HHS Issues Final Rule in an Important Effort to Safeguard Reproductive Privacy

The Department of Health and Human Services published a final rule this week strengthening privacy protections for reproductive health information. The rule extends the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule by prohibiting regulated entities from using or disclosing personal health information for the “mere act of seeking, obtaining, providing, or facilitating reproductive health care.” This is an important reproductive privacy safeguard for millions of Americans, particularly in the wake of the U.S. Supreme Court’s decision invalidating the constitutional right to abortion in Dobbs v. Jackson Women’s Health Organization. As EPIC wrote in its comments to HHS, the collection and misuse of reproductive health information post-Dobbs can expose people to undue criminalization under newly-enacted state laws and deter others from seeking reproductive health services even where they are legal.

Although HHS has concluded the current rulemaking, EPIC continues to support two further amendments to the HIPAA Privacy Rule set out in its comments. First, the Rule should protect reproductive health care provided in every state, including states that have banned or severely limited access to abortion and other reproductive health services. As adopted, the new rule only covers PHI concerning reproductive health care that was lawful in the jurisdiction in which it was obtained. Second, HHS should adopt a warrant requirement for law enforcement access to PHI. While the changes finalized this week require a signed attestation from law enforcement that they are not seeking PHI related to reproductive health care for any prohibited purpose, HHS should strengthen these protections and bring the Privacy Rule in line with the Fourth Amendment by establishing a warrant requirement supported by probable cause.

EPIC regularly files comments on proposed rules to protect the privacy of personal information and advocates for reproductive privacy and other health privacy protections. EPIC released a statement in 2022 opposing the Supreme Court’s rollback of the constitutional right to abortion and published an analysis of reproductive privacy after the overturning of Roe v. Wade.