# HIPAA Privacy Rule To Support Reproductive Health Care Privacy > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2024-08503 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** April 26, 2024 - **Citation:** 89 FR 32976 ## Text DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Parts 160 and 164 RIN 0945-AA20 HIPAA Privacy Rule To Support Reproductive Health Care Privacy AGENCY: Office for Civil Rights (OCR), Office of the Secretary, Department of Health and Human Services. ACTION: Final rule. SUMMARY: The Department of Health and Human Services (HHS or “Department”) is issuing this final rule to modify the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act). The Department is issuing this final rule after careful consideration of all public comments received in response to the notice of proposed rulemaking (NPRM) for the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (“2023 Privacy Rule NPRM”) and public comments received on proposals to revise provisions of the HIPAA Privacy Rule in the NPRM for the Confidentiality of Substance Use Disorder (SUD) Patient Records (“2022 Part 2 NPRM”). DATES: Effective date: This final rule is effective on June 25, 2024. Compliance date: Persons subject to this regulation must comply with the applicable requirements of this final rule by December 23, 2024, except for the applicable requirements of 45 CFR 164.520 in this final rule. Persons subject to this regulation must comply with the applicable requirements of 45 CFR 164.520 in this final rule by February 16, 2026. FOR FURTHER INFORMATION CONTACT: Marissa Gordon-Nguyen at (202) 240-3110 or (800) 537-7697 (TDD), or by email at OCRPrivacy@hhs.gov . SUPPLEMENTARY INFORMATION: Table of Contents I. Executive Summary A. Overview B. Effective and Compliance Dates 1. 2023 Privacy Rule NPRM 2. Overview of Comments 3. Final Rule 4. Response to Public Comments II. Statutory and Regulatory Background A. Statutory Authority and History 1. Health Insurance Portability and Accountability Act of 1996 (HIPAA) 2. Health Information Technology for Economic and Clinical Health (HITECH) Act B. Regulatory History 1. 2000 Privacy Rule 2. 2002 Privacy Rule 3. 2013 Omnibus Rule 4. 2024 Privacy Rule III. Justification for This Rulemaking A. HIPAA Encourages Trust and Confidence by Carefully Balancing Individuals' Privacy Interests With Others' Interests in Using or Disclosing PHI 1. Privacy Protections Ensure That Individuals Have Access to, and Are Comfortable Accessing, High-Quality Health Care 2. The Department's Approach to the Privacy Rule Has Long Sought To Balance the Interests of Individuals and Society B. Developments in the Legal Environment Are Eroding Individuals' Trust in the Health Care System C. To Protect the Trust Between Individuals and Health Care Providers, the Department Is Restricting Certain Uses and Disclosures of PHI for Particular Non-Health Care Purposes IV. General Discussion of Public Comments A. General Comments in Support of the Proposed Rule B. General Comments in Opposition to the Proposed Rule C. Other General Comments on the Proposed Rule V. Summary of Final Rule Provisions and Public Comments and Responses A. Section 160.103 Definitions 1. Clarifying the Definition of “Person” 2. Interpreting Terms Used in Section 1178(b) of the Social Security Act 3. Adding a Definition of “Reproductive Health Care” 4. Whether the Department Should Define Any Additional Terms B. Section 164.502—Uses and Disclosures of Protected Health Information: General Rules 1. Clarifying When PHI May Be Used or Disclosed by Regulated Entities 2. Adding a New Category of Prohibited Uses and Disclosures 3. Clarifying Personal Representative Status in the Context of Reproductive Health Care 4. Request for Comments C. Section 164.509—Uses and Disclosures for Which an Attestation is Required 1. Current Provision 2. Proposed Rule 3. Overview of Public Comments 4. Final Rule 5. Responses to Public Comments D. Section 164.512—Uses and Disclosures for Which an Authorization or Opportunity To Agree or Object Is Not Required 1. Applying the Prohibition and Attestation Condition to Certain Permitted Uses and Disclosures 2. Making a Technical Correction to the Heading of 45 CFR 164.512(c) and Clarifying That Providing or Facilitating Reproductive Health Care Is Not Abuse, Neglect, or Domestic Violence 3. Clarifying the Permission for Disclosures Based on Administrative Processes 4. Request for Information on Current Processes for Receiving and Addressing Requests Pursuant to 164.512(d) Through (g)(1) E. Section 164.520—Notice of Privacy Practices for Protected Health Information 1. Current Provision 2. CARES Act 3. Proposals in 2022 Part 2 NPRM and 2023 Privacy Rule NPRM 4. Overview of Public Comments 5. Final Rule 6. Responses to Public Comments F. Section 164.535—Severability G. Comments on Other Provisions of the HIPAA Rules VI. Regulatory Impact Analysis A. Executive Order 12866 and Related Executive Orders on Regulatory Review 1. Summary of Costs and Benefits 2. Baseline Conditions 3. Costs of the Rule B. Regulatory Alternatives to the Final Rule C. Regulatory Flexibility Act—Small Entity Analysis D. Executive Order 13132—Federalism E. Assessment of Federal Regulation and Policies on Families F. Paperwork Reduction Act of 1995 Explanation of Estimated Annualized Burden Hours Table of Acronyms Term Meaning AMA American Medical Association. API Application Programming Interface. CARES Act Coronavirus Aid, Relief, and Economic Security Act. CDC Centers for Disease Control and Prevention. CLIA Clinical Laboratory Improvement Amendments of 1988. CMS Centers for Medicare & Medicaid Services. DOD Department of Defense. Department or HHS Department of Health and Human Services. EHR Electronic Health Record. E.O. Executive Order. FDA Food and Drug Administration. FHIR® Fast Healthcare Interoperability Resources®. FTC Federal Trade Commission. GINA Genetic Information Nondiscrimination Act of 2008. Health IT Health Information Technology. HIE Health Information Exchange. HIPAA Health Insurance Portability and Accountability Act of 1996. HITECH Act Health Information Technology for Economic and Clinical Health Act of 2009. ICR Information Collection Request. IIHI Individually Identifiable Health Information. NCVHS National Committee on Vital and Health Statistics. NICS National Instant Criminal Background Check System. NPP Notice of Privacy Practices. NPRM Notice of Proposed Rulemaking. OCR Office for Civil Rights. OHCA Organized Health Care Arrangement. OMB Office of Management and Budget. ONC Office of the National Coordinator for Health Information Technology. PHI Protected Health Information. PRA Paperwork Reduction Act of 1995. RFA Regulatory Flexibility Act. RIA Regulatory Impact Analysis. SBA Small Business Administration. SSA Social Security Act of 1935. TPO Treatment, Payment, or Health Care Operations. UMRA Unfunded Mandates Reform Act of 1995. I. Executive Summary A. Overview In this final rule, the Department of Health and Human Services (HHS or “Department”) modifies certain provisions of the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”), issued pursuant to section 264 of the Administrative Simplification provisions of title II, subtitle F, of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). 1 The Privacy Rule 2 is one of several rules, collectively known as the HIPAA Rules, 3 that protect the privacy and security of individuals' protected health information 4 (PHI), which is individually identifiable health information 5 (IIHI) transmitted by or maintained in electronic media or any other form or medium, with certain exceptions. 6 1 Subtitle F of title II of HIPAA (Pub. L. 104-191, 110 Stat. 1936 (Aug. 21, 1996)) added a new part C to title XI of the Social Security Act of 1935 (SSA), Public Law 74-271, 49 Stat. 620 (Aug. 14, 1935), ( see sections 1171-1179 of the SSA (codified at 42 U.S.C. 1320d-1320d-8)), as well as promulgating section 264 of HIPAA (codified at 42 U.S.C. 1320d-2 note), which authorizes the Secretary to promulgate regulations with respect to the privacy of individually identifiable health information. The Privacy Rule has subsequently been amended pursuant to the Genetic Information Nondiscrimination Act of 2008 (GINA), title I, section 105, Public Law 110-233, 122 Stat. 881 (May 21, 2008) (codified at 42 U.S.C. 2000ff), and the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, Public Law 111-5, 123 Stat. 226 (Feb. 17, 2009) (codified at 42 U.S.C. 1390w-4(O)(2)). 2 45 CFR parts 160 and 164, subparts A and E. For a history of the Privacy Rule, see infra Section II.B., “Regulatory History.” 3 See also the HIPAA Security Rule, 45 CFR parts 160 and 164, subparts A and C; the HIPAA Breach Notification Rule, 45 CFR part 164, subpart D; and the HIPAA Enforcement Rule, 45 CFR part 160, subparts C, D, and E. 4 45 CFR 160.103 (definition of “Protected health information”). 5 42 U.S.C. 1320d. See also 45 CFR 160.103 (definition of “Individually identifiable health information”). 6 At times throughout this final rule, the Department uses the terms “health information” or “individuals' health information” to refer generically to health information pertaining to an individual or individuals. In contrast, the Department's use of the term “IIHI” refers to a category of health information defined in HIPAA, and “PHI” is used to refer specifically to a category of IIHI that is defined by and subject to the privacy and security standards promulgated in the HIPAA Rules. The Privacy Rule requires the disclosure of PHI only in the following circumstances: when required by the Secretary to investigate a regulated entity's compliance with the Privacy Rule and to the individual pursuant to the individual's right of access and the individual's right to an accounting of disclosures. 