for reproductive health care by making changes to regulations.
Prohibition of use or disclosure of PHI for investigative or proceeding purposes
The proposed rule would prohibit the use or disclosure of PHI by a regulated entity for the purpose of a criminal, civil, or administrative investigation or proceeding related to seeking, obtaining, providing, or facilitating reproductive health care. This prohibition would apply in specific circumstances outlined in the proposed rule.
Scope of the prohibition
The proposed prohibition would apply when the investigation or proceeding is connected to reproductive health care sought, obtained, provided, or facilitated in a state where the health care is lawful but outside of the state where the investigation or proceeding is authorized. It would also apply to reproductive health care that is protected, required, or expressly authorized by federal law, regardless of the state in which it is provided.
Exceptions to the prohibition
The proposed rule would still allow regulated entities to use or disclose PHI for purposes other than investigating or imposing liability on any person for seeking, obtaining, providing, or facilitating reproductive health care. For example, PHI could be disclosed for defending against allegations of professional misconduct or negligence related to reproductive health care or to defend any person in a proceeding where liability could be imposed for providing reproductive health care.
Attestation requirement
The proposed rule would require regulated entities to obtain a signed attestation when they receive a request for PHI potentially related to reproductive health care. This attestation would confirm that the use or disclosure of PHI is not for a prohibited purpose. The requirement would apply in specific circumstances such as health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners.
Implications for reproductive PHI
The proposed rule addresses the sensitivity of reproductive health information. It recognizes that reproductive health care is highly personal and that individuals have a legitimate expectation of privacy when it comes to such information.
By prohibiting certain uses and disclosures of PHI related to reproductive health care, the rule seeks to safeguard sensitive information and maintain patient-provider confidentiality.
It clarifies that privacy protections apply regardless of whether health care is sought, obtained, provided, or facilitated in the state where the investigation or proceeding is authorized. This provision ensures that individuals who travel across state lines for reproductive health care, such as abortion, can still benefit from privacy protections irrespective of the jurisdiction in which the investigation or proceeding takes place.
Additionally, the rule seeks to protect individuals' privacy rights and help ensure that individuals can freely access reproductive health care without fear of legal consequences or privacy breaches.
Related: How HIPAA Applies to reproductive health information
The implementation of the NPRM for reproductive health
The NPRM is open for commentary by the public until 16 June 2023. The Department welcomes comments on the proposed time frame for compliance and any other aspects of the rulemaking.
According to the proposed rule, if a final rule is published, it would have an effective date of 60 days after publication. Regulated entities would then have a compliance period to establish and implement policies and practices to achieve compliance with the new or modified standards.
The general compliance period for new or modified standards is 180 days from the effective date of the change. The Department does not mention anticipating any unique implementation challenges warranting an extended compliance period beyond the standard 180 days. Therefore, it has proposed to apply the standard compliance date of 180 days after the effective date of a final rule.
It is important to note that if any provision of the final rule is deemed invalid or unenforceable, it would be treated as severable from the remainder of the rule. The invalidation of a specific application of a provision would not affect the application of the provision to other persons or circumstances.
How will the proposed rulemaking affect healthcare providers that offer reproductive health services?
Healthcare organizations would have a heightened responsibility to protect the privacy and confidentiality of individuals' reproductive health information. This may involve implementing new privacy safeguards, revising consent forms and notices of privacy practices (NPPs), and training staff on the updated requirements. If finalized, it would be necessary to plan and allocate resources accordingly to meet the compliance deadline.
The proposed rule may affect insurance claims and billing processes related to reproductive health services. It may involve verifying that insurers and third-party administrators also comply with the privacy protections outlined in the proposed rule.
Lastly, healthcare organizations would need to be cautious not to disclose PHI in violation of these prohibitions. This includes refraining from identifying individuals for the purpose of initiating investigations or proceedings related to lawful reproductive health care.
Related: HIPAA Compliant Email: The Definitive Guide
Kirsten Peremore
