2 minute read
The U.S. Department of Health and Human Services (HHS) issued a final rule which strengthens HIPAA Privacy Rule by prohibiting PHI disclosure related to lawful reproductive health care in certain situations to protect access and privacy. The rule limits the use, disclosure, and protection of protected health information (PHI) by health care entities. It also permits the use of PHI for non-health care purposes, such as legal investigations.
The final rule prohibits regulated entities from using or disclosing PHI for investigations related to reproductive health care, where lawful. It also prohibits identifying individuals for such investigations. This prohibition applies where a regulated entity reasonably determines that:
If a regulated entity did not provide reproductive health care, the final rule prohibits disclosing PHI without sufficient information to prove legality. This can be overcome by providing evidence that the care was unlawful under the circumstances. When a regulated entity receives a request for PHI related to reproductive health care, they must obtain a signed attestation confirming the use is not prohibited.
Regulated entities may want to review their privacy practices for reproductive health care support and adjust agreements and HIPAA policies for the final rule changes. Download the bulletin for more details.