Skip to content

HHS Issues Notice of Proposed Rulemaking on Reproductive Health Care Privacy

April 18, 2023

The U.S. Department of Health & Human Services (HHS), Office for Civil Rights (OCR), recently issued a Notice of Proposed Rulemaking (NPRM) that would prohibit the use or disclosure of protected health information (PHI) to investigate and prosecute patients, providers, and others involved in the provision of reproductive health care. The proposed rule is intended to strengthen HIPAA’s Privacy Rule to protect patient-provider confidentiality and prevent private medical records from being used against people seeking or providing lawful reproductive health care.

The NPRM follows in the aftermath of the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization which overturned its ruling in Roe v. Wade. After the Dobbs decision, President Biden signed Executive Order 14076, directing HHS to consider taking action to further protect sensitive reproductive health care information and patient-provider confidentiality. The proposed changes to HIPAA’s Privacy Rule would only apply where the disclosure is “primarily for the purpose” of investigating or imposing liability with respect to reproductive health care in states where such health care is lawful or protected by Federal law, regardless of whether the investigation or proceeding arises in the same or a different state. In all other situations, covered entities would still be permitted to use and disclose PHI as permitted by HIPAA.

OCR’s proposed rule would extend additional privacy protections for providers, insurers, patients, and others to safeguard PHI when that information otherwise would be disclosed or used to identify, investigate, sue, or prosecute someone for seeking, obtaining, providing, or facilitating lawful reproductive health care. Under the proposed rule, reproductive health care includes but is not limited to prenatal care, abortion, miscarriage management, infertility treatment, contraception use, and treatment for reproductive-related conditions such as ovarian cancer.

The requirements in the NPRM, if finalized, would require covered entities to obtain attestations from those requesting reproductive health care information. Under the proposed rules, covered entities will be required to obtain signed attestations from the requestors of PHI related to reproductive health care for health oversight activities, for judicial and administrative proceedings, for law enforcement purposes, or to coroners and medical examiners before using or disclosing the PHI to the requesting party. The attestations must verify that the use or disclosure is not for a prohibited purpose. Where a covered entity determines that the attestation was materially false, they are required to terminate the use or disclosure of the PHI. Covered entities would also need to revise and redistribute their Notices of Privacy Practices to include information on prohibited uses and disclosures.

Covered entities should review the NPRM and submit comments on the proposal to HHS during the 60-day comment period. In the meantime, the current HIPAA Privacy Rule remains in effect, and the existing Privacy Rule permits, but does not require, certain disclosures to law enforcement and others, subject to specific conditions.

The views and opinions expressed in the article represent the view of the authors and not necessarily the official view of Clark Hill PLC. Nothing in this article constitutes professional legal advice nor is it intended to be a substitute for professional legal advice. 

Subscribe for the latest

Subscribe

Related

Event

Webinar: Special Education Bootcamp - Compliance Foundations Under IDEA

Whether you are new to special education leadership or looking to reinforce your foundational knowledge, this interactive webinar will provide a comprehensive overview of the core compliance requirements under the Individuals with Disabilities Education Act (IDEA). Designed for school leaders who are responsible for ensuring legally sound practices, this session will offer practical tools and strategies to help participants navigate common procedural and substantive pitfalls, support sound decision-making, and build a compliant and student-centered special education program.

Explore more
Event

Telehealth Week Webinar 2025: Navigating Legal Changes and Future Trends for Healthcare Providers

Join Paul Schmeltzer, Carrie Foote, and John Howard for our one-hour annual Telehealth Week webinar, focused on the evolving legal landscape of telehealth. This session will cover key topics, including the upcoming DEA final rule on prescribing controlled substances via telehealth, federal reimbursement concerns for telehealth, and what healthcare providers need to prepare for other upcoming changes.

Explore more
Event

Webinar: The Transatlantic Tightrope: AI, ESG and the Evolving Duty of Care for Multinational Companies

Join Mariah Leffingwell and Sam Saarsteiner for a conversation, moderated by co-chair of Clark Hill’s ESG & Sustainability advisory practice, Maram Salaheldin,  that bridges the Atlantic—and the gap between innovation and accountability—as they explore how today’s duty of care must adapt to tomorrow’s technologies.

Explore more