OCR releases final HIPAA Privacy Rule to Support Reproductive Health Care Privacy
To further protect the privacy of reproductive health care, on April 22, 2024, the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) issued a final rule modifying the HIPAA Privacy Rule (the Final Rule). The Final Rule is scheduled to be published in the Federal Register on April 26, 2024. The Final Rule prohibits the disclosure of protected health information (PHI) related to lawful reproductive health care in certain scenarios.
Background and Regulatory Context
Following the June 24, 2022, US Supreme Court decision in Dobbs v. Jackson Women’s Health Organization (Dobbs) OCR issued a notice of proposed rulemaking (NPRM) on April 17, 2023, proposing to modify the HIPAA Privacy Rule to support the privacy of reproductive health care information (2023 NPRM). OCR expressed concern that the confidentiality of reproductive health information may be impacted by those who wish to use such information to initiate criminal, civil, and administrative investigations or proceedings. The 2023 NPRM was designed, in part, to prevent this information from being targeted and to continue to protect the confidentiality of this sensitive data.
Impact on Covered Entities and Business Associates
What’s the impact? The new regulations implement, with some changes, previously-proposed limitations on when covered entities and business associates may use and disclose reproductive health information. Specifically:
- Persons seeking reproductive health information will need to provide attestation as to a compliant purpose in certain circumstances.
- Covered entities need to modify their Notice of Privacy Practices in relation to this Final Rule and the recent 42 CFR Part 2 regulations addressing substance use disorder information.
Timeline of Regulatory Actions
| Date | Event/Action |
|---|---|
| June 24, 2022 | US Supreme Court decision in Dobbs v. Jackson Women’s Health Organization |
| April 17, 2023 | OCR issued a notice of proposed rulemaking (NPRM) |
| April 22, 2024 | OCR issued the Final Rule modifying the HIPAA Privacy Rule |
| April 26, 2024 | Final Rule scheduled to be published in the Federal Register |
As previously described in the 2023 NPRM, in the preamble to the Final Rule, OCR reiterates how it wants to continue to protect patient privacy and support reproductive health care privacy.