OCR Issues Guidance on HIPAA Privacy Protections for Reproductive Health Information
- July 01, 2022
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued June 29 new guidance to help patients, as well as health care providers, understand federal privacy protections for reproductive health information following the Supreme Court’s ruling in Dobbs vs. Jackson Women’s Health Organization.
The guidance notes that the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule would not permit a hospital to disclose the medical information of an individual suspected of taking medication to end a pregnancy in a state that prohibits abortion unless state law expressly requires reporting to law enforcement.
Unless “required by law,” the guidance says “such disclosure would be impermissible and constitute a breach of unsecured PHI [protected health information] requiring notification to HHS and the individual affected.”
The Privacy Rule also permits but does not require covered entities to disclose PHI for law enforcement purposes pursuant to a court order. However, only the PHI expressly authorized by the court order may be disclosed.
The guidance also offers the example of a pregnant individual in a state that bans abortion informing their health care provider of plans to seek an abortion in another state where abortion is legal. In this scenario, the Privacy Rule would not permit the provider to disclose PHI to law enforcement because a statement indicating an individual’s intent to get a legal abortion does not qualify as a “serious and imminent threat to the health or safety of a person or the public,” according to the guidance.
A second guidance also issued by OCR notes that in most cases the HIPAA rules do not protect individuals’ PHI when they access or store the information on personal cell phones or tablets. The guidance provides tips for safeguarding privacy when using period trackers and other health information apps.
“How you access health care should not make you a target for discrimination. HHS stands with patients and providers in protecting HIPAA privacy rights and reproductive health care information,” said HHS Secretary Xavier Becerra. “Anyone who believes their privacy rights have been violated can file a complaint with OCR as we are making this an enforcement priority.”