Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

On April 22, 2024, the Office for Civil Rights at the U.S. Department of Health &amp; Human Services (HHS) issued a final rule<a href="#note-i">[i]</a> to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to support the privacy of reproductive health care information.<a href="#note-ii">[ii]</a> The final rule follows the Supreme Court decision in Dobbs v. Jackson Women’s Health Organization that overturned Roe v. Wade, eliminating the federal right to abortion under the U.S. Constitution. In response, many states took action to ban or restrict abortion and other reproductive health care.  The federal government has issued this final rule to expand reproductive health care privacy protections out of concern that these new state laws may have a chilling effect on patients seeking reproductive health care and health care providers providing reproductive health care alike.

core/paragraph

The current patchwork of state reproductive health care laws can leave individuals living in more restrictive states with the choice of either having limited-to-no access to reproductive health care services or having to travel to states that offer adequate reproductive health care services. Such travel can be prohibitively expensive, especially for individuals in states landlocked by other states that have similarly restrictive state laws. The federal government has expressed concern that state health care officials could pursue legal action against individuals for seeking reproductive health care in another state. The final rule aims to protect the privacy of individuals legally seeking reproductive health care in other states, making it more difficult for state law enforcement to prosecute such individuals under their home state’s laws. Likewise, the final rule protects the privacy of health care providers who legally provide reproductive health care. The final rule also provides heightened confidentiality protections to communications between patients and their health care providers regarding reproductive health care.

The final rule prohibits health care providers from using or disclosing protected health information (PHI) for the following activities:

core/list

Subject to the Legality Requirement, covered entity health care providers are not required nor permitted to acknowledge that an individual received reproductive health care. Additionally, reproductive health care is presumed to be lawful under the circumstances in which it was provided unless the health care provider has actual knowledge that the reproductive health care was not lawful under the circumstances in which it was provided. (i.e., the care was provided by an unlicensed person or was provided in a state that does not permit reproductive health care).

Seeking, obtaining, providing or facilitating reproductive health care includes, but is not limited to any of the following: expressing interest in, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, administering, authorizing, providing coverage for, approving, counseling on, assisting or otherwise taking action to engage in reproductive health care or attempting any of the same.

Health care providers may, however, continue to use or disclose PHI for purposes otherwise permitted under the HIPAA Privacy Rule where the request for use or disclosure of PHI is not made to investigate or impose liability on any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care. Such purposes could include, for example, billing for health care services, health care operations or defending a medical malpractice claim by the individual.

core/heading

The final rule requires health care providers that receive a request for PHI relating to reproductive health care to obtain a signed attestation that the use or disclosure is not for any of the following prohibited purposes:

HHS plans to publish model attestation language.

Health care providers are required to revise their notices of privacy practices to inform individuals that their PHI may not be used or disclosed for a prohibited purpose by February 16, 2026. Providers that are also subject to the confidentiality rules for substance use disorder information at 42 C.F.R. Part 2 (Part 2 Rules) must also update their notices of privacy practices by February 16, 2026, to address other required changes to the Part 2 Rules.

Health care providers are required to comply with the new rules beginning on December 23, 2024, except for the changes to the Notice of Privacy Practices, which must be made by February 16, 2026.

In addition to updating their notices of privacy practices, health care providers should:

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/05/New-HIPAA-Reproductive-Health-Care-Privacy-Protections.pdf

core/file

core/separator

<a id="_ftn1" href="#_ftnref1">[i]</a> <a href="https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy">Federal Register: HIPAA Privacy Rule To Support Reproductive Health Care Privacy</a>

<a id="_ftn2" href="#_ftnref2">[ii]</a> The term “reproductive health care” is defined as health care that affects the health of the individual in all matters relating to the reproductive system and to its functions and processes.  45 C.F.R. 164.103.

New HIPAA Reproductive Health Care Privacy Protections

Services