The Department of Health and Human Services (HHS) issued a final rule Monday blocking the disclosure of protected health information to aid in the investigation or litigation of patients or providers involved in legal reproductive health care.
The rule issued by the HHS Office for Civil Rights (OCR) prohibits providers, clearing houses and their business associates regulated by the Health Insurance Portability and Accountability Act (HIPAA) from disclosing a patient’s protected health information to facilitate an investigation or impose liability by law enforcement.
“Each and every American still has a right to their privacy, especially when it comes to their very private, very personal health information,” HHS Secretary Xavier Becerra said in a Monday press briefing.
“Please make no mistake … when you access care, when you go see a doctor, when you enter a hospital, when you see a medical professional and you provide — because you’re required or you requested — very personal health information, that information is entitled to protections under federal law, perhaps even state law. But under federal law, you have rights to your privacy. That’s what today is about,” he said.
OCR Director Melanie Fontes Rainer said this rule applies in states where the reproductive health care service in question is legal. She added the rule is meant to aid women who travel out-of-state to receive reproductive health care services, such as abortions — both surgical and medical.
Both the out-of-state provider and the patient’s in-state provider who did not provide the reproductive health services but may have these records will be protected under this rule and can refuse requests to disclose the information.
If a person travels out-of-state to receive care that is not legal in their home state, the final rule includes a presumption for providers that services their patients received out-of-state were legal.
Though Democratic lawmakers had called on the administration to include a requirement for law enforcement to obtain a warrant to request patient records, the final rule did not include this provision. Fontes Rainer said these records would still operate under the “the existing HIPAA Privacy Rule.”
Under HIPAA, providers are prohibited from sharing protected health information in response to a subpoena unless certain conditions are first satisfied.
Noting the limitations of the rule as it does not apply in states where abortions are banned, Becerra said, “We have no illusion that everything that the president has urged us to do with our authorities is going to undo Dobbs.”
“If your privacy can be violated simply by trying to exercise the health care you need, or your medical professional tells you you need, that puts at risk whether you feel comfortable getting that health care,” Becerra said. “This is like a chapter in 1984. This is as Orwellian as it gets.”
Updated at 12:36 p.m. EDT