Department of Health and Human Services

  • EPIC Encourages HHS to Promulgate Updated Cybersecurity Requirements to Protect Electronic Personal Health Information

    March 11, 2025

    • Cybersecurity

    • Data Protection

    • Data Security

    • Health and Reproductive Privacy

    • Updates

  • HHS Issues Final Rule in an Important Effort to Safeguard Reproductive Privacy

    April 24, 2024

    The Department of Health and Human Services published a final rule this week strengthening privacy protections for reproductive health information. The rule extends the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule by prohibiting regulated entities from using or disclosing personal health information for the “mere act of seeking, obtaining, providing, or facilitating reproductive health care.” This is an important reproductive privacy safeguard for millions of Americans, particularly in the wake of the U.S. Supreme Court’s decision invalidating the constitutional right to abortion in Dobbs v. Jackson Women's Health Organization.

    • Cybersecurity

    • Data Protection

    • Data Security

    • Health and Reproductive Privacy

    • Updates

  • EPIC Commends Proposed HIPAA Reproductive Health Safeguards, Calls on HHS to Further Strengthen Rule

    June 20, 2023

    In comments to the Department of Health and Human Services, EPIC praised HHS for proposing new reproductive health safeguards for the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and called on the agency to expand those protections.

    • Data Protection

    • Health and Reproductive Privacy

    • Updates

  • Comments of EPIC on HHS Proposed Rulemaking to Modify HIPAA Privacy Rule to Support Reproductive Health Care Privacy

    June 20, 2023

    The Electronic Privacy Information Center (EPIC) submits these comments in response to the Department of Health and Human Services (HHS)’s April 17, 2023 request for comment on its notice of proposed rulemaking to modify disclosure standards for protected health information under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the Health Information Technology for Economic and Clinical Health Act (HITECH Act).[1] The proposed modifications would limit uses and disclosures of Protected Health Information (PHI) where the information relates to lawfully obtained reproductive health care.[2] EPIC commends HHS for taking meaningful steps to protect the privacy of people’s reproductive health information, but we recommend that the agency further strengthen the rule to ensure that these protections are not easily sidestepped, to raise the baseline level of protection for all health data to the constitutional standard, and to specifically overrule state mandatory reporting laws that would otherwise undermine the proposed rule. 

    • Data Protection

    • Health and Reproductive Privacy

    • APA Comments

  • EPIC, Coalition Urge HHS to Abandon Database Tracking HIV PrEP Users

    February 27, 2023

    Rights urged the agency to reverse plans that would require recipients of free HIV Pre-Exposure Prophylaxis (PrEP) to submit information to a database maintained by HHS.

    • Data Protection

    • Government Databases

    • Health and Reproductive Privacy

    • Surveillance Oversight

    • Updates

  • Comments of EPIC, CHLP, PrEP4All, and Patient Privacy Rights to HHS on HIV PrEP Database SoRN

    February 27, 2023

    • Data Protection

    • Government Databases

    • Health and Reproductive Privacy

    • Surveillance Oversight

    • APA Comments

  • Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement

    May 6, 2021

    • Data Protection

    • Health and Reproductive Privacy

    • APA Comments