7 Any other uses or disclosures described in the Privacy Rule are either permitted or prohibited, as specified in the Privacy Rule. For example, the Privacy Rule permits, but does not require, a regulated entity to disclose PHI to conduct quality improvement activities when applicable conditions are met, and it prohibits a regulated entity from selling PHI except pursuant to and in compliance with 45 CFR 164.508(a)(4). 8 7 See 45 CFR 164.502(2) and (4). 8 See 45 CFR 164.512(i) and 164.502(a)(5)(ii). In accordance with its statutory mandate, the Department promulgated the Privacy Rule and continues to administer and enforce it to ensure that individuals are not afraid to seek health care from, or share important information with, their health care providers because of a concern that their sensitive information will be disclosed outside of their relationship with their health care provider. Protecting privacy promotes trust between health care providers and individuals, advancing access to and improving the quality of health care. To achieve this goal, the Department generally has applied the same privacy standards to nearly all PHI, regardless of the type of health care at issue. Notably, special protections were given to psychotherapy notes, owing in part to the particularly sensitive information those notes contain. 9 9 See 45 CFR 164.501 and 164.508(a)(2). Under its statutory authority to administer and enforce the HIPAA Rules, the Department may modify the HIPAA Rules as needed. 10 The Supreme Court decision in Dobbs v. Jackson Women's Health Organization 11 ( Dobbs ) overturned precedent that protected a constitutional right to abortion and altered the legal and health care landscape. This decision has far-reaching implications for reproductive health care beyond its effects on access to abortion. 12 This changing legal landscape increases the likelihood that an individual's PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect, including the trust of individuals in health care providers and the health care system. 13 The threat that PHI will be disclosed and used to conduct such an investigation against, or to impose liability upon, an individual or another person is likely to chill an individual's willingness to seek lawful health care treatment or to provide full information to their health care providers when obtaining that treatment, and on the willingness of health care providers to provide such care. 14 These developments in the legal environment increase the potential that use and disclosure of PHI about an individual's reproductive health will undermine access to and the quality of health care generally. 10 Section 1174(b)(1) of Public Law 104-191 (codified at 42 U.S.C. 1320d-3). 11 597 U.S. 215 (2022). 12 See Melissa Suran, “Treating Cancer in Pregnant Patients After Roe v Wade Overturned,” JAMA (Sept. 29, 2022), https://jamanetwork-com.hhsnih.idm.oclc.org/journals/jama/fullarticle/2797062?resultClick=1 and Rita Rubin, “How Abortion Bans Could Affect Care for Miscarriage and Infertility,” JAMA (June 28, 2022), https://jamanetwork-com.hhsnih.idm.oclc.org/journals/jama/fullarticle/2793921?resultClick=1. 13 See infra National Committee on Vital and Health Statistics (NCVHS) discussion, Section II.A.1., expressing concern for harm caused by disclosing identifiable health information for non-health care purposes. 14 See Whitney S. Rice et al. “ `Post- Roe ' Abortion Policy Context Heightens Imperative for Multilevel, Comprehensive, Integrated Health Education,” (Sept. 29, 2022), https://journals.sagepub.com/doi/full/10.1177/10901981221125399 (“New ethical and legal complexities around patient counseling are emerging, particularly in states limiting or eliminating abortion access, due to more extreme abortion restrictions. Clinicians in such contexts may be forced to adhere to legal requirements of states which run counter to well-being and desires of patients, violating the medical principles of beneficence and respect for patient autonomy”). In order to continue to protect privacy in a manner that promotes trust between individuals and health care providers and advances access to, and improves the quality of, health care, we have determined that the Privacy Rule must be modified to limit the circumstances in which provisions of the Privacy Rule permit the use or disclosure of an individual's PHI about reproductive health care for certain non-health care purposes, where such use or disclosure could be detrimental to privacy of the individual or another person or the individual's trust in their health care providers. This determination was informed by our expertise in administering the Privacy Rule, questions we have received from members of the public and Congress, comments we received on the 2023 HIPAA Privacy Rule to Support Reproductive Health Care Privacy notice of proposed rulemaking (NPRM) (“2023 Privacy Rule NPRM”), 15 and our analysis of the state of privacy for IIHI. 15 88 FR 23506 (Apr. 17, 2023). This final rule (“2024 Privacy Rule”) amends provisions of the Privacy Rule to strengthen privacy protections for highly sensitive PHI about the reproductive health care of an individual, and directly advances the purposes of HIPAA by setting minimum protections for PHI and providing peace of mind that is essential to individuals' ability to obtain lawful reproductive health care. This final rule balances the interests of society in obtaining PHI for non-health care purposes with the interests of the individual, the Federal Government, and society in protecting individual privacy, thereby improving the effectiveness of the health care system by ensuring that persons are not deterred from seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which such health care is provided. The Department carefully analyzed state prohibitions and restrictions on an individual's ability to obtain high-quality health care and their effects on health information privacy and the relationships between individuals and their health care providers after Dobbs; assessed trends in state legislative activity with respect to the privacy of PHI; and conducted a thorough review of the text, history, and purposes of HIPAA and the Privacy Rule. The Department also engaged in extensive discussions with HHS agencies and other Federal departments, including the Department of Justice; consulted with the National Committee on Vital and Health Statistics (NCVHS) and the Attorney General as required by section 264(d) of HIPAA, and with Indian Tribes as required by Executive Order 13175; 16 held listening sessions with and reviewed correspondence from stakeholders, including covered entities, states, individuals, and patient advocates; and reviewed correspondence to HHS from Members of Congress. 17 The modifications made to the Privacy Rule by this final rule are the result of this work. 16 See 65 FR 67249 (Nov. 11, 2000). See also Presidential Memorandum on Tribal Consultation and Strengthening Nation-to-Nation Relationships (Jan. 26, 2021), https://www.whitehouse.gov/briefing-room/presidential-actions/2021/01/26/memorandum-on-tribal-consultation-and-strengthening-nation-to-nation-relationships/ and Dep't of Health and Human Servs., Tribal Consultation Policy, https://www.hhs.gov/sites/default/files/iea/tribal/tribalconsultation/hhs-consultation-policy.pdf. See also 88 FR 23506 (Apr. 17, 2023) (notice of Tribal consultation). The Department consulted with representatives of Tribal Nations on May 17, 2023. During the consultation, the representatives raised issues of health inequities and privacy of health information, specifically among American Indians and Alaskan Natives after Dobbs. 17 Letter from U.S. Senator Tammy Baldwin et al. to HHS Sec'y Xavier Becerra (Mar. 7, 2023) (addressing HIPAA privacy regulations and Dobbs v. Jackson Women's Health Organization ). Letter from U.S. Senator Patty Murray et al. to HHS Sec'y Xavier Becerra (Sept. 13, 2022) (addressing HIPAA privacy regulations and Dobbs v. Jackson Women's Health Organization ). Letter from U.S. Representative Earl Blumenauer et al. to HHS Sec'y Xavier Becerra (Aug. 30, 2022) (addressing HIPAA privacy regulations and Dobbs v. Jackson Women's Health Organization ). Letter from U.S. Senator Michael F. Bennet et al. to HHS Sec'y Xavier Becerra (July 1, 2022) (addressing HIPAA privacy regulations and Dobbs v. Jackson Women's Health Organization ). B. Effective and Compliance Dates 1. 2023 Privacy Rule NPRM In the 2023 Privacy Rule NPRM, the Department proposed an effective date for a final rule that would occur 60 days after publication, and a compliance date that would occur 180 days after the effective date. 18 Taken together, the two dates would give entities 240 days after publication to implement compliance measures. In the preamble to the proposed rule, the Department stated that it did not believe that the proposed rule would pose unique implementation challenges that would justify an extended compliance period ( i.e., a period longer than the standard 180 days provided in 45 CFR 160.105). 19 The Department also asserted that adherence to the standard compliance period is necessary to timely address the circumstances described in the 2023 Privacy Rule NPRM. 18 See 88 FR 23506, 23510 (Apr. 17, 2023). 