April 12, 2023 | In the News
HHS Proposes Rules to Strengthen Patient-Provider HIPAA Privacy in Reproductive Care
Bolstering the HIPAA Privacy Rule: Rulemaking from the Department's Enforcement Agency, HHS Office for Civil Rights (OCR)
Our compliance team wants to help you save time in figuring out your requirements as a health organization, covered entity, or business associate. Here are the crucial ideas summarized, so you don't miss them in the agency's writing style.
Proposed Measures to Strengthen the HIPAA Privacy Rule
The Focus? HHS issued a Notice of Proposed Rulemaking (NPRM) to strengthen HIPAA Privacy Rule protections.
The Goal? To prevent the use or disclosure of PHI to investigate or prosecute patients and providers involved in reproductive health care. HHS responded to thousands of patients, providers, and organizations who expressed a need for change to protect patient-provider confidentiality.
The Prediction? Our team forecasts an increase in HIPAA violations due to the lack of implemented privacy protections to adequately safeguard PHI from being disclosed or used to identify, investigate, sue, or prosecute someone for seeking, obtaining, providing, or facilitating lawful reproductive health care.
Our Recommendation? Keep raising awareness to prevent unauthorized access. Specifically, to avoid private medical records from being used against anyone seeking, acquiring, providing, or facilitating reproductive health care services.
Greater Focus on Protecting a Patient's Health Information and Privacy
The Importance? Protecting sensitive information related to reproductive health care services has become critical after the Dobbs Decision by the Supreme Court.
The White House issued Executive Order 14076, which directs HHS to consider ways to strengthen the protection of sensitive information regarding patient confidentiality for services identified as reproductive health care.
The Proposed Rule
The Change? The NPRM proposes to extend additional privacy protections for providers, insurers, patients, and others to safeguard PHI when that information would be disclosed or used to identify, investigate, sue, or prosecute someone for seeking, obtaining, providing, or facilitating lawful reproductive health care.
Reproductive health care would be defined to include, but not be limited to:
- prenatal care.
- abortion.
- miscarriage management.
- infertility treatment.
- contraception use.
- treatment for reproductive-related conditions such as ovarian cancer.
The HIPAA Privacy Rule (Current Status)
The Current Status? While the Department is undertaking this rulemaking, the current Privacy Rule remains in effect.
The existing Privacy Rule permits certain disclosures to law enforcement and others, subject to specific conditions.
Expect an Enforcement Increase
OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of people's health information.
Regarding health information privacy or civil rights violations, HHS encourages patients nationwide to file complaints at the OCR: https://www.hhs.gov/ocr/complaints/index.html
Summary and More Information about HHS Proposed Measures
Since this is a developing issue, our compliance advisors will monitor the rulemaking process.
- The NPRM itself: You can view and download NPRM at the Federal Register here (https://www.federalregister.gov/public-inspection/current)
- An NPRM fact sheet: Available in English here (https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/hipaa-reproductive-health-fact-sheet/index.html)
- FYI, Public comments on the NPRM are due at least before June 10th, 2023 (i.e., "60 days after publication of the NPRM in the Federal Register" - HHS)