HIPAA Privacy Rule Update to Support Reproductive Health Care Privacy | What these changes mean for providers of substance use and mental health treatment services | | If you provide substance use or mental health treatment services, the people you serve may share information about their reproductive health, including abortion and related healthcare services. In these cases, it is important to know that the HHS Office for Civil Rights (OCR) announced in April 2023 a Final Rule amending the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to support reproductive healthcare privacy.
The Final Rule applies to covered entities and business associates, and prohibits certain uses and disclosures of protected health information (PHI) about reproductive health care that was lawfully provided. | Key Points for Providers of Substance Use Disorder (SUD) and Mental Health (MH) Treatment Services: | In the course of providing care related to substance use or behavioral health, a patient may also share information about their reproductive healthcare, including care provided by another (non-MH/SUD) healthcare provider. Providers may presume the reproductive healthcare was lawfully provided, absent actual knowledge or substantial factual basis otherwise. If you receive a request for information potentially related to reproductive healthcare for health oversight activities, law enforcement, judicial or administrative proceedings, or regarding those who have died, consult with your agency’s administrator, attorney, or privacy/compliance officers before releasing information.
| Key Points for Administrators and Privacy/Compliance Officers at Behavioral Health Agencies: | The Final Rule prohibits the use or disclosure of PHI for the following purposes: To conduct a criminal, civil, or administrative investigation or proceeding against any person seeking, obtaining, providing, or facilitating reproductive healthcare that is lawfully provided; or To identify any person for the purpose of initiating such investigations or proceedings.
When a HIPAA covered entity (including a behavioral healthcare provider) receives a request for PHI potentially related to an individual’s reproductive healthcare, and the request is for the purpose of health oversight activities, law enforcement, judicial or administrative proceedings, or regarding those who have died, then the HIPAA covered entity must obtain a signed attestation from the requestor. For behavioral healthcare providers, it is particularly important to understand the Final Rule’s presumption: reproductive healthcare provided by another person is presumed lawful, absent actual knowledge or substantial factual basis otherwise. The effective date of the Final Rule was June 25, 2024. HIPAA covered entities and business associates may begin implementing the heightened privacy protections now, and must be in compliance with the Final Rule by December 23, 2024. The Final Rule also introduced changes to the Notice of Privacy Practices (NPP), with a compliance date of February 16, 2026. These changes are consistent with changes to 42 Code of Federal Regulations (CFR) 2.22 which concerns the Part 2 Patient Notice that is discussed in the rule.
To learn more about the final rule, visit the HHS Office for Civil Rights’ resources for community members, covered entities, and business associates. | | For any questions or concerns, or to share a resource, request technical assistance, or sign up for our email list, | Funded by SAMHSA, the CoE-PHI develops and disseminates resources, training, and TA for states, healthcare providers, school administrators and individuals and families to improve understanding and application of federal privacy laws and regulations, including FERPA, HIPAA, and 42 CFR Part 2, when providing and receiving treatment for SUD and mental illness. Resources, training, technical assistance, and any other information provided through the CoE-PHI do not constitute legal advice. |
|
|
