A final HIPAA rule on reproductive health care privacy prohibits covered entities from disclosing reproductive health care information to law enforcement agencies, with an exception.^[1] The HHS Office for Civil Rights (OCR) released the rule April 22, two days before the U.S. Supreme Court heard oral arguments on whether Idaho’s abortion ban violates the Emergency Medical Treatment and Labor Act (EMTALA)—events that have pushed abortion deeper into the compliance realm.^[2]

The HIPAA rule adds a category of prohibited uses and disclosures of protected health information (PHI) that “encompasses the use or disclosure of PHI for any activities conducted for the purpose of investigating or imposing liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care that the regulated entity that has received the request for PHI has reasonably determined is lawful under the circumstances in which such health care is provided.” Covered entities have 240 days to comply from the date the rule is published in the Federal Register.

“This has the potential to be the most consequential HIPAA rule since the [original] HIPAA rule,” said attorney Rob Keenan, with King & Spalding in Atlanta, with the possible exception of the breach notification rule. “Like everything that’s part of the culture wars, it’s going to be challenged and defended in every possible way.”

The rule requires covered entities (e.g., hospitals and physicians) to update their notice of privacy practices (NPP) to include the prohibition, said attorney Reece Hirsch, with Morgan, Lewis & Bockius LLP in San Francisco. But they have until 2026 to align IT with the NPP changes required by the 2024 Confidentiality of Substance Use Disorder Patient Records regulation (known as Part 2), he said.^[3]

The HIPAA rule’s prohibition is consistent with the Biden administration’s moves to protect reproductive health care in the wake of the 2022 Supreme Court decision in Dobbs v. Jackson Women’s Health Organization, which overturned the right to abortion enshrined in Roe v. Wade. For example, OCR posted guidance on the disclosure of information about reproductive health care under HIPAA that reinforced the fact that the Privacy Rule allows covered entities to disclose PHI without patient consent under narrow circumstances but in most cases doesn’t require them to, and that state law often is the arbiter of what should be disclosed.^[4] There are limited exceptions, including for disclosures to law enforcement, but they must be backed by something else, such as court orders and state laws.