This overview is excerpted from Manatt on Health, Manatt’s subscription service that provides in-depth insights and analysis focused on the legal, policy and market developments. For more information on how to subscribe to Manatt on Health, please reach out to Barret Jefferds.
The Big Picture
On April 22, the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) released a Final Rule to enhance the privacy of information related to reproductive health care. The Final Rule adds new purpose-based prohibitions on uses and disclosures of protected health information (PHI) to the existing Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule regulations in an effort to better protect individuals providing or obtaining lawful reproductive health care.
HHS received nearly 30,000 public comments in response to its April 2023 proposed rule. The Final Rule seeks to address concerns arising from the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization that PHI may be used in investigations or proceedings against individuals who seek legal reproductive health care or providers who furnish such care, potentially discouraging individuals from seeking lawful treatment from (or discussing it with) their provider. (For more on the proposed rule, see the Manatt on Health analysis.)
The new rule broadly defines “reproductive health care” as “health care… which affects the health of an individual in all matters relating to the reproductive system and to its functions and processes,” and adopts new “purpose-based” prohibitions on certain uses and disclosures of PHI.
Specifically, and as described in more detail below, the Final Rule:
- Prohibits the use or disclosure of PHI when it is sought to investigate or impose criminal, civil, or administrative liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate reproductive health care that is lawful under the circumstances in which such health care is provided, or to identify persons for such purposes;
- Requires covered entities (CEs) and their business associates to obtain a signed attestation that certain requests for PHI potentially related to reproductive health care are not for these prohibited purposes; and
- Requires CEs to modify their Notice of Privacy Practices (NPP) to support reproductive health care privacy.
The new prohibitions on use and disclosure of PHI related to reproductive health care are subject to a “Rule of Applicability,” which generally states that the prohibitions apply only when such care was lawfully provided. The Final Rule also includes a presumption that the reproductive health care at issue in a request is presumed to be lawful under the circumstances in which it was provided, when the care is provided by a person other than the entity receiving the request for PHI.
The rule is effective on June 25, and compliance with most of its provisions will be required by December 25 (six months after the effective date); compliance with required modifications to NPPs is required by February 16, 2026, aligning the date with the new federal 42 CFR part 2 (Part 2) regulation.1
HHS has also finalized the following provisions.
Notice of Privacy Practices
The Final Rule mandates that an NPP contain a description, including at least one example, of (1) the types of uses and disclosures of PHI prohibited by the Final Rule, and (2) the types of uses and disclosures of PHI for which an attestation is required by the Final Rule.
Additional changes seek to align the HIPAA Privacy Rule with requirements for CEs that create or maintain PHI that is also a record of SUD treatment provided by a program subject to the federal Part 2 regulations, meaning it is federally assisted and holds itself out as providing and provides SUD services.2
The Final Rule also makes a number of NPP changes originally proposed by two other proposed rules (issued in 20213 and 20224). These include:
- A CE that creates or maintains Part 2 records must provide notice to individuals of the ways the CE may use and disclose such records and of the individual’s rights and the CE's responsibilities with respect to the records;
- A CE must provide notice to individuals that a Part 2 record may not be used or disclosed in a civil, criminal, administrative, or legislative proceeding against the individuals without their consent or a court order;
- A CE must provide individuals with a clear and conspicuous opportunity to elect not to receive fundraising communications before using Part 2 records for fundraising purposes for the CE's benefit; and
- An NPP must include a statement that explains PHI disclosed under the Privacy Rule may be subject to redisclosure and no longer protected by the Privacy Rule.
Notably, the Final Rule does not address a number of other significant proposals from the January 2021 proposed rule, such as expanding the right of individual access; shortening the time frame within which a covered entity must respond to an individual’s request for access to their records; and clarifying that covered entities are expressly permitted to disclose PHI to social services agencies, community-based organizations, and other similar third parties that provide health-related services, in order to expand and improve care coordination and care management.
Accounting of Disclosures
HHS confirmed that the new attestation requirements have no effect on an individual’s right to an accounting of disclosures under the HIPAA Privacy Rule.
Personal Representatives
The Final Rule clarifies that a person’s or entity’s status as a personal representative cannot be denied because it provided or facilitated reproductive health care, in an effort to alleviate concerns that regulated entities could potentially assert that, by virtue of the personal representative’s involvement in the reproductive health care of the individual, the entity believes that the personal representative is subjecting the individual to abuse.
For questions on the above, please reach out to Randi Seigel, Alice Leiter, or Angela Haddon. For more information on how to subscribe to Manatt on Health, please reach out to Barret Jefferds.
1 HHS released a Part 2 final rule in February, designed to more closely align the Part 2 Confidentiality of Substance Use Disorder Patient Records regulations with the regulatory requirements under HIPAA. As indicated by OCR and the Substance Abuse and Mental Health Services Administration (SAMHSA), the changes to this regulation are intended to improve care coordination for patients seeking or undergoing substance use disorder (SUD) treatment, ease patient privacy concerns, and break down barriers to information sharing by easing compliance complexities and providing patients with additional rights. For more on the Part 2 final rule, see the Manatt on Health analysis.
2 42 C.F.R. § 2.11
3 86 FR 6446 (Jan. 21, 2021).
4 87 FR 74216 (Dec. 2, 2022). For more, see the Manatt on Health analysis.