Document Type

Article

Publication Date

Fall 2025

Publication Title

The Journal of Gender, Race & Justice

Abstract

On April 26, 2024, the federal Department of Health and Human Services (HHS) promulgated a final rule (Final Rule) amending the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The Final Rule prohibits HIPAA covered entities and business associates from using and disclosing protected health information (PHI) to conduct criminal, civil, or administrative investigations into an individual for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care. The Final Rule also prohibits HIPAA covered entities and business associates from using and disclosing PHI to impose criminal, civil, and administrative liability on any individual, or to identify any individual, for the same purposes. The Final Rule refers to each of these three prohibitions as a purpose-based use and disclosure prohibition. Extraordinarily controversial, the Final Rule has been challenged on a number of administrative law grounds. According to its challengers, the Final Rule exceeds HHS’s authority under the HIPAA statute, contravenes the HIPAA statute, and is arbitrary and capricious in violation of the Administrative Procedure Act (APA). This Article offers an additional, substantive criticism of the Final Rule that runs in the opposite direction. That is, the wording of the Final Rule suggests that the purpose-based use and disclosure prohibitions only apply when a covered entity or business associate has received a request for PHI, such as a request for PHI from law enforcement. If this suggestion is true, the Final Rule ignores the fact that many health industry disclosures of reproductive health information occur without a prior request for PHI. Indeed, many health care providers volunteer (that is, they initiate disclosures of) reproductive health information to alert law enforcement to the provision or receipt of health care that the provider (frequently incorrectly) believes evidences a crime. This Article argues that the Final Rule misses the mark by conditioning the confidentiality of reproductive health information on a covered entity’s or business associate’s receipt of a request for PHI. Allowing covered entities and business associates to volunteer PHI to law enforcement without prior patient authorization undermines the trust necessary for the proper functioning of provider-patient relationships, discourages individuals from seeking reproductive health care, and jeopardizes the health, safety, and welfare of individuals who need reproductive health care. To correct the Final Rule, this Article re-writes the purpose-based use and disclosure prohibitions so they apply to all uses and disclosures of PHI by covered entities and business associates that involve the: (i) conduct of a criminal, civil, or administrative investigation into any individual for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care; (ii) imposition of criminal, civil, or administrative liability on any individual for the same mere acts; and (iii) identification of any individual involved in the same mere acts. If adopted by HHS, these re-writes will improve the confidentiality of reproductive health information, restore patient trust in the health care system, and protect the health, safety, and welfare of individuals needing reproductive health care. Addendum: On June 18, 2025, after this Article went to press, a federal district court issued an order vacating most of the Final Rule. The proposals set forth in this Article remain helpful to the extent HHS successfully appeals this order or similar reproductive health privacy rules are promulgated in the future.

Volume

38

Issue

3

First Page

559

Last Page

584

Download

Share

COinS