Employers that sponsor self-insured health plans will need to update their health plan HIPAA Privacy Notices, and take other action in respect of HIPAA privacy compliance, as a result of new guidance issued by the Office for Civil Rights (OCR) at the U.S. Department of Health & Human Services (HHS), addressing reproductive health care privacy rights of employees.

OCR’s guidance, issued in the form of a Final Rule, addresses privacy concerns stemming from the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization and related state abortion law changes.

HIPAA and Reproductive Health | HHS.gov

The Final Rule is effective as of June 25, 2024 (HIPAA Privacy Notices need to be updated by February 16, 2026).

What does the new rule provide?

In general, a HIPAA covered entity (like a health plan) or a business associate may not use or disclose protected health information for any of the following activities:

  1. to conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.
  2. to impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.
  3. to identify any person for any purpose described above.

Next Steps:

Covered entities and business associates should consult with their #ERISA counsel and:

  • Review / update current HIPAA policies, procedures and notices, as necessary, to incorporate the Final Rule;
  • Work with third-party administrators (TPAs), including to develop a system to identify and track PHI that is potentially related to reproductive health care;
  • Conduct HIPAA training for the benefits team, as necessary;
  • Assess if current business associate agreements need to be amended in light of the Final Rule; and
  • Monitor additional guidance, including model attestations, from HHS.

When was the last time your HIPAA Privacy Notice was updated?