The Biden-Harris Administration, through the Office for Civil Rights (OCR) at the U.S. Department of Health & Human Services (HHS), has issued a Final Rule modifying the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to enhance reproductive health care privacy. This action seeks to safeguard reproductive health care access and privacy along with bolstering patient-physician confidentiality.
The Final Rule fortifies privacy by prohibiting the use or disclosure of protected health information (PHI) related to reproductive health by covered entities (e.g., physicians, hospitals, health plans, health care clearinghouses) and their business associates. The Final Rule also permits covered entities to use or disclose PHI for non-prohibited purposes under the Privacy Rule.
Prohibited purposes include using PHI to: investigate any person for seeking, obtaining, providing, or facilitating lawful reproductive health care; to impose liability on any person for seeking, obtaining, providing, or facilitating lawful reproductive health care; and to identify any person for the purposes of investigation or liability.
To enforce the prohibition, the Final Rule mandates that covered entities obtain a signed attestation from requestors affirming that the PHI will not be used for prohibited purposes. This requirement applies to requests for PHI for health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners.
The Office of the National Coordinator for Health Information Technology (ONC) has confirmed that complying with OCR’s reproductive health regulations will not constitute information blocking. For example, if a request is made to a physician for reproductive health PHI, and the physician requests that an attestation be signed that the PHI will not be used for prohibited purposes and that attestation is not signed, is not complete, or cannot be relied on, a physician can withhold that PHI without being considered an information blocker.
The AMA has been urging both OCR and ONC to provide much needed education and resources to help physicians implement and comply with the regulations and to protect patient and physician information from misuse. In response to our requests, the administration developed the materials below.
Physicians must be in compliance with the Final Rule by December 23, 2024.
Below are several helpful resources provided by OCR. These include:
- Resources to help communicate with other clinicians and community members.
- A fact sheet summary of the rule.
- A recorded briefing by OCR staff reviewing the rule.
Model attestation for a requested use or disclosure of protected health information.
The post HIPAA Privacy Rule to Support Reproductive Healthcare Privacy appeared first on North Carolina Medical Society.