Stemple Quoted on Texas Ruling Removing Additionally HIPAA Privacy Protections for Reproductive Health Care Information

Hillary said that the ruling means HIPAA-covered entities will once again need to comply with the original version of the HIPAA Privacy Rule, under which covered entities are permitted to disclose, without a patient’s authorization, a patient’s reproductive health information for law enforcement purposes and as required by law.

“These disclosures can include disclosures to comply with state reporting mandates. Additionally, covered entities and their business associates are no longer required to obtain an attestation for PHI [protected health information] requests that are potentially related to reproductive healthcare,” she said. “Essentially we’ve returned to the pre-June 2024 HIPAA status quo, where reproductive health information receives the same protections under HIPAA as any other type of protected health information.”

She added, “Covered entities should carefully review their internal HIPAA policies and procedures related to the disclosure of PHI, particularly as it relates to disclosures for judicial, administrative, or law enforcement purposes. These policies should align with the requirements for such disclosures in the original Privacy Rule, as well as any applicable state laws. In many cases, covered entities may be able to revert back to prior versions of their HIPAA policies.”

Hillary noted that covered entities will need to provide workforce training on any updated policies and procedures and will also need to assess whether any of their business associate agreements need to be amended.

“Covered entities may need to revise HIPAA privacy policies and procedures. In particular, covered entities may need to revise their policies that are related to disclosures of reproductive health care information for judicial, administrative, or law enforcement purposes to ensure compliance with the original HIPAA Privacy Rule, which is once again the operative version of the rule,” she said. “Additionally, many states have implemented privacy and consumer protection laws that place restrictions on disclosing reproductive healthcare information. As a result, any revisions to HIPAA policies and procedures should still comply with applicable state law requirements.”

Read the full article.