19 See id. 2. Overview of Comments A commenter urged the Department to move quickly to issue the final rule and to provide a 180-day compliance period as proposed. Some commenters requested that the Department provide additional time for regulated entities to comply with the proposed modifications to the Privacy Rule. Several commenters requested that the Department coordinate compliance deadlines across its rulemakings, while a few commenters specifically encouraged the Department to provide additional time for compliance with the modifications to the Notice of Privacy Practices (NPP) requirements proposed in the 2023 Privacy Rule NPRM. 3. Final Rule This final rule is effective on June 25, 2024. Covered entities and business associates of all sizes will have 180 days beyond the effective date of the final rule to comply with the final rule's provisions, with the exception of the NPP provisions, which we address separately below. We understand that some covered entities and business associates remain concerned that a 180-day period may not provide sufficient time to come into compliance with the modified requirements. However, we believe that providing a 180-day compliance period best comports with section 1175(b)(2) of the Social Security Act of 1935 (SSA), 42 U.S.C. 1320d-4, and our implementing provision at 45 CFR 160.104(c)(1), which require the Secretary to provide at least a 180-day period for covered entities to comply with modifications to standards and implementation specifications in the HIPAA Rules, and also that providing a 180-day compliance period best protects the privacy and security of individuals' PHI in a timely manner that reflects the urgency of addressing the changes in the legal landscape and their effects on individuals, regulated entities, and other persons, while balancing the burden imposed upon regulated entities of implementing this final rule. Section 160.104(a) permits the Department to adopt a modification to a standard or implementation specification adopted under the Privacy Rule no more frequently than once every 12 months. 20 As discussed above, we are required to provide a minimum of a 180-day compliance period when adopting a modification, but we are permitted to provide a longer compliance period based on the extent of the modification and the time needed to comply with the modification in determining the compliance date for the modification. 21 The Department makes every effort to consider the burden and cost of implementation for regulated entities when determining an appropriate compliance date. 20 45 CFR 160.104(a). 21 45 CFR 160.104(c)(2). While we recognize that regulated entities will need to revise and implement changes to their policies and procedures in response to the modifications in this final rule, we do not believe that these changes are so significant as to require more than a 180-day compliance period. This final rule narrowly tailors the application of its changes to certain limited circumstances involving lawful reproductive health care and clarifies that regulated entities are not expected to know or be aware of laws other than those with which they are required to comply. While it adds a condition to certain requests for uses and disclosures, the affected requests already require careful review by regulated entities for compliance with previously imposed conditions. Thus, we do not believe it will be difficult for regulated entities to adjust their policies and procedures to accommodate this new requirement. The other modifications finalized in this rule are in service of implementing the two changes above and impose minimal burden on regulated entities. Additionally, the Department believes, based on its evaluation of the evolving privacy landscape, that the changes made by this final rule are of particular urgency. Accordingly, we believe that a 180-day compliance period, combined with a 60-day effective date, is sufficient for regulated entities to make the changes required by most of the modifications in this final rule, with the exception of the NPP provisions. We separately consider the question of the compliance date for the modifications to the NPP provisions. In the 2022 Confidentiality of Substance Use Disorder (SUD) Patient Records NPRM (“2022 Part 2 NPRM”), 22 the Department proposed, among other things, to revise 45 CFR 164.520 as required by section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. 23 The Department proposed to provide the same compliance date for both the proposed modifications to 45 CFR 164.520 and the more extensive modifications to 42 CFR part 2 (“Part 2”). 24 The 2024 Confidentiality of Substance Use Disorder (SUD) Patient Records Final Rule (“2024 Part 2 Rule”) explicitly noted that the Department was not finalizing the proposed modifications to the NPP provisions at that time, but that we planned to do so in a future HIPAA final rule. 25 The Department also acknowledged that some covered entities might have NPPs that would not reflect updated changes to policies and procedures addressing how Part 2 records are used and disclosed. Rather than requiring covered entities to revise their NPPs twice in a short period of time, the Department announced in the 2024 Part 2 Rule that it would exercise enforcement discretion related to the requirement that covered entities update their NPPs whenever material changes are made to privacy practices until the compliance date established by a future HIPAA final rule. 26 The Department is finalizing the modifications to the NPP required by section 3221 of the CARES Act in this rule and aligning the effective and compliance dates for all of the modified NPP requirements with those of the 2024 Part 2 Rule. 22 87 FR 74216 (Dec. 2, 2022). 23 Public Law 116-136, 134 Stat. 281 (Mar. 27, 2020). 24 89 FR 12472 (Feb. 16, 2024). 25 Id. at 12482, 12528, and 12530. 26 Id. at 12482, 12528, and 12530. The compliance date of the 2024 Part 2 Rule is February 16, 2026, substantially later than the compliance date for most of this final rule, because of the significant changes required for compliance with the 2024 Part 2 Rule. Accordingly, in compliance with 45 CFR 160.104 and consistent with the NPP proposals included in the 2022 Part 2 NPRM and public comment, we are aligning the compliance date for the NPP changes required by this final rule with the compliance date for the 2024 Part 2 Rule so that covered entities regulated under both rules can implement all changes to their NPPs at the same time. Covered entities are expected to be in compliance with the modifications to 45 CFR 164.520 on February 16, 2026. 4. Response to Public Comments Comment: One commenter expressed support for the proposal in the 2023 Privacy Rule NPRM to establish a 180-day compliance date and urged the Department to issue a final rule quickly. Some commenters sought an extension of the compliance date for twelve to eighteen months, explaining that extensive policy and legal work, process and software changes, documentation and training would be required to implement the 2023 Privacy Rule NPRM. One commenter suggested phasing in the attestation requirement so that “downstream” regulated entities, such as business associates and managed care organizations, would have a later compliance date than health care providers. Response: We appreciate the commenters' suggestions, but as discussed above, based on our assessment, we do not believe the modifications required by this final rule will require longer to implement. Comment: Some commenters requested that the Department coordinate compliance deadlines of final rules that revise the Privacy Rule or publish one final rule addressing the proposals in the NPRMs to enable regulated entities to leverage the resources required to implement the changes to achieve compliance with all of the new requirements at one time. One commenter explained that each NPRM would involve operational changes requiring significant resources and effort and expressed their belief that a single comprehensive final rule would allow regulated entities to make all of the required changes, including revisions to policies and procedures, development of new or revised workflows, electronic health record (EHR) updates, and technology enhancements. Response: We appreciate the commenters' suggestion, but we do not believe that it is necessary to fully align the compliance dates for the 2024 Part 2 Rule and the 2024 Privacy Rule. By imposing separate compliance deadlines, we are able to act more quickly to protect the privacy of PHI. However, consistent with 45 CFR 160.104 and as requested by public comment, we are applying the same compliance date for covered entities to revise their NPPs to address modifications made to 45 CFR 164.520 in response to and consistent with the CARES Act and to support reproductive health care privacy. The compliance date for the NPP provisions is February 16, 2026. 27 Part 2 programs, including those that are covered entities, can choose to implement the changes to their NPPs that are required by the 2024 Part 2 Rule prior to the compliance date, but there is no requirement that they do so. 27 89 FR 12472 (Feb. 16, 2024). II. Statutory and Regulatory Background A. Statutory Authority and History 1. Health Insurance Portability and Accountability Act of 1996 (HIPAA) In 1996, Congress enacted HIPAA 28 to reform the health care delivery system to “improve portability and continuity of health insurance coverage in the group and individual markets.” 29 To enable health care delivery system reform, Congress included in HIPAA requirements for standards to support the electronic exchange of health information. According to section 261, “[i]t is the purpose of this subtitle to improve [. . .] the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information [. . .].” 