The U.S. Department of Health and Human Services (HHS) has updated the HIPAA Privacy Rule to better protect the privacy of reproductive healthcare information. These changes come following the Dobbs v. Jackson Women’s Health Organization (2022) decision by the US Supreme Court which overthrew Roe v. Wade. They are set to take effect on December 22, 2024, but group health plans must update their policies by February 16, 2026.
This updated rule will now address how Protected Health Information (PHI) related to reproductive healthcare can be used or shared. Group health insurance plans, whether self-funded or fully insured, must now update their agreements, privacy notices, and procedures to include new rules about reproductive healthcare. Staff must be trained to understand and follow new rules.
Under the new rules, health plans and their business partners must get a written and signed statement from anyone requesting reproductive healthcare-related PHI, informing them about possible legal consequences for misuse of the information. The rules specifically ban the use of PHI for:
HHS will provide a sample Notice of Privacy Practices before the rules take effect. Group health plans need to adopt a privacy notice that follows these new rules and update their policies and training materials.
Group health plans should start preparing now to ensure they are ready for these changes.