Reproductive care final rule: What it means and what organizations need to do

In April 2024, a federal ruling related to HIPAA privacy around reproductive rights introduced enhanced privacy protections for patients and providers.

Beyond awareness about compliance, integrating upgraded security protocols to safeguard sensitive reproductive health information could help reinforce patient security — and trust.

Background

The Biden-Harris Administration, through the Office of Civil Rights issued the HIPAA privacy rule to support reproductive healthcare privacy to support and enhance reproductive healthcare privacy by prohibiting the disclosure of protected health information (PHI) related to lawful reproductive healthcare in certain circumstances.

Amendments to the privacy rule will become effective on June 25, 2024, and regulated entities must be in compliance with most of them by Dec. 22, 2024.

Who’s impacted

• Regulated healthcare providers
• Health plans
• Healthcare clearinghouses
• Business associates of the above
• Patients

What’s changed: Law enforcement exception

The original rule set out to define protected PHI for individuals, who’s covered, what information is protected, and how this protected information can be used and disclosed. Organizations are prohibited from sharing health information without a patient’s written consent, except in certain situations as with certain public needs, including law enforcement. In such cases, organizations may share patient information with the police if, say, they’re responding to a legal order like a subpoena or warrant.

Following the U.S. Supreme Court’s Dobb’s decision in 2022, overturning Roe v. Wade (which concluded that the constitution doesn’t protect the right to abortion), 21 states have banned abortion and restricted other reproductive rights.

The final rule enhances privacy protections and prohibits the disclosure of PHI related to lawful reproductive healthcare in certain circumstances, to protect patient confidentiality and prevent medical records from being used against people for providing or obtaining lawful reproductive healthcare.

Amendments now prohibit the disclosure of PHI when it’s requested for the purpose of investigating or imposing liability on any person for the act of seeking, obtaining, providing, or facilitating reproductive healthcare if:

• Care was received in a state where it’s legal, and outside the state where the investigation is authorized
• Care is protected or explicitly allowed by federal law, no matter the state it was provided in
• Organization receiving the request doesn’t know the care was illegal, and no solid evidence was provided to suggest otherwise

Key provisions and implications

Some core impacts of the ruling are as follows:

Enhanced privacy protections

The rule mandates stricter access controls and sharing protocols requiring healthcare providers to obtain clear, explicit consent from patients before disclosing reproductive health information.

Patient rights expansion

Patients now have greater authority to dictate how their information is shared, particularly concerning disclosures to insurers and other healthcare entities.

Patients can request that their reproductive health information not be shared with certain entities, including other healthcare providers or insurers, unless explicitly required by law. This is particularly significant given the varying state laws on reproductive rights.

Upgraded security protocols

Implementation of advanced security measures for storing and transmitting reproductive health information electronically is now essential.

Educational responsibilities

Healthcare providers must educate their staff and patients about these new protections, ensuring everyone understands their rights and obligations under the new rule.

Attestation

The rule requires covered entities to obtain attestation from the requestor that their written request for the patient’s PHI aren’t for a prohibited purpose.

Preparation for compliance

Navigating the complexities of healthcare regulations while maintaining the highest standards of patient privacy can be overwhelming. As healthcare professionals, compliance with this new rule isn’t about adhering to legal standards — it’s about reinforcing trust with your patients and safeguarding their most sensitive information.