30 Congress applied the Administrative Simplification provisions directly to three types of entities known as “covered entities”—health plans, health care clearinghouses, and health care providers who transmit information electronically in connection with a transaction for which HHS has adopted a standard. 31 28 Public Law 104-191, 110 Stat. 1936 (Aug. 21, 1996). 29 See H.R. Rep. No. 104-496, at 66-67 (1996). 30 42 U.S.C. 1320d note (Statutory Notes and Related Subsidiaries: Purpose). Subtitle F also amended related provisions of the SSA. 31 See section 262 of Public Law 104-191, adding section 1172 to the SSA (codified at 42 U.S.C. 1320d-1). See also section 13404 of the American Recovery and Reinvestment Act of 2009, Public Law 111-5, 123 Stat. 115 (Feb. 17, 2009) (codified at 42 U.S.C. 17934) (applying privacy provisions and penalties to business associates of covered entities). Section 262(a) of HIPAA required the Secretary to adopt uniform standards “to enable health information to be exchanged electronically.” 32 Congress directed the Secretary to adopt standards for unique identifiers to identify individuals, employers, health plans, and health care providers across the nation 33 and standards for, among other things, transactions and data elements relating to health information, 34 the security of that information, 35 and verification of electronic signatures. 36 32 42 U.S.C. 1320d2(a)(1). 33 42 U.S.C. 1320d-2(b)(1). 34 42 U.S.C. 1320d-2(a), (c), and (f). 35 42 U.S.C. 1320d-2(d). 36 42 U.S.C. 1320d-2(e). Congress recognized that the standardization of certain electronic health care transactions required by HIPAA posed risks to the privacy of confidential health information and viewed individual privacy, confidentiality, and data security as critical for orderly administrative simplification. 37 Thus, as explained in the preamble to the 2023 Privacy Rule NPRM, 38 Congress provided the Department with the authority to regulate the privacy of IIHI. According to one Member of Congress, privacy standards would create an additional layer of protection beyond the oath pledged by health care providers to keep information secure and, as described by another Member, would further protect information from being used in a “malicious or discriminatory manner.” 39 Congress intended for the law to enhance individuals' trust in health care providers, which required that the law provide additional protection for the confidentiality of IIHI. As described by a Member of Congress: “The bill would also establish strict security standards for health information because Americans clearly want to make sure that their health care records can only be used by the medical professionals that treat them. Often, we assume that because doctors take an oath of confidentiality that in fact all who touch their records operate by the same standards. Clearly, they do not.” 40 Moreover, Congress considered that health care reform required an approach that would not compromise privacy as health information became more accessible. 41 37 On a resolution waiving points of order against the Conference Report to H.R. 3103, members debated an “erosion of privacy” balanced against the administrative simplification provisions. Thus, from HIPAA's inception, privacy has been a central concern to be addressed as legislative changes eased disclosures of PHI. See 142 Cong. Rec. H9777 and H9780; see also H.R. Rep. No. 104-736, at 177 and 264 (1996); 142 Cong. Rec. H9780 (daily ed. Aug. 1, 1996) (statement of Rep. Sawyer); 142 Cong. Rec. H9792 (daily ed. Aug. 1, 1996) (statement of Rep. McDermott); and 142 Cong. Rec. S9515-16 (daily ed. Aug. 2, 1996) (statement of Sen. Simon). 38 88 FR 23506, 23511 (Apr. 17, 2023). 39 See statement of Rep. Sawyer, supra note 37. See also statement of Sen. Simon, supra note 37. 40 Statement of Rep. Sawyer, supra note 37. 41 See H.R. Rep. No. 104-496 Part 1, at 99-100 (Mar. 25, 1996). Accordingly, section 264(a) directed the Secretary to submit to Congress detailed recommendations for Federal “standards with respect to the privacy of [IIHI]” nationwide within one year of HIPAA's enactment. 42 The statute made clear that the Secretary had the authority to promulgate regulations if Congress did not enact legislation covering these matters within three years. 43 Congress directed the Secretary to ensure that the regulations promulgated “address at least” the following three subjects: (1) the rights that an individual who is a subject of IIHI should have; (2) the procedures that should be established for the exercise of such rights; and (3) the uses and disclosures of such information that should be authorized or required. 44 42 42 U.S.C. 1320d-2 note. 43 Id. 44 Id. Additionally, Congress provided a clear statement that HIPAA's provisions would “supersede any contrary provision of State law,” with certain limited exceptions. 45 One exception to this general preemption authority is for “state privacy laws that are contrary to and more stringent than the corresponding federal standard, requirement, or implementation specification.” 46 Thus, Congress intended for the Department to create privacy standards to safeguard health information while respecting the ability of states to provide individuals with additional health information privacy. 45 42 U.S.C. 1320d-7. 46 65 FR 82580 (the exception applies under section 1178(a)(2)(B) of the SSA and section 264(c)(2) of HIPAA). Congress required the Secretary to consult with the NCVHS, 47 thereby ensuring that the Secretary's decisions reflected public and expert involvement and advice in carrying out the requirements of section 264. 48 NCVHS sent its initial recommendations to the Secretary in a letter to the Secretary on June 27, 1997. Importantly, NCVHS advised that “strong substantive and procedural protections” should be imposed if health information were to be disclosed to law enforcement, and, where identifiable health information would be made available for non-health purposes, individuals should be afforded assurances that their data would not be used against them. 49 Additionally, NCVHS “unanimously” recommended that “[. . .] the Secretary and the Administration assign the highest priority to the development of a strong position on health privacy that provides the highest possible level of protection for the privacy rights of patients.” 50 NCVHS further noted that failure to do so would “undermine public confidence in the health care system, expose patients to continuing invasions of privacy, subject record keepers to potentially significant legal liability, and interfere with the ability of health care providers and others to operate the health care delivery and payment system in an effective and efficient manner,” which would undermine what Congress intended. 51 47 NCVHS serves as the Secretary's statutory public advisory body for health data, statistics, privacy, and national health information policy and HIPAA. NCVHS also advises the Secretary, “reports regularly to Congress on HIPAA implementation, and serves as a forum for interaction between HHS and interested private sector groups on a range of health data issues.” Nat'l Comm. On Vital and Health Statistics, “About NCVHS,” https://ncvhs.hhs.gov/; see also “NCVHS 60th Anniversary Symposium and History,” U.S. Dep't of Health and Human Servs., at 28-29 (Feb. 2011), https://ncvhs.hhs.gov/wp-content/uploads/2014/05/60_years_of_difference.pdf . 48 See section 264(a) and (d) of Public Law 104-191 (codified at 42 U.S.C. 1320d-2 note). 49 Letter from NCVHS Chair Don E. Detmer to HHS Sec'y Donna E. Shalala (June 27, 1997) (forwarding NCVHS recommendations), https://ncvhs.hhs.gov/rrp/june-27-1997-letter-to-the-secretary-with-recommendations-on-health-privacy-and-confidentiality/. 50 Id. at Principal Findings and Recommendations. 51 Id. NCVHS further recommended that “any rules regulating disclosures of identifiable health information be as clear and as narrow as possible. Each group of users must be required to justify their need for health information and must accept reasonable substantive and procedural limitations on access.” 52 According to NCVHS, this would allow for the disclosures that society deemed necessary and appropriate while providing individuals with clear expectations regarding their health information privacy. 52 Id. at Third-Party Disclosures. As we noted in the 2023 Privacy Rule NPRM, 53 Congress contemplated that the Department's rulemaking authorities under HIPAA would not be static. Congress specifically built in a mechanism to adapt such regulations as technology and health care evolve, directing that the Secretary review and modify the Administrative Simplification standards as determined appropriate, but not more frequently than once every 12 months. 54 That statutory directive complements the Secretary's general rulemaking authority to “make and publish such rules and regulations, not inconsistent with this chapter, as may be necessary to the efficient administration of the functions with which each is charged under this chapter.” 55 53 88 FR 23506, 23513 (Apr. 17, 2023). 54 See section 1174(b)(1) of Public Law 104-191 (codified at 42 U.S.C. 1320d-3). 55 Section 1102 of the SSA (codified at 42 U.S.C. 1302). 