The forecast for healthcare privacy regulations continues to remain on the radar. A proposed amendment to the HIPAA Privacy Rule[1] (Proposed Amendment) attempts to strike a balance between a citizen’s right to privacy and enforcement of state laws regulating access to reproductive healthcare. The Proposed Amendment represents a shift in the way patient data related to reproductive healthcare is protected. It should be viewed as a precursor, analogous to a weather watch, and healthcare organizations and business associates should remain alert.
The Proposed Amendment and Reproductive Healthcare
Protected Health Information (PHI) has long been defined by the HIPAA Privacy and Security rules[2]. The Proposed Amendment’s inclusion of a new definition related to reproductive healthcare (RHC), however, would create a sub-category of data with a more stringent set of rules for use and disclosure outside of a healthcare context.
The Proposed Amendment defines RHC as “care, services, or supplies related to the reproductive health of the individual.” This definition includes both services furnished by providers and individuals’ efforts to secure RHC. RHC includes but is not limited to the following:
- Contraception, including emergency contraception;
- Fertility or infertility-related healthcare;
- Other types of care, services, or supplies used for the diagnosis and treatment of conditions related to the reproductive system;
- Pregnancy-related healthcare including but not limited to miscarriage management, molar or ectopic pregnancy treatment, pregnancy termination, pregnancy screening, products related to pregnancy, prenatal care, and similar or related care;
- Other types of care, services, or supplies used for the diagnosis and treatment of conditions related to the reproductive system including healthcare related to reproductive organs, regardless of whether the healthcare is related to an individual’s pregnancy or whether the individual is of reproductive age; and
- Services such as assisted reproductive technology and its components, as well as other care, services, or supplies used for the diagnosis and treatment of infertility.
The Proposed Amendment would prohibit the use and disclosure of RHC-related PHI for purposes such as criminal, civil, or administrative investigations or proceedings when the individual obtained RHC lawfully. Disclosure of RHC-related PHI would be prohibited without an authorization for the purpose of actions taken outside of a healthcare context when the RHC in question was undertaken in a state where it was legally authorized. This potential change provides protection not only for the patient but also for the providers and their associated organizations. Additionally, because RHC-related PHI would be prohibited from being disclosed for investigation and prosecution purposes, this change is intended to calm fears associated with individual willingness to provide accurate and relevant RHC information to healthcare providers.
Next Steps for Healthcare Organizations and Business Associates
Healthcare organizations and business associates will need to consider several broad categories of compliance activities if the Proposed Amendment takes effect. The first and most easily identifiable is the adoption of an attestation form mandated by the Proposed Amendment. As outlined in the Proposed Amendment, the attestation form would be used when disclosures currently “Required by Law” occur. The attestation itself would be completed by the requestor, indicating their understanding and assurance that the RHC-related PHI would not be used for newly prohibited purposes if the Proposed Amendment is adopted. The U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR) indicates it may provide a template for general use; otherwise, affected organizations would need to develop their own compliant attestation forms.
Not all impacts of the Proposed Amendment are so clearly visible, however. Within an organization’s compliance and privacy programs, the following key items might also require revision to comply with the Proposed Amendment’s definition of RHC and its appropriate use and disclosure:
- Revision and expansion of an organization’s Notice of Privacy Practices, Business Associate Agreement templates, and HIPAA notification forms;
- Updates to organizational privacy policies and procedures to ensure consistency with revised processes and documentation methods; and
- Development and provision of training to all organizational employees regarding updated policies, processes, and procedures.
Of note, the HHS OCR has acknowledged the national financial burden associated with implementation of these revised measures should the Proposed Amendment take effect. Its analyses estimate that the first year will cost the industry approximately $612 million. Years 2-5 will add $68 million each year, for an annualized cost of $183 million each year over the next five years.
Despite the costs, as outlined in the Proposed Amendment, the HHS OCR believes the non-quantifiable benefits outweigh the quantified costs involved. The benefits include these:
- a broader approach to health literacy related to reproductive health;
- quality healthcare through the maintenance of trust between patients and providers;
- the lowering of barriers to prenatal healthcare for any patient seeking a complete range of options;
- improved mental health and emotional well-being for patients fearing prosecution due to disclosure of their PHI;
- protection for rape survivors who may be forced into undue scrutiny of their medical records;
- improvement, or at least maintenance, of the economic stability for families facing investigations or legal proceedings for actions taken legally in another state;
- maintenance of the economic stability of healthcare organizations facing those same investigations or legal proceedings; and
- the ability of individual patients to obtain information regarding and make full and complete lawful decisions concerning their reproductive healthcare.
Like watching changeable weather, healthcare organizations and business associates should continue to monitor developments related to the Proposed Amendment, as well as their effect on organizational processes and procedures. Further, healthcare organizations and business associates should evaluate the requirements of the Proposed Amendment and submit comments by June 16, 2023. Comments submitted will bring attention to areas of potential concern and provide additional insight for consideration.
If you have questions about healthcare compliance or regulations, strategic planning, or any other area related to healthcare systems, our executive contacts would be happy to assist. Contact them at the e-mails below or by calling (800) 270-9629.
[1] https://www.govinfo.gov/content/pkg/FR-2023-04-17/pdf/2023-07517.pdf. After its publication on April 17, 2023, the Proposed Amendment remains open for public comment for 60 days.
[2] https://www.hhs.gov/answers/hipaa/what-is-phi/index.html
