The rule updates HIPAA to prohibit disclosure of public health information on anyone seeking, obtaining, providing or facilitating legal reproductive health care
May 17, 2024 (ACP) -- The U.S. Department of Health & Human Services Office for Civil Rights (OCR) announced a final rule that will prohibit disclosure of protected health information as it relates to legal reproductive health care services.
"We're really pleased to see this change overall," said Shari Erickson, ACP chief advocacy officer and senior vice president of governmental affairs and public policy. "It will be much more protective of our members and their patients."
The rule updates the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The final rule, issued by the OCR, "essentially prohibit[s] state or local officials from gathering medical records related to reproductive health care for a civil, criminal or administrative investigation from providers or health insurers in a state where abortion remains legal," the Associated Press reported.
In its justification for the final rule, published in the Federal Register on April 26, the OCR cites the ACP 2021 position paper on "Health Information Privacy, Protection and Use in the Expanding Digital Health Ecosystem." Specifically, the OCR cites the paper's focus on the importance of promoting trust in the medical system, stating that the "prospect of the disclosure of highly sensitive [public health information] by regulated entities can result in medical mistrust."
As Erickson noted, multiple states have severely limited abortion access. There is concern that law enforcement officials in those states will investigate and prosecute women who seek legal care elsewhere -- and those who assist them.
The rules provide a "shield of protection" for physicians, she explained. "They prohibit conducting a criminal, civil or administrative investigation on any person seeking, obtaining, providing or facilitating lawful reproductive health care," she said.
In addition to clinicians and physicians, the restrictions encompass entities such as health plans and clearinghouses that process claims.
Erickson cautioned, however, that some private information about reproductive health care is not covered by HIPAA, and law enforcement could potentially still access it despite the new regulations. For example, period-tracking apps that could reveal a pregnancy are not protected by HIPAA. Neither are cell phone location-tracking services, which could reveal that a pregnant woman traveled across state lines.
"There's no protection for this kind of data, which may be sought out in a criminal case or civil lawsuit," Erickson said. "ACP and our allies would like to see greater protections for patient data more broadly. For the time being, physicians may consider advising patients that this information is not protected."
Legal challenges to the rules are possible, Erickson noted. ACP has filed numerous friend-of-the-court briefs in reproductive health care cases and is ready to take further action when necessary. "These briefs allow us to provide clinically relevant information to the court from a physician perspective," she said.
The final rule from OCR is scheduled to go into effect on June 25, 2024, and persons subject to the regulations must comply by Dec. 23, 2024. There is an exception regarding changes to privacy notices, which must be revised by Feb. 16, 2026.
Back to the May 17, 2024 issue of ACP Advocate