2. Health Information Technology for Economic and Clinical Health (HITECH) Act On February 17, 2009, Congress enacted the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act) 56 to promote the widespread adoption and standardization of health information technology (health IT). The HITECH Act included additional HIPAA privacy and security requirements for covered entities and business associates and expanded certain rights of individuals with respect to their PHI. 56 Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009, Public Law 111-5, 123 Stat. 115 (Feb. 17, 2009) (codified at 42 U.S.C. 201 note). Congress understood the importance of a relationship between a connected health IT landscape, “a necessary and vital component of health care reform,” 57 and privacy and security standards when it enacted the HITECH Act. The Purpose statement of an accompanying House of Representatives report 58 on the Energy and Commerce Recovery and Reinvestment Act 59 recognizes that “[i]n addition to costs, concerns about the security and privacy of health information have also been regarded as an obstacle to the adoption of [health IT].” The Senate Report for S. 336 60 similarly acknowledges that “[i]nformation technology systems linked securely and with strong privacy protections can improve the quality and efficiency of health care while producing significant cost savings.” 61 As the Department explained in the 2013 regulation referred to as the “Omnibus Rule” 62 and discussed in greater detail below, the HITECH Act's additional HIPAA privacy and security requirements 63 supported Congress' goal of promoting widespread adoption and interoperability of health IT by “strengthen[ing] the privacy and security protections for health information established by HIPAA.” 64 57 C. Stephen Redhead, Cong. Rsch. Serv., R40161, “The Health Information Technology for Economic and Clinical Health (HITECH) Act,” (2009), https://crsreports.congress.gov/product/pdf/R/R40161/9 (“[Health IT], which generally refers to the use of computer applications in medical practice, is widely viewed as a necessary and vital component of health care reform.”). 58 H.R. Rep. No. 111-7, at 74 (2009), accompanying H.R. 629, 111th Cong. 59 H.R. 629, Energy and Commerce Recovery and Reinvestment Act of 2009, introduced in the House on January 22, 2009, contained nearly identical provisions to subtitle D of the HITECH Act. 60 Congress enacted the American Recovery and Reinvestment Act of 2009, which included the HITECH Act, on February 17, 2009. While it was the House version of the bill, H.R. 1, that was enacted, the Senate version, S. 336, contained nearly identical provisions to subtitle D of the HITECH Act. 61 S. Rep. No. 111-3 accompanying S. 336, 111th Cong., at 59 (2009). 62 78 FR 5566 (Jan. 25, 2013). 63 Subtitle D of title XIII of the HITECH Act (codified at 42 U.S.C. 17921, 42 U.S.C. 17931-17941, and 42 U.S.C. 17951-17953). 64 78 FR 5566, 5568 (Jan. 25, 2013). In passing the HITECH Act, Congress instructed the Department that any new health IT standards adopted under section 3004 of the Public Health Service Act (PHSA) must take into account the privacy and security requirements of the HIPAA Rules. 65 Congress also affirmed that the existing HIPAA Rules were to remain in effect to the extent that they are consistent with the HITECH Act and directed the Secretary to revise the HIPAA Rules as necessary for consistency with the HITECH Act. 66 Congress confirmed that the new law was not intended to have any effect on authorities already granted under HIPAA to the Department, including section 264 of that statute and the regulations issued under that provision. 67 Congress thus affirmed the Secretary's ongoing rulemaking authority to modify the Privacy Rule's standards and implementation specifications as often as every 12 months when appropriate, including to strengthen privacy and security protections for IIHI. 65 Section 3009(a)(1)(B) of the PHSA, as added by section 13101 of the HITECH Act (codified at 42 U.S.C. 300jj-19(a)(1)). 66 Section 13421(b) of the HITECH Act (codified at 42 U.S.C. 17951). 67 Section 3009(a)(1)(A) of the PHSA, as added by section 13101 of the HITECH Act (codified at 42 U.S.C. 300jj-19(a)(1)). B. Regulatory History The Secretary has delegated the authority to administer the HIPAA Rules and to make decisions regarding their implementation, interpretation, and enforcement to the HHS Office for Civil Rights (OCR). 68 Since the enactment of the HITECH Act, the Department has exercised its authority to modify the Privacy Rule several times—in 2013, 2014, and 2016. 69 68 See U.S. Dep't of Health and Hum. Servs., Off. of the Sec'y, Off. for Civil Rights; Statement of Delegation of Authority, 65 FR 82381 (Dec. 28, 2000); U.S. Dep't of Health and Hum. Servs., Off. of the Sec'y, Off. for Civil Rights; Delegation of Authority, 74 FR 38630 (Aug. 4, 2009); U.S. Dep't of Health and Hum. Servs., Off. of the Sec'y, Statement of Organization, Functions and Delegations of Authority, 81 FR 95622 (Dec. 28, 2016). 69 See 78 FR 5566 (Jan. 25, 2013); 79 FR 7290 (Feb. 6, 2014); 81 FR 382 (Jan. 6, 2016). 1. 2000 Privacy Rule As directed by HIPAA, the Department provided a series of recommendations to Congress for a potential new law that would address the confidentiality of IIHI. 70 Congress did not act within its three-year self-imposed deadline. Accordingly, the Department published a proposed rule on November 3, 1999, 71 and issued the first final rule establishing “Standards for Privacy of Individually Identifiable Health Information” (“2000 Privacy Rule”) on December 28, 2000. 72 70 See U.S. Dep't of Health and Hum. Servs., Off. of the Assistant Sec'y for Plan. and Evaluation, “Recommendations of the Secretary of Health and Human Services, pursuant to section 264 of the Health Insurance Portability and Accountability Act of 1996,” Section I.A. (Sept. 1997), https://aspe.hhs.gov/reports/confidentiality-individually-identifiable-health-information. 71 64 FR 59918 (Nov. 3, 1999). 72 65 FR 82462 (Dec. 28, 2000). The primary goal of the Privacy Rule was to provide greater protection to individuals' privacy to engender a trusting relationship between individuals and health care providers. As announced, the final rule set standards to protect the privacy of IIHI to “begin to address growing public concerns that advances in electronic technology and evolution in the health care industry are resulting, or may result, in a substantial erosion of the privacy surrounding” health information. 73 On the eve of that rule's issuance, the President issued an Executive Order recognizing the importance of protecting individual privacy, explaining that “[p]rotecting the privacy of patients' protected health information promotes trust in the health care system. It improves the quality of health care by fostering an environment in which patients can feel more comfortable in providing health care professionals with accurate and detailed information about their personal health.” 74 73 Id. 74 See Executive Order 13181 (Dec. 20, 2000), 65 FR 81321. Since its promulgation, the Privacy Rule has protected PHI by limiting the circumstances under which covered entities and their business associates (collectively, “regulated entities”) are permitted or required to use or disclose PHI and by requiring covered entities to have safeguards in place to protect the privacy of PHI. In adopting these regulations, the Department acknowledged the need to balance several competing factors, including existing legal expectations, individuals' privacy expectations, and societal expectations. 75 The Department noted in the preamble that the large number of comments from individuals and groups representing individuals demonstrated the deep public concern about the need to protect the privacy of IIHI and constituted evidence of the importance of protecting privacy and the potential adverse consequences to individuals and their health if such protections are not extended. 76 Through its policy choices in the 2000 Privacy Rule, the Department struck a balance between competing interests—the necessity of protecting privacy and the public interest in using identifiable health information for vital public and private purposes—in a way that was also workable for the varied stakeholders. 77 75 See 65 FR 82462, 82471 (Dec. 28, 2000). 76 See id. at 82472. 77 See id. In the 2000 Privacy Rule, the Department established “general rules” for uses and disclosures of PHI, codified at 45 CFR 164.502. 78 The 2000 Privacy Rule also specified the circumstances in which a covered entity was required to obtain an individual's consent, 79 authorization, 80 or the opportunity for the individual to agree or object. 81 Additionally, it established rules for when a covered entity is permitted to use or disclose PHI without an individual's consent, authorization, or opportunity to agree or object. 82 In particular, the Privacy Rule permits certain uses and disclosures of PHI, without the individual's authorization, for identified activities that benefit the community, such as public health activities, judicial and administrative proceedings, law enforcement purposes, and research. 83 78 65 FR 82462 (Dec. 28, 2000). 79 45 CFR 164.506 was originally titled “Consent for uses or disclosures to carry out treatment, payment, or health care operations.” 80 45 CFR 164.508. 81 45 CFR 164.510. 82 45 CFR 164.512. 83 See 64 FR 59918, 59955 (Nov. 3, 1999). The Privacy Rule also established the rights of individuals with respect to their PHI, including the right to receive adequate notice of a covered entity's privacy practices, the right to request restrictions of uses and disclosures, the right to access ( i.e., to inspect and obtain a copy of) their PHI, the right to request an amendment of their PHI, and the right to receive an accounting of disclosures. 