Office for Civil Rights Publishes Guidance on Releasing Protected Health Information Related to Abortion

The Office for Civil Rights (OCR) has published guidance discussing how the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule applies to release of information concerning abortion. Most health care providers are covered entities under HIPAA, and are permitted to disclose protected health information (PHI) only as expressly permitted or required under the Privacy Rule. The guidance discusses several scenarios involving the Privacy Rule provisions concerning disclosures required by law, disclosures to law enforcement and disclosures to avert a serious threat to health or safety.

Disclosures of PHI required by law include only disclosures where the health care provider is compelled to disclose PHI, and the disclosure is limited to what the law requires. OCR gives the example of a patient in a hospital emergency department experiencing complications related to miscarriage in the tenth week of pregnancy, where a hospital staff member suspects that the patient may have taken medication to end the pregnancy. If state law prohibits abortion after six weeks but does not expressly mandate health care workers to report suspected violations to law enforcement, disclosure would be prohibited.

Concerning disclosures for law enforcement, OCR notes that the Privacy Rule permits disclosure only where law enforcement presents a legally enforceable mandate, such as a court order. If a law enforcement official requests a reproductive health care clinic to provide information on abortions at the facility but the official does not present a court order or other binding legal process, the clinic would violate the Privacy Rule by disclosing the requested information. In contrast, if the official presents a court order requiring the clinic to provide that information, the Privacy Rule would permit the clinic to disclose only the PHI expressly covered by the order.

Finally, OCR discusses a scenario where a pregnant patient in a state that bans abortion informs their health care provider that they intend to seek an abortion in another state. OCR concludes that disclosing this information to law enforcement would violate the Privacy Rule, because the patient’s statement would not qualify as a serious and imminent threat to the health or safety of a person or the public, and would be inconsistent with professional ethical standards.

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/phi-reproductive-health/index.html