As states enact and enforce various laws restricting, prohibiting, and even criminalizing abortion and other reproductive health care services, HIPAA rules that allow disclosure of patient information become potential privacy landmines.

HIPAA loopholes that jeopardized the privacy of sensitive reproductive health data will be tightened or even closed if U.S. Department of Health & Human Services (HHS) rules proposed on April 12th are adopted. One loophole, briefly described in our post here, allows a provider to disclose information if a provider reasonably believes an individual is a victim of abuse or neglect and disclosure is required by law, but also when it’s simply authorized by law and the provider, in the exercise of professional judgment, believes disclosure is necessary to prevent serious harm to the individual or other potential victims. Other potential loopholes include (but are not limited to) the ability to disclose information more if required by law, for public health activities (including reports of child abuse), for law enforcement purposes, and about victims of a crime.

On the other hand, disclosure of complete and accurate health information by providers is essential for treatment purposes. HHS faced the daunting task of closing potential privacy loopholes without preventing appropriate and necessary disclosures, such as those necessary for treatment.

As described in the proposal: “[H]ealth care providers may omit information about an individual’s medical history or condition, or leave gaps or include inaccuracies, when preparing medical records, out of fear that the individual’s PHI is likely to be disclosed without the individual’s or the health care provider’s knowledge or consent for use in criminal or civil proceedings against the individual, their health care provider, or others. In so doing, they increase the risk that the individual will receive substandard ongoing or future health care.”

The proposed rule makes a number of significant changes, which we will explore further in upcoming posts. A key change is the prohibition against disclosures in connection with criminal, civil, or administrative investigations or proceedings.

The HHS Fact Sheet explains:

“Under the proposal, the prohibition would apply where the relevant criminal, civil, or administrative investigation or proceeding is in connection with one of the following:

• Reproductive health care that is sought, obtained, provided, or facilitated in a state where the health care is lawful and outside of the state where the investigation or proceeding is authorized.
  • For example, if a resident of one state traveled to another state to receive reproductive health care, such as an abortion, that is lawful in the state where such health care was provided.
• Reproductive health care that is protected, required, or expressly authorized by federal law, regardless of the state in which such health care is provided.
  • For example, if the reproductive health care, such as miscarriage management, is required under the Emergency Medical Treatment and Labor Act (EMTALA) to stabilize the health of the pregnant individual.
• Reproductive health care that is provided in the state where the investigation or proceeding is authorized and is permitted by the law of the state in which such health care is provided.
  • For example, if a resident of a state receives reproductive health care, such as a pregnancy test or treatment for an ectopic pregnancy, in the state where they reside, and that reproductive health care is lawful in that state.”

[View source.]