84 84 See 45 CFR 164.520, 164.522, 164.524, 164.526, and 164.528. In the 2000 Privacy Rule, the Secretary exercised her statutory authority to adopt 45 CFR 160.104(a), which reserves the Secretary's ability to modify any standard or implementation specification adopted under the Administrative Simplification provisions. 85 The Secretary first invoked this modification authority to amend the Privacy Rule in 2002 86 and made additional modifications in 2013, 87 and 2016, 88 as described below. 85 See 65 FR 82462, 82800 (Dec. 28, 2000). 86 See 67 FR 53182 (Aug. 14, 2002). 87 78 FR 5566 (Jan. 25, 2013). 88 81 FR 382 (Jan. 6, 2016). 2. 2002 Privacy Rule After publication of the 2000 Privacy Rule, the Department received many inquiries and unsolicited comments about the Privacy Rule's effects and operation. As a result, the Department opened the 2000 Privacy Rule for further comment in February 2001, less than one month before the effective date and 25 months before the compliance date for most covered entities, and issued clarifying guidance on its implementation. 89 NCVHS' Subcommittee on Privacy, Confidentiality and Security held public hearings about the 2000 Privacy Rule. From those hearings, the Department obtained additional information about concerns related to key provisions and their potential unintended consequences for health care quality and access. 90 On March 27, 2002, the Department proposed modifications to the 2000 Privacy Rule to clarify the requirements and correct potential problems that could threaten access to, or quality of, health care. 91 89 66 FR 12738 (Feb. 28, 2001). 90 67 FR 53182, 53183 (Aug. 14, 2002). 91 67 FR 14775 (Mar. 27, 2002). In response to comments on the proposed rule, the Department finalized modifications to the Privacy Rule on August 14, 2002 (“2002 Privacy Rule”). 92 This final rule clarified HIPAA's requirements while maintaining strong protections for the privacy of IIHI. 93 These modifications addressed certain workability issues, including but not limited to clarifying distinctions between health care operations and marketing; modifying the minimum necessary standard to exclude disclosures authorized by individuals and clarify its operation; eliminating the consent requirement for uses and disclosures of PHI for treatment, payment, or health care operations (TPO), and to otherwise clarify the role of consent in the Privacy Rule; and making other modifications and conforming amendments consistent with the proposed rule. The Department also included modifications to the provisions permitting the use or disclosure of PHI for public health activities and for research activities without consent, authorization, or an opportunity to agree or object. 92 67 FR 53182 (Aug. 14, 2002). See the final rule for changes in the entirety. The 2002 Privacy Rule was issued before the compliance date for the 2000 Privacy Rule. Thus, covered entities never implemented the 2000 Privacy Rule. Instead, they implemented the 2000 Privacy Rule as modified by the 2002 Privacy Rule. 93 See 67 FR 53182 (Aug. 14, 2002). 3. 2013 Omnibus Rule Following the enactment of the HITECH Act, the Department issued an NPRM, entitled “Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health [HITECH] Act” (“2010 NPRM”), 94 which proposed to implement certain HITECH Act requirements. In 2013, the Department issued the final rule, Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health [HITECH] Act and the Genetic Information Nondiscrimination Act, and Other Modifications to the HIPAA Rules (“2013 Omnibus Rule”), 95 which implemented many of the new HITECH Act requirements, including strengthening individuals' privacy rights related to their PHI. 94 75 FR 40868 (July 14, 2010). 95 78 FR 5566 (Jan. 25, 2013). In addition to finalizing requirements of the HITECH Act that were proposed in the 2010 NPRM, the Department adopted modifications to the Enforcement Rule not previously adopted in an earlier interim final rule, 74 FR 56123 (Oct. 30, 2009), and to the Breach Notification Rule not previously adopted in an interim final rule, 74 FR 42739 (Aug. 24, 2009). The Department also finalized previously proposed Privacy Rule modifications as required by GINA, 74 FR 51698 (Oct. 7, 2009). The Department also finalized regulatory provisions that were not required by the HITECH Act, but were necessary to address the workability and effectiveness of the Privacy Rule and to increase flexibility for and decrease burden on regulated entities. 96 In the 2010 NPRM, the Department noted that it had not amended the Privacy Rule since 2002. 97 It further explained that information gleaned from contact with the public since that time, enforcement experience, and technical corrections needed to eliminate ambiguity provided the impetus for the Department's actions to make certain regulatory changes. 98 96 See 78 FR 5566 (Jan. 25, 2013) (explaining that the Department was using its general authority under HIPAA to make a number of changes to the Privacy Rule that were intended to increase workability and flexibility, decrease burden, and better harmonize the requirements with those under other Departmental regulations). The Department's general authority to modify the Privacy Rule is codified in HIPAA section 264(c), and OCR conducts rulemaking under HIPAA based on authority granted by the Secretary. 97 See 75 FR 40868, 40871 (July 14, 2010). 98 75 FR 40868, 40871 (July 14, 2010). For example, the Department modified its prior interpretation of the Privacy Rule requirement at 45 CFR 164.508(c)(1)(iv) that a description of a research purpose must be study specific. 99 The Department explained that, under its new interpretation, the research purposes need only be described adequately such that it would be reasonable for an individual to expect that their PHI could be used or disclosed for such future research. 100 In the 2013 Omnibus Rule, the Department explained that this change was based on the concerns expressed by covered entities, researchers, and other commenters on the 2010 NPRM that the former requirement did not represent current research practices. The Department provided a similar explanation for its modifications to the Privacy Rule that permit certain disclosures of student immunization records to schools without an authorization. 101 Additionally, based on a recommendation made at an NCVHS meeting, the Department requested comment on and finalized proposed revisions to the definition of PHI to exclude information regarding an individual who has been deceased for more than 50 years. 102 For the latter, the Department noted that it was balancing the privacy interests of decedents' living relatives and other affected individuals against the legitimate needs of public archivists to obtain records. 103 99 See 78 FR 5566, 5611 (Jan. 25, 2013). 100 See id. at 5612. 101 Id. at 5616-17. See also 45 CFR 164.512(b)(1). 102 78 FR 5566, 5614 (Jan. 25, 2013). See also 45 CFR 164.502(f) and the definition of “Protected health information” at 45 CFR 160.103, excluding IIHI regarding a person who has been deceased for more than 50 years. 103 In addition to the rulemakings discussed here, the Department has modified the Privacy Rule for workability purposes and in response to changes in circumstances on two other occasions, and it issued another notice of proposed rulemaking in 2021 for the same reasons. See 79 FR 7289 (Feb. 6, 2014), 81 FR 382 (Jan. 6, 2016), and 86 FR 6446 (Jan. 21, 2021). None of the changes described in the paragraph above were required by the HITECH Act. Rather, the Department determined that it was necessary to promulgate these changes pursuant to its existing general rulemaking authority under HIPAA. NCVHS and the public also recommended other changes between the publication of the 2002 Privacy Rule and the 2013 Omnibus Rule, including the creation of specific categories of PHI, such as “Sexuality and Reproductive Health Information” that would allow for special protections of such PHI. 104 The Department declined to propose specific protections for certain categories of PHI at that time because of concerns about the ability of regulated entities to segment PHI and the effects on care coordination. Many of those concerns are still present and so, the Department did not propose and determined not to establish a specific category of particularly sensitive PHI in this rulemaking. Instead, as discussed more fully below, the Department is finalizing a purpose-based prohibition against certain uses and disclosures. 104 See Letter from NCVHS Chair Simon P. Cohn to HHS Sec'y Michael O. Leavitt (June 22, 2006), https://ncvhs.hhs.gov/rrp/june-22-2006-letter-to-the-secretary-recommendations-regarding-privacy-and-confidentiality-in-the-nationwide-health-information-network/; Letter from NCVHS Chair Simon P. Cohn to HHS Sec'y Michael O. Leavitt (Feb. 20, 2008) (listing categories of health information that are commonly considered to contain sensitive information), https://ncvhs.hhs.gov/wp-content/uploads/2014/05/080220lt.pdf; Letter from NCVHS Chair Justine M. Carr to HHS Sec'y Kathleen Sebelius (Nov. 10, 2010) (forwarding NCVHS recommendations), https://ncvhs.hhs.gov/wp-content/uploads/2014/05/101110lt.pdf. 4. 