HIPAA Reproductive Care PHI Overturned, But Law Still Mostly Protects It
Healthcare and privacy attorneys Shannon Hartsfield and Beth Pitman were quoted in a Part B News article on a federal court decision vacating the Biden Administration's reproductive health data protection rule under the Health Insurance Portability and Accountability Act (HIPAA). The rule prohibited the use or disclosure of protected health information (PHI) related to reproductive healthcare for criminal, civil or administrative investigative purposes in certain instances; the purpose of the policy, promulgated as the HIPAA Privacy Rule, was to prevent prosecutors in states that banned abortion post-Dobbs from obtaining PHI in states where it remains legal. Both attorneys commented on what the Purl v. HHS decision striking it down means for providers.
Ms. Hartsfield noted the ruling may come as a relief to providers that were still working on updating their compliance programs, given the rule's scope and large amount of information potentially covered.
"The regulatory changes defined 'reproductive healthcare' very broadly as anything 'that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes,'" she said. "Therefore, it applied to a wide swath of medical information that had nothing to do with abortion. For example, it would apply to records about whether a man was infertile, or records of a woman taking birth control pills."
Ms. Pitman clarified that the effect of the vacatur is nationwide, even after the Trump v. CASA ruling concerning nationwide injunctions, because "an order vacating an agency rule nationwide is treated differently from a nationwide injunction providing individual relief." She also cautioned that Purl did not affect already-established procedures for reviewing and complying with requests for PHI and that compliance with state laws is still necessary.
READ: HIPAA Reproductive Care PHI Overturned, But Law Still Mostly Protects It (Subscription required)