New guidance from the HHS Office for Civil Rights (OCR) about the disclosure of information on reproductive health care under HIPAA is a powerful reminder that the Privacy Rule only allows covered entities (CEs) to disclose protected health information (PHI) without patient consent under narrow circumstances but in most cases doesn’t require them to, and that state law often is the arbiter of what should be disclosed, attorneys said.^[1] Compliance and privacy officers might want to revisit their disclosure policies with that in mind in the wake of the June 24 Supreme Court decision that overturned the constitutional right to abortion enshrined in Roe vs. Wade, because emergency room nurses, physicians and other clinicians may be unsure of their obligations in certain situations, including disclosures of PHI.^[2]

“Providers need to have heightened awareness of requests for information and the main question is not about HIPAA,” said attorney Katie Ilten, with Fredrikson & Byron in Minneapolis. “It is about whether state laws apply to someone.” But nurses and many other health care professionals who may be mandatory reporters under various state laws can’t be expected to know the nuances of state law, “especially on this topic that is rapidly evolving,” said Richelle Marting, an attorney in Olathe, Kansas.

The OCR guidance, posted June 29, emphasizes that the HIPAA Privacy Rule allows, but doesn’t require, covered entities to disclose PHI without patient authorization. There are limited exceptions, including for disclosures to law enforcement, but they must be backed by something else, such as court orders and state laws.

The message is loud and clear: “HIPAA has never been a law that compels disclosure,” Ilten said.

The guidance is “a great reminder that under HIPAA, a disclosure that is required by law for HIPAA purposes is only permissible and not mandatory,” Marting said. Because that often will be determined by state laws, providers will have to understand what their state laws require, Marting said. “Under HIPAA, where a disclosure meets the ‘required by law’ criteria, HIPAA allows the disclosure but only the minimum necessary information that is required under state law.”