2024 Privacy Rule On April 17, 2023, the Department issued an NPRM 105 to modify the Privacy Rule for the purpose of prohibiting uses and disclosures of PHI for criminal, civil, or administrative investigations or proceedings against persons for seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it is provided. To properly execute the HIPAA statutory mandate, and in accordance with the regulatory authority granted to it by Congress, the Department continually monitors and evaluates the evolving environment for health information privacy nationally, including the interaction of the Privacy Rule and state statutes and regulations governing the privacy of health information. In keeping with the Department's practice, this final rule accommodates state autonomy to the extent consistent with the need to maintain rules for health information privacy that serve HIPAA's objectives. The regulation thus preempts state law only to the extent necessary to achieve Congress' directive to establish a standard for the privacy of IIHI for the purpose of improving the effectiveness of the health care system. As discussed below, achieving that objective requires individuals to trust that their health care providers will maintain privacy of PHI about lawful reproductive health care. In addition, NCVHS held a virtual public meeting that included a discussion about the proposed rule on June 14, 2023, 106 and provided recommendations to the Department based on this discussion, briefings at their July 2022 107 and December 2022 108 meetings, and the expertise of its members. 109 The resultant public record and subsequent recommendations submitted to the Department by NCVHS, along with other public comments on the 2023 Privacy Rule NPRM, informed the development of these modifications. 105 88 FR 23506. 106 See Meeting of NCVHS (June 14, 2023), https://ncvhs.hhs.gov/meetings/full-committee-meeting-13/. 107 See Meeting of NCVHS, Briefing on Legislative Developments in Data Privacy (July 21, 2022), https://ncvhs.hhs.gov/meetings/full-committee-meeting-11/. 108 See Meeting of NCVHS, Briefing by Cason Schmit (Dec. 7, 2022), https://ncvhs.hhs.gov/meetings/full-committee-meeting-12/. 109 Letter from NCVHS Chair Jacki Monson to HHS Sec'y Xavier Becerra (June 14, 2023) (forwarding NCVHS recommendations), https://ncvhs.hhs.gov/wp-content/uploads/2023/06/NCVHS-Comments-on-HIPAA-Reproduction-Health-NPRM-Final-508.pdf. III. Justification for This Rulemaking A. HIPAA Encourages Trust and Confidence by Carefully Balancing Individuals' Privacy Interests With Others' Interests in Using or Disclosing PHI 1. Privacy Protections Ensure That Individuals Have Access to, and Are Comfortable Accessing, High-Quality Health Care The goal of a functioning health care system is to provide high-quality health care that results in the best possible outcomes for individuals. To achieve that goal, a functioning health care system depends in part on individuals trusting health care providers. Thus, trust between individuals and health care providers is essential to an individual's health and well-being. 110 Protecting the privacy of an individual's health information is “a crucial element for honest health discussions.” 111 The original Hippocratic Oath required physicians to pledge to maintain the confidentiality of health information they learn about individuals. 112 Without confidence that private information will remain private, individuals—to their own detriment—are reluctant to share information with health care providers. 110 See Jennifer Richmond et al., “Development and Validation of the Trust in My Doctor, Trust in Doctors in General, and Trust in the Health Care Team Scales,” 298 Social Science & Medicine 114827 (2022), https://www.sciencedirect.com/science/article/abs/pii/S0277953622001332?via%3Dihub; see also Fallon E. Chipidza et al., “Impact of the Doctor-Patient Relationship,” The Primary Care Companion for CNS Disorders (Oct. 2015), https://www.psychiatrist.com/pcc/delivery/patient-physician-communication/impact-doctor-patient-relationship/. See Testimony (transcribed) of William G. Plested, III, M.D., Member, Board of Trustees, American Medical Association, Hearing on Confidentiality of Patient Medical Records before House of Representatives Committee on Ways and Means, Subcommittee on Health (Feb. 17, 2000), https://www.govinfo.gov/content/pkg/CHRG-106hhrg66897/html/CHRG-106hhrg66897.htm. (“Trust is the foundation of the patient/physician relationship.”) 111 See Am. Med. Ass'n, “Patient Perspectives Around Data Privacy,” (2022), https://www.ama-assn.org/system/files/ama-patient-data-privacy-survey-results.pdf. 112 See John C. Moskop et al., “From Hippocrates to HIPAA: Privacy and Confidentiality in Emergency Medicine—Part I: Conceptual, Moral, and Legal Foundations,” 45 Ann Emerg. Med.1 (Jan. 2005) (quoting the Oath of Hippocrates, “What I may see or hear in the course of the treatment or even outside of the treatment in regard to the life of men, which on no account one must spread abroad, I will keep to myself [. . .].”), https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7132445/#bib1. When proposing the 2000 Privacy Rule, the Department recognized that individuals may be deterred from seeking needed health care if they do not trust that their sensitive information will be kept private. 113 The Department described its policy choices as stemming from a motivation to develop and maintain a relationship of trust between individuals and health care providers. The Department explained that a fundamental assumption of the 2000 Privacy Rule was that the greatest benefits of improved privacy protection would be realized in the future as individuals gain increasing trust in their health care provider's ability to maintain the confidentiality of their health information. 114 As a result, the Privacy Rule strengthened protections for health information privacy, including the right of individuals to determine who has access to their health information. 113 See 64 FR 59918, 60006 (Nov. 3, 1999) (In the 1999 Privacy Rule NPRM, the Department discussed confidentiality as an important component of trust between individuals and health care providers and cited a 1994 consumer privacy survey that indicated that a lack of privacy may deter patients from obtaining preventive care and treatment.). See id. at 60019. 114 See 64 FR 59918, 60006 (Nov. 3, 1999). Despite the Privacy Rule's rights and protections, individuals do not have confidence that their IIHI is being protected adequately. In a 2022 survey on patient privacy, the American Medical Association (AMA) found that, of 1,000 patients surveyed: (1) nearly 75% were concerned about protecting the privacy of their own health information; and (2) 59% of patients worried about health data being used by companies to discriminate against them or their loved ones. 115 According to the AMA, a lack of health information privacy raises many questions about circumstances that could put individuals and health care providers in legal peril, and that the “primary purpose of increasing [health information] privacy is to build public trust, not inhibit data exchange.” 116 115 See “Patient Perspectives Around Data Privacy,” supra note 111. 116 Id. at 2. The Federal Government also has a strong interest in ensuring that individuals have access to high-quality health care. 117 This is true at both an individual and population level. In the 2000 Privacy Rule, the Department noted that high-quality health care depends on an individual being able to share sensitive information with their health care provider based on the trust that the information shared will be protected and kept confidential. 118 An effective health care system requires an individual to share sensitive health information with their health care providers. They do so with the reasonable expectation that this information is going to be used to treat them. The prospect of the disclosure of highly sensitive PHI by regulated entities can result in medical mistrust and the deterioration of the confidential, safe environment that is necessary to provide high-quality health care, operate a functional health care system, and improve the public's health generally. 119 High-quality health care cannot be attained without patient candor. Health care providers rely on an individual's health information to diagnose them and provide them with appropriate treatment options and may not be able to reach an accurate diagnosis or recommend the best course of action for the individual if the individual's medical records lack complete information about their health history. However, an individual may be unwilling to seek treatment or share highly sensitive PHI when they are concerned about the confidentiality and security of PHI provided to treating health care providers. 120 The Department has long recognized that health care professionals who lose the trust of their patients cannot deliver high-quality care. 121 Similarly, if a health care provider does not trust that the PHI they include in an individual's medical records will be kept private, the health care provider may leave gaps or include inaccuracies when preparing medical records, creating a risk that ongoing or future health care would be compromised. In contrast, heightened confidentiality and privacy protections enable a health care provider to feel confident maintaining full and complete medical records. 117 See Testimony (transcribed) of Peter R. Orszag, Director, Congressional Budget Office, Hearing on Comparative Clinical Effectiveness before House of Representatives Committee on Ways and Means, Subcommittee on Health, 2007 WL 1686358 (June 12, 2007) (“because federal health insurance programs play a large role in financing medical care and represent a significant expenditure, the federal government itself has an interest in evaluations of the effectiveness of different health care approaches”); Statement of Sen. Durenberger introducing S.1836, American Health Quality Act of 1991 and reading bill text, 137 Cong. Rec. S26720 (Oct. 17, 1991) (“[T]he Federal Government has a demonstrated interest in assessing the quality of care, access to care, and the costs of care through the evaluative activities of several Federal agencies.”). 