On April 12, 2023, the Biden administration announced a notice of proposed rulemaking (NPRM) from the Department of Health and Human Services (HHS) Office for Civil Rights (OCR), the agency responsible for enforcing the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The NPRM is designed to protect patient privacy as it relates to the provision of reproductive healthcare. The NPRM would primarily prohibit entities regulated by HIPAA from disclosing protected health information (PHI) related to an individual’s reproductive healthcare to law enforcement or others when such reproductive healthcare is provided in a state where it is legally provided.

Essentially, this proposal is designed to protect individuals who seek or obtain legal reproductive health services in states that legally provide the services from prosecution in states which prohibit such services within their own borders. More, specifically, the NPRM would prohibit the disclosure of PHI by a covered entity for the purposes of:

  1. Investigating or commencing a proceeding against any person in connection with seeking, obtaining, providing, or facilitating reproductive healthcare, where such healthcare is lawful under the circumstances in which it is provided; or
  2. Identifying any person for the purpose of initiating such investigations or proceedings.

Under the NPRM, if a covered entity receives a request for PHI related to reproductive healthcare, it must obtain a statement from the requesting party attesting that the request is not related to one of the prohibited purposes listed above. The NPRM would not prohibit regulated entities from disclosing information related to reproductive healthcare as long as the information is not sought for one of the impermissible purposes.

When responding to a request for PHI related to reproductive healthcare, the NPRM also explicitly requires a regulated entity to make its own determination as to whether the reproductive healthcare was lawfully provided or obtained. Regulated entities may not rely on the representations of a requesting party because, according to the NPRM, as the holders of the requested records, they have the most complete information and are in the best position to determine whether the reproductive healthcare at issue was obtained lawfully.

HHS is soliciting public comment in several areas, including the need to balance an individual’s right to access their health records against the possibility that law enforcement may attempt to subvert this rule by having individuals authorize the release of their healthcare records to law enforcement. HHS is accepting public comments on the proposed rule until June 16, 2023.

Wilson Sonsini Goodrich & Rosati closely follows developments with regulatory organizations such as HHS. For more information, or if you need assistance with regulatory compliance regarding healthcare privacy or other privacy or consumer protection issues, please contact Haley Bavasi, Hale Melnick, Laura Ahmed, or another member of Wilson Sonsini’s privacy and cybersecurity practice.