The Office for Civil Rights of the U.S. Department of Health and Human Services (HHS) has proposed a rule change on the Standards for Privacy for Individually Identifiable Health Information that would protect all “medical” information for “reproductive healthcare” (dog whistle for abortion) from being used for a number of reasons including and explicitly for criminal investigative reasons.
From the summary:
The proposal would modify existing standards by prohibiting uses and disclosures of PHI for criminal, civil, or administrative investigations or proceedings against individuals, covered entities or their business associates (collectively, “regulated entities”)…
Excerpt:
On April 17, 2023, the Office for Civil Rights (“OCR”) of the U.S. Department of Health and Human Services (“HHS”) issued a notice of proposed rulemaking to modify the Standards for Privacy for Individually Identifiable Health Information (the “Privacy Rule”) under the Health Insurance Portability and Accountability Act (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”).[1] The proposed rule would modify existing standards that permit uses and disclosures of protected health information (“PHI”) relating to reproductive health care that may be detrimental to individuals seeking care and may restrict access to such lawful care (the “Proposed Rule”). The full text of HHS’s Notice of Proposed Rulemaking can be found here.
The Proposed Rule was open for comment for 60 days, ending June 16, 2023, and received nearly 9,000 comments. Of the publicly published comments from individuals and organizations, the overwhelming majority support increased protections for reproductive health information. If the Proposed Rule is finalized, it will become effective 60 days after publication of the final rule, requiring regulated entities to comply 180 days after publication of the final rule.
The Department of Health and Human Services (HHS or “Department”) is issuing this notice of proposed rulemaking (NPRM) to solicit comment on its proposal to modify the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The proposal would modify existing standards permitting uses and disclosures of protected health information (PHI) by limiting uses and disclosures of PHI for certain purposes where the use or disclosure of information is about reproductive health care that is lawful under the circumstances in which such health care is provided. The proposal would modify existing standards by prohibiting uses and disclosures of PHI for criminal, civil, or administrative investigations or proceedings against individuals, covered entities or their business associates (collectively, “regulated entities”), or other persons for seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it is