HHS Issues Final Rule to Protect Privacy of Reproductive Healthcare Data

Patients who share their health information -- including reproductive health information -- with providers and health plans have the right to have that information kept private, according to a final rule issued Monday by HHS.

"When Dobbs overturned Roe vs. Wade, it did more to damage access to healthcare than anything that we can think of in our lifetimes," HHS Secretary Xavier Becerra said at a press conference at HHS headquarters in Washington. He was referring to the Supreme Court's Dobbs v. Jackson Women's Health Organization decision in June 2022, which overturned Roe v. Wade and put abortion laws back into the hands of the states.

However, "it did more than just overturn the right to access abortion care," Becerra said. "It took away the right to access care, period. And for those who don't believe that, all you have to now look at is what is happening."

"Families who are hoping to have children through in vitro fertilization are finding that Dobbs may have ruined that opportunity," he continued. "They're finding that access to contraception care, which is not abortion, [is] now being threatened as well. And so today Americans are living lives recognizing that at least for women, they have fewer rights today than their mothers did, and it is difficult sometimes to comprehend. But there is one thing Dobbs did not take away, and that is the right of Americans to their privacy."

According to an HHS press release, the final rule strengthens the privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA). It will:

• Prohibit the use or disclosure of personal health information (PHI) when it is sought to investigate or impose liability on individuals, healthcare providers, or others who seek, obtain, provide, or facilitate legal reproductive healthcare.
• Require a regulated healthcare provider, health plan, clearinghouse, or their business associates, to obtain a signed attestation that certain requests for PHI potentially related to reproductive healthcare are not for these prohibited purposes.
• Require regulated healthcare providers, health plans, and clearinghouses to modify their Notice of Privacy Practices to support reproductive healthcare privacy.

"We are in the midst of a public health crisis -- a crisis created by blatant attacks on reproductive rights of those I care for, of our communities, and even my own daughters, attacks that disrespectfully ignore individuals' personal agency, autonomy and their very humanity," said Serina Floyd, MD, an ob/gyn and an abortion provider at Planned Parenthood in the Washington area. "As an abortion provider caring for the residents of the [D.C.-Maryland-Virginia area], as well as those forced to travel here for care from as many as thousands of miles away, I see firsthand the chaos, confusion, fear and anxiety these unrelenting attacks cause."

"We are living in a world where patients, healthcare providers, and support persons are at risk of criminalization for seeking, obtaining, providing, or facilitating [abortion care]," Floyd said. "At this moment in time, breaches and patient privacy can have dire consequences for my patients and for myself. This should never be the case. Your personal health data should never be used against you, not by prosecutors, not by lawmakers, and not by private citizens who have been encouraged to enforce abortion laws." Floyd was referring to a Texas law that allows state residents to sue for up to $10,000 anyone who helps perform or induce an abortion.

Jennifer Klein, director of the White House Gender Policy Council, said that "doctors and nurses are being threatened with jail time for providing the care they were trained to provide ... The president and vice president [Joe Biden and Kamala Harris] believe this should never happen in America. It's why the president has directed his administration to protect access to a wide range of reproductive healthcare, including abortion, contraception, and IVF."

Melanie Fontes Rainer, director of the HHS Office for Civil Right, said that in the time since Roe was overturned, her office has "heard from patients and providers, medical organizations, and many more across the country on their worries about their ability to access healthcare and its impact on their privacy. As a result, individuals may hesitate to interact with or seek care from providers, health plans, pharmacies, and related health applications out of fear that their data will be tracked and shared with state agencies, law enforcement, and others." She urged women who feel their rights have been violated to file a complaint with her office.

During a question-and-answer session, Fontes Rainer noted that the rule is meant to apply to women who have to leave their home state to seek reproductive healthcare. "When a woman travels from one state where the care might be banned to another state to receive lawful reproductive healthcare, no matter what that care is -- if it's a pill, or it's a procedure, or it's just a medical examination, when that woman goes home, her medical records will be protected," she said.

The woman herself, "her providers, or her home [state] providers -- who literally had nothing to do with the care she received in the first instance -- they will be protected and they'll be able to say, 'No, you cannot have this information,'" she continued. "And the provider in the state where she traveled will also be protected from folks reaching in to go after that type of medical care."

Asked whether he was concerned that HHS would get sued over the final rule, Becerra responded that getting sued "is just par for the course. We're going to do everything we need to do ... If you're accessing the care that you think you need, or your provider has told you that you need, then please remember, we want to protect your privacy. If you believe your privacy was abridged or someone violated your right to privacy, let us know. Let us figure out if we can protect your privacy."

The final rule will take effect 60 days after publication in the Federal Register.

Comment