On April 22, the United States Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released a Final Rule prohibiting the use and disclosure of protected health information (PHI) related to lawful reproductive healthcare in certain circumstances. This Final Rule was effective as of June 25 and serves as the latest amendment to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule.
Regulated entities subject to the Final Rule must comply with certain requirements as early as Dec. 23, giving these entities limited time to assess the implications and draft and operationalize policies, procedures, and forms.
The Final Rule is a direct response to state abortion laws that were enacted/amended shortly after the U.S. Supreme Court decision in Dobbs v. Jackson Women’s Health Organization overturned the longstanding precedent of Roe v. Wade. The Final Rule attempts to strengthen certain patient privacy protections relating to the use or disclosure of reproductive health PHI by HIPAA-covered entities and their business associates.
On Sept. 4, Texas Attorney General Ken Paxton filed a complaint against HHS and OCR, challenging the Final Rule – arguing that the Final Rule restrictions significantly harm state investigations. Illinois Attorney General Kwame Raoul issued a statement in response to Texas’s lawsuit, calling the challenge a “cruel attack that only serves to instill fear and punish people across the country for accessing medical care.” Other states may challenge the Final Rule as well. Meanwhile, the December 2024 Final Rule compliance date looms large.
