Published May 23, 2023
In accord with the Biden administration’s pro-abortion agenda, the U.S. Department of Health and Human Services issued a notice of proposed rulemaking (NPRM) on April 17, 2023, titled “HIPAA Privacy Rule To Support Reproductive Health Care Privacy.” The NPRM would modify privacy standards under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for information related to “reproductive health care.”
With certain exceptions, HIPAA safeguards the privacy and security of individuals’ protected health information (PHI) or individually identifiable health information transmitted by or maintained in electronic media or any other form or medium. HIPAA applies to “covered entities,” including health plans, insurance companies, and most health care providers, such as hospitals, clinics, doctors, and other medical professionals. HIPAA, however, generally does not apply to employers, schools, states, or most law enforcement agencies.
Citing the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization and certain states’ post-Dobbs abortion laws, HHS believes “it may be necessary” to modify privacy standards related to requests for the use or disclosure of an individual’s PHI related to reproductive health care because of the “potential” for such uses or disclosures “to undermine access to and the quality of health care generally.” Specifically, HHS is concerned about “criminal, civil, or administrative investigations or proceedings that chill access to lawful health care and full communication between individuals and health care providers.” As such, it issued the NPRM to “protect the trust between individuals and health care providers.”
New Definitions
HHS proposes three definitional changes. First, “person” which is currently defined as “natural person, trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private,” would specify that a natural person means “a human being who is born alive.” In 2019, HHS under the Trump administration enforced HIPAA against a Florida medical center for failing to provide a mother timely access to prenatal health records for her unborn child. The NPRM, in contrast, would directly exclude unborn children from HIPAA protections.
Second, “public health” (as used in the terms “public health surveillance,” “public health investigation,” and “public health intervention”) would be defined to mean “population-level activities to prevent disease and promote health of populations.” These activities, however, would explicitly exclude “uses and disclosures for the criminal, civil, or administrative investigation into or proceeding against a person in connection with obtaining, providing, or facilitating reproductive health care” and “for the identification of any person in connection with a criminal, civil, or administrative investigation into or proceeding against a person in connection with obtaining, providing, or facilitating reproductive health care.” This limitation would likely inhibit state health departments’ collection of health data and investigations and enforcement of health and safety regulations.
Third, “reproductive health care” would be defined broadly as “care, services, or supplies related to the reproductive health of the individual.” While much of the discussion in the NPRM is focused on abortion, this expansive definition would cover not only abortion, but also contraception, pregnancy, miscarriage, fertility treatments, and even sterilizing “gender transition” interventions, such as puberty blockers, cross-sex hormones, and genital surgeries.
Additional Limitations on the Use and Disclosure of “Reproductive Health Care” Information
Generally, outside of treatment, HIPAA prohibits the use and disclosure of PHI without an individual’s permission. Exceptions exist where there is an imminent threat to the health and safety of a person and for law enforcement purposes when there is a court order.
In the NPRM, HHS proposes 45 CFR § 164.502(5)(iii) which would add extra limitations to the use and disclosure of PHI for reproductive health care. Under the proposal, PHI may not be used or disclosed in three circumstances when it is “for a criminal, civil, or administrative investigation into or proceeding against any person in connection with seeking, obtaining, providing, or facilitating reproductive health care” or “to identify any person for the purpose of initiating” such an investigation or proceeding.
Those three circumstances are where the investigation or proceeding is in connection with any person “seeking, obtaining, providing, or facilitating reproductive health care”:
(1) “outside of the state where the investigation or proceeding is authorized and where such health care is lawful in the state in which it is provided”;
(2) “that is protected, required, or authorized by Federal law, regardless of the state in which such health care is provided”; and
(3) “that is provided in the state in which the investigation or proceeding is authorized and that is permitted by the law of that state.”
“Seeking, obtaining, providing, or facilitating reproductive health care” would include, at a minimum, “expressing interest in, inducing, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, assisting, or otherwise taking action to engage in reproductive health care; or attempting any of the same.”
The NPRM references the newly discovered federal authority the Biden Administration claims for abortion, citing the Emergency Medical Treatment and Active Labor Act 161 (EMTALA) and Department of Veterans Affairs’ regulations as examples of federal laws that could require “reproductive health care,” and thus fall under circumstance 2.
HHS is clear that the NPRM would preempt state law that would require use or disclosure of PHI for reproductive health care for the proposed “prohibited purposes.” It places the burden of determining the lawfulness of the “reproductive health care” on the covered entity, which may or may not have the relevant legal expertise to make that determination. Indeed, whether a particular act is lawful is often not established until after conclusion of an investigation or court case. In effect, the NPRM would likely inhibit states’ ability to investigate or enforce abortion laws or laws prohibiting minors from accessing gender transition drugs and surgeries.
HHS also proposes adding § 164.509 which would provide additional attestation standards specific to the use and disclosure of PHI “potentially related to reproductive health care.” This would make it even harder for covered entities to use or disclose PHI, even with an individual’s permission.
Changing Disclosures About Victims of Abuse, Neglect, or Domestic Violence
Generally, HIPAA allows a personal representative of an individual to see that individual’s PHI unless the covered entity has a “reasonable belief” of abuse, neglect, or domestic violence by the personal representative or when it would not be “in the best interest of the individual.” Under the NPRM, however, these exceptions would “not apply where the primary basis for the covered entity’s belief is the facilitation or provision of reproductive health care by such person for and at the request of the individual.” This would open the door for abusers to obtain PHI of those whom they are abusing.
HIPAA also permits covered entities based on reasonable belief to disclose PHI about victims of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, authorized by law to receive reports of abuse, neglect, or domestic violence. The NPRM would prohibit such permissible disclosures when the report “is based primarily on the provision of reproductive health care.” Similarly, this prohibition could enable child abuse coverups.
Costs and Benefits
HHS estimates that first-year costs alone attributed to the NPRM would be approximately $612 million. These costs are associated with covered entities “(1) creating an attestation form and handling requests for disclosures for which an attestation is required; (2) revising business associate agreements; (3) updating the Notice of Privacy Practices (NPP) and posting it online; (4) developing new or modified policies and procedures; (5) revising training programs for workforce members; and (6) requesting an exception from preemption of state law.” There would be additional ongoing costs in subsequent years.
HHS states the NPRM would “likely” result in “substantial” and “important benefits” that it is “unable to fully quantify at this time.” These benefits include: (1) “improved trust between individuals and health care providers”; (2) “enhanced privacy and improved access to reproductive health care and information, which may prevent increases in maternal mortality and morbidity”; (3) “increased accuracy and completeness in patient medical records, which may prevent poor health outcomes”; (4) “enhanced support for victims of rape, incest, and sex trafficking”; and (5) “maintenance of family economic stability.”
HHS “expects” that “the totality of the benefits” of the NPRM would “outweigh the costs.”
Rachel N. Morrison is a Fellow at the Ethics and Public Policy Center, where she directs EPPC’s HHS Accountability Project. An attorney, her legal and policy work focuses on religious liberty, health care rights of conscience, the right to life, nondiscrimination, and civil rights.
