The HHS Office for Civil Rights (OCR), in the wake of the Supreme Court decision overturning Roe v. Wade, issued guidance on the HIPAA Privacy Rule and disclosures of information relating to reproductive health care, emphasizing that HIPAA is intended to give “individuals confidence that their protected health information (PHI), including information relating to abortion and other sexual and reproductive health care, will be kept private.”^[1]

Consequently, OCR said, “regulated entities can use or disclose PHI, without an individual’s signed authorization, only as expressly permitted or required by the Privacy Rule. The Privacy Rule permissions for disclosing PHI without an individual’s authorization for purposes not related to health care, such as disclosures to law enforcement officials, are narrowly tailored to protect the individual’s privacy and support their access to health services.”

OCR noted that the Privacy Rule “permits but does not require covered entities to disclose PHI about an individual, without the individual’s authorization, when such disclosure is required by another law and the disclosure complies with the requirements of the other law. This permission to disclose PHI as ‘required by law’ is limited to ‘a mandate contained in law that compels an entity to make a use or disclosure of PHI and that is enforceable in a court of law.’”