On June 16, 2023, nearly half of the State Attorneys General[1] penned a letter (the “Letter”) to the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”) advocating for broader privacy protections surrounding reproductive health care information. Specifically, the Letter targeted the Notice of Proposed Rulemaking (the “Proposed Rule”) published by OCR in April of 2023, which proposed a number of revisions to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).[2]
In particular, the Proposed Rule was intended to implement certain safeguards in response to the U.S. Supreme Court’s overturning of Roe v. Wade and Planned Parenthood v. Casey, as well as the various state laws which were either triggered or enacted thereafter.[3] The Proposed Rule attempts to achieve this goal by modifying the current provisions for use and disclosure of protected health information (“PHI”) “for the purpose of conducting a criminal, civil, or administrative investigation into or proceeding against the individual, a health care provider, or other person in connection with seeking, obtaining, providing, or facilitating reproductive health care that: (1) is provided outside of the state where the investigation or proceeding is authorized and such health care is lawful in the state in which it is provided; (2) is protected, required, or authorized by Federal law, regardless of the state in which such health care is provided; or (3) is provided in the state in which the investigation or proceeding is authorized and that is permitted by the law of that state.”[4]
Although the Letter predominately praises and endorses the Proposed Rule, it also cites the need for even greater privacy protections for reproductive health care. By way of example, the Proposed Rule calls for additional recommendations for OCR to consider, including that OCR should:
- Adopt an independent definition of “reproductive health.” Although the Proposed Rule currently contemplates inclusion of “reproductive health care” as a subcategory of “health care,” the Letter advocates for creation of a separate definition for “reproductive health.”[5] The Letter suggests this revision is warranted as it would clarify that all covered entities, rather than only those providing gynecological or fertility-related care, would need to comply with the corresponding obligations.[6]
- Provide examples of “reproductive health care.” The Letter contends that the Proposed Rule should include examples of what constitutes “reproductive health care” to further clarify OCR’s efforts to capture care, services, and supplies that may not be directly related to fertility or pregnancy, such as gender-affirming care and assisted reproduction.[7] In effect, the examples would serve to reinforce OCR’s efforts to cast a wide net.
- Clarify the definitions of “birth” and “death.”The Letter calls for the Proposed Rule to define “birth” and “death” to clarify that termination of a pregnancy does not qualify as a public health reporting event.[8] As a result, the termination would likely be exempt from HIPAA’s reporting requirements.[9]
- Expand application of prohibition on use or disclosure of PHI to further certain investigations or proceedings to other forms of health care. As noted above, the Proposed Rule prohibits certain uses or disclosures of PHI for the purpose of conducting a criminal, civil, or administrative investigation into or proceeding against persons involved in reproductive health care.[10] The Letter suggests that this prohibition should be expanded to other categories of health care information, as “patients should not be policed or criminalized for the type of health care they seek.”[11] The Letter cites gender-affirming services as an example.[12]
- Clarify the “primarily for the purpose of” qualifier. The Proposed Rule currently permits use or disclosure of PHI “[u]nless such use or disclosure is primarily for the purpose of investigating or imposing liability on any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care.”[13] The Letter suggests that the “primarily for the purpose of” qualifier could be exploited to circumvent the goal of the Proposed Rule and thus the word “primarily” should be stricken to reduce such a risk.[14]
- Prohibit providers from asking patients to authorize prohibited disclosures. The Letter maintains that patients should not be permitted to authorize disclosures for reproductive health information which would otherwise be banned under the Proposed Rule.[15] Specifically, the Letter praises the rejection of this concept in the Proposed Rule, emphasizing that patients would likely be subject to coercion.[16]
- Maintain current preemption rule. The Letter supports the Proposed Rule’s adherence to the current standard that HIPAA preempts state laws which are less protective of PHI.[17]
- Maintain attestation requirement. The Letter strongly endorses the Proposed Rule’s requirement that uses or disclosures of reproductive health information are subject to a new attestation requirement.[18] Specifically, the Proposed Rule requires that prior to disclosing PHI to a third party, HIPAA regulated entities must obtain an attestation that the request in question is not related to efforts to secure reproductive health services in furtherance of certain activities, such as health oversight activities, judicial or administrative proceedings, or law enforcement purposes.[19]
- Maintain exclusion of reproductive health information disclosures from exceptions to HIPAA’s authorization requirements. In addition, the Letter endorses the Proposed Rule’s efforts to establish that disclosures of reproductive health care information are not included within HIPAA’s current exceptions to the patient authorization requirement, provided that such use or disclosure would violate the Proposed Rule’s prohibition on use of reproductive health care information for a criminal, civil, or administrative investigation.[20]
- Expand and refine requirements for notices of privacy practices.The Letter advocates for updates to HIPAA’s requirements for notices of privacy practices to ensure that information on use or disclosure of patient information is available in a clear and accessible format while also clarifying the circumstances under which information could be disclosed to a recipient that would not be subject to HIPAA.[21] In addition, the Letter argues that notices of privacy practices should be required to list uses and disclosures of reproductive health information on the first page of the notice under a clear and conspicuous header.[22]
- Creation of a centralized platform that provides education on reproductive care and related privacy rights. The Letter calls for OCR to emphasize patient education through the establishment of a nationally available, online platform, that would outline information on reproductive health care and related privacy rights.[23]
As the Proposed Rule is not final, providers, payors, and other HIPAA-regulated entities should be attentive to ongoing developments as they will almost certainly impact day-to-day compliance operations. We will continue to monitor and provide updates to keep you informed about new developments.
FOOTNOTES
[1] Specifically, the State Attorneys General represented Arizona, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New York, New Mexico, North Carolina, Oregon, Pennsylvania, Rhode Island, Vermont, Washington, Wisconsin, and Washington D.C.
[2] 88 Fed. Reg. 23506, et seq.
[3] 88 Fed. Reg. 23519.
[4] 88 Fed. Reg. 23522.
[5] Letter, at pp. 7-8.
[6] Letter, at p. 8.
[7] Letter, at pp. 8-9.
[8] Letter, at p. 9.
[9] Id.
[10] 88 Fed. Reg. 23522.
[11] Letter, at p. 10.
[12] Id. (citing 88 Fed. Reg. 23552-53)
[13] 88 Fed. Reg. 23532-33.
[14] Letter, at p. 10.
[15] Letter, at p. 12.
[16] Id.
[17] Id.
[18] Letter, at pp. 12-15.
[19] 88 Fed. Reg. 23553.
[20] Letter, at p. 15.
[21] Letter, at p. 17.
[22] Letter, at p. 18.
[23] Letter, at p. 19.
