In May 2024, the Department of Health and Human Services issued a final rule amending the HIPAA Privacy Rule to address reproductive health privacy. The final rule was prompted by a 2022 Supreme Court decision. Dobbs v. Jackson Women’s Health Organizationconcluded that the U.S. Constitution does not prohibit states from regulating or banning abortion. The final rule provides guidance to “business associates” and “covered entities,” including employer-sponsored group health insurance plans, on how to respond to requests for protected health information (PHI) related to reproductive health care.
The final rule prohibits the use or disclosure of PHI for criminal, civil, or administrative investigations or proceedings against individuals involved in lawful reproductive health care, and prohibits the use of PHI to identify such individuals or health care providers. However, group health plans may disclose PHI related to reproductive health care with a certification from the individual or their representative. The final rule specifies the required content and distribution of these certifications and outlines standards for validity. A certification may be invalid if it contains less or more information than is required by the final rule.
Group health plans must take steps to comply with the reproductive health privacy changes. HIPAA privacy policies and procedures, as well as employee training, must be updated promptly, as they must comply by December 22, 2024. The final rule also requires that HIPAA-required Notices of Privacy Practices be revised by February 16, 2026 to reflect these reproductive health privacy changes, as well as existing rules regarding the confidentiality of medical records for individuals with substance use disorders.
For further information or questions about the information in this newsletter, please contact your Quarles & Brady legal counsel or the information provided below.
