On April 12, 2023, the Department of Health & Human Services (HHS) issued a Notice of Proposed Rulemaking (NPRM) that would enhance privacy protections in reproductive care. This NPRM strengthens privacy protections already found within the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule by prohibiting the use or disclosure of protected health information (PHI) for purposes of investigating or prosecuting patients, providers, or other participants for their involvement in legal reproductive health care. According to HHS, the proposed rule attempts to bolster protections of reproductive health care in the wake of the U.S. Supreme Court decision in Dobbs v. Jackson Women’s Health Organization overturning Roe v. Wade in 2022.
Under the current HIPAA Privacy Rule, health care providers are permitted, but not required, to make disclosures of PHI to law enforcement and other entities under certain circumstances, referred to as “required by law” disclosures. Under the proposed rule, providers would be prohibited from sharing PHI in those limited “required by law” circumstances where the investigation or proceedings are in connection with reproductive health care that falls under one of the following categories:
- Reproductive health care that is sought, obtained, provided, or facilitated in a state where the health care is lawful and outside of the state where the investigation or proceeding is authorized;
- Reproductive health care that is protected, required, or expressly authorized by federal law, regardless of the state in which the health care is provided; or
- Reproductive health care that is provided in the state where the investigation or proceeding is authorized and is permitted by the laws of such state.
In this proposed rule, the definition of reproductive care includes but is not limited to prenatal care, abortion, miscarriage management, infertility treatment, contraception use, and treatment for reproductive-related conditions such as ovarian cancer.