The U.S. Department of Health and Human Services (“HHS”), and Office for Civil Rights (“OCR”) issued a “Final Rule,” HIPAA Privacy Rule to Support Reproductive Health Care Privacy, which was published in the Federal Register on April 26, 2024.1
In this Final Rule and landmark publication, OCR, for the first time in history, absent a federal statutory mandate, categorically and explicitly provides special protections and obligations related to particular types of information created, received, transmitted or maintained by a HIPAA covered entity or business associate; in this case, protected health information (“PHI”) about reproductive health care. Notably, the Final Rule restrictions on the use and disclosure of PHI apply to all HIPAA covered entities, including health care providers that conduct standard transactions, health plans, and health care clearinghouses, as well as to all HIPAA business associates (collectively “Regulated Entities”) and not specifically to certain types of providers or to providers that provide reproductive health care services only.
