Final Rule Amends Provisions of the HIPAA Privacy Rule
In less than three weeks, on June 25, 2024, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (Final Rule) goes into effect. This new rule amends provisions of the Privacy Rule to strengthen privacy protections for highly sensitive protected health information (PHI) about the reproductive health care of an individual.
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued this Final Rule after hearing from communities that changes were needed to protect patient confidentiality better and prevent medical records from being used against people for providing or obtaining lawful reproductive health care.
Final Rule Protects Reproductive Health Care PHI Across State Lines
Many patients living in states with abortion restrictions have had to travel to states without restrictions to receive care, noted OCR Director Melanie Fontes Rainer at a news conference. Under the new rule, “when a woman travels from one state where the care might be banned to another state to receive lawful reproductive health care, no matter what that health care is — whether it’s a pill or it’s a procedure or it’s just a medical examination — when that woman goes home, her medical records will be protected,” Rainer said.
Patients and Providers Benefit from Final Rule
The Final Rule ensures that individuals are not deterred from seeking, obtaining, providing, or facilitating lawful reproductive health care while it:
- Prohibits the use or disclosure of PHI when it is sought to investigate or impose liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate reproductive health care that is lawful under the circumstances in which such health care is provided, or to identify persons for such activities.
- Requires a regulated health care provider, health plan, clearinghouse, or their business associates to obtain a signed attestation that certain requests for PHI potentially related to reproductive health care are not for these prohibited purposes. “You’re fully protected from those disclosures under HIPAA unless the patient themselves signs an authorization, and they request it,” explained PrivaPlan President David Ginsberg. This attestation requirement applies when the request is for PHI for any of the following:
- Health oversight activities.
- Judicial and administrative proceedings.
- Law enforcement purposes.
- Disclosures to coroners and medical examiners.
- Requires regulated health care providers, health plans, and clearinghouses to modify their Notice of Privacy Practices (NPP) to support reproductive health care privacy.
Learn More
Check out our blog post about the recent HIPAA updates that impact health care providers and ensure compliance of Substance Use Disorder (SUD) treatment records.
Beyond the June 25 Final Rule Effective Date
HIPAA-covered entities have until December 23, 2024, to comply with the amendment and until February 16, 2026, to update their NPPs to include new disclosures related to reproductive health care privacy.
PrivaPlan will provide its ToolKit subscribers and compliance clients with revised NPP templates, updated policies and procedures, and training. Contact us today for more information or to learn how our privacy experts can help your organization!