118 See 65 FR 82462, 82463 (Dec. 28, 2000). 119 See, e.g., Brooke Rockwern et al., Medical Informatics Committee and Ethics, Professionalism and Human Rights Committee of the American College of Physicians, “Health Information Privacy, Protection, and Use in the Expanding Digital Health Ecosystem: A Position Paper of the American College of Physicians,” 174 Ann Intern Med. 994 (Jul. 2021) (discussing the need for trust in the health care system as necessary to mitigate a global pandemic); Johanna Birkhäuer et. al, “Trust in the Health Care Professional and Health Outcome: A Meta-Analysis,” 12 PLoS One e0170988 (Feb. 7, 2017). See also Eric Boodman, “In a doctor's suspicion after a miscarriage, a glimpse of expanding medical mistrust,” STAT News (June 29, 2022), https://www.statnews.com/2022/06/29/doctor-suspicion-after-miscarriage-glimpse-of-expanding-medical-mistrust/ (Sarah Prager, professor of obstetrics and gynecology at the University of Washington, stating that it is a bad precedent if clinical spaces become unsafe for patients because, “[a health care provider's] ability to take care of patients relies on trust, and that will be impossible moving forward.”). 120 See “Development and Validation of the Trust in My Doctor, Trust in Doctors in General, and Trust in the Health Care Team Scales,” supra note 110; Bradley E. Iott et al., “Trust and Privacy: How Patient Trust in Providers is Related to Privacy Behaviors and Attitudes,” 2019 AMIA Annu Symp Proc 487 (Mar. 2020), https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7153104/; Pamela Sankar et al., “Patient Perspectives of Medical Confidentiality: a Review of the Literature,” 18 J. of Gen. Internal Med. 659 (Aug. 2003), https://pubmed.ncbi.nlm.nih.gov/12911650/. 121 See 65 FR 82462, 82468 (Dec. 28, 2000). Incomplete medical records and health care avoidance not only inhibit the quality of health care an individual receives; they are also detrimental to efforts to improve public health. The objective of public health is to prevent disease in and improve the health of populations. Barriers that undermine the willingness of individuals to seek health care in a timely manner or to provide complete and accurate health information to their health care providers undermine the overall objective of public health. For example, individuals who are not candid with their health care providers because of concerns about potential negative consequences of a loss of privacy may withhold information about a variety of health matters that have public health implications, such as communicable diseases or vaccinations. 122 Experience also shows that medical mistrust—especially in communities of color and other communities that have been marginalized or negatively affected by historical and current health care disparities—can create damaging and chilling effects on individuals' willingness to seek appropriate and lawful health care for medical conditions that can worsen without treatment. 123 122 See Letter from NCVHS Chair Simon P. Cohn, supra note 104, at 2 (2006) (with forwarded NCVHS recommendations, “Individual trust in the privacy and confidentiality of their personal health information also promotes public health, because individuals with potentially contagious or communicable diseases are not inhibited from seeking treatment.”). 123 See Texas Dep't of State Health Servs., “Texas Maternal Mortality and Morbidity Review Committee and Department of State Health Services Joint Biennial Report 2022,” at 41 (Dec. 2022) https://www.dshs.texas.gov/sites/default/files/legislative/2022-Reports/2022-MMMRC-DSHS-Joint-Biennial-Report.pdf; Lynn M. Paltrow et al., “Arrests of and forced interventions on pregnant women in the United States, 1973-2005: implications for women's legal status and public health,” 38 J. Health Pol. Pol'y Law 299 (2013) (finding that hospital staff are most likely to report pregnant low-income and patients of color, especially Black women, to the authorities.); Terri-ann Monique Thompson et al., “Racism Runs Through It: Examining the Sexual and Reproductive Health Experience of Black Women in the South,” 41 Health Affairs 195 (Feb. 2022) (discussing how individual racism affects reproductive health care use by undermining the patient-doctor relationship), https://www.healthaffairs.org/doi/10.1377/hlthaff.2021.01422 ); Joli Hunt, “Maternal Mortality among Black Women in the United States,” Ballard Brief (July 2021), https://ballardbrief.byu.edu/issue-briefs/maternal-mortality-among-black-women-in-the-united-states/ (discussing the disproportionately high rate of Black maternal mortality and morbidity); Austin Frakt, “Bad Medicine: The Harm that Comes from Racism,” The New York Times (July 8, 2020), https://www.nytimes.com/2020/01/13/upshot/bad-medicine-the-harm-that-comes-from-racism.html. 2. The Department's Approach to the Privacy Rule Has Long Sought To Balance the Interests of Individuals and Society While recognizing the importance of preserving individuals' trust, the Department has consistently taken the approach of balancing the interests of the individual in the privacy of their PHI with society's interests, including in the free flow of information that enables the provision of effective and efficient health care services. Such an approach derives from Congress's direction, in 1996, to improve the efficiency and effectiveness of the health care system by encouraging the development of a health information system while taking into account the privacy of IIHI and the uses and disclosures of such information that should be authorized or required. 124 In past rulemakings, the Department has made revisions to the Privacy Rule to balance an individual's privacy expectations with a covered entity's need for information for reimbursement and quality purposes. 125 As the Department previously explained, “Patient privacy must be balanced against other public goods, such as research and the risk of compromising such research projects if researchers could not continue to use such data.” 126 The 2000 Privacy Rule included permissions for regulated entities to disclose PHI under certain conditions, including for judicial and administrative proceedings and law enforcement purposes, because an individual's right to privacy in information about themselves is not absolute. For example, it does not prevent reporting of public health information on communicable diseases, nor does it prevent law enforcement from obtaining information when due process has been observed. 127 124 42 U.S.C. 1320d note and 1320d-2 note. 125 See 67 FR 53182, 53216 (Aug. 14, 2002). 126 Id. at 53226. 127 65 FR 82462, 82464 (Dec. 28, 2000). In more recent rulemakings revising the Privacy Rule, the Department has continued its efforts to build and maintain individuals' trust in the health care system while balancing the interests of individuals with those of others. For example, in explaining revisions made as part of the 2013 Omnibus Rule, the Department recognized that covered entities must balance protecting the privacy of health information with sharing health information with those responsible for ensuring public health and safety. 128 The Privacy Rule was also revised in 2016 (“2016 Privacy Rule”) in accordance with an administration-wide effort to curb gun violence across the nation. 129 The 2016 Privacy Rule was tailored to authorize the disclosure of a limited set of PHI 130 for a narrow, specific purpose, that is, to permit only regulated entities that are state agencies or other entities designated by a state to collect and report information to the National Instant Criminal Background Check System (NICS) or a lawful authority making an adjudication or commitment as described by 18 U.S.C. 922(g)(4) to disclose to NICS the identities of individuals who are subject to a Federal “mental health prohibitor,” that disqualifies them from shipping, transporting, possessing, or receiving a firearm. As explained in the 2016 Privacy Rule, the Federal mental health prohibitor applies only to the extent that the individual is involuntarily committed or determined by a court or other lawful authority to be a danger to self or others, or is unable to manage their own affairs because of a mental illness or condition. 131 Similar to this final rule, the 2016 Privacy Rule balanced public safety goals with individuals' privacy interests by clearly limiting permissible disclosures to those that are necessary to ensure that individuals are not discouraged from seeking lawful health care, in this case, voluntary treatment for mental health needs. 132 In the 2013 Omnibus Rule and 2016 Privacy Rule, the Department ensured that the disclosures were necessary for the public good and were not for the purpose of harming the individual. This approach is consistent with the NCVHS recommendations to the Secretary relating to health information privacy: “The Committee strongly supports limiting use and disclosure of identifiable information to the minimum amount necessary to accomplish the purpose. The Committee also strongly believes that when identifiable health information is made available for non-health uses, patients deserve a strong assurance that the data will not be used to harm them.” 133 128 See 78 FR 5566, 5616 (Jan. 25, 2013). 129 81 FR 382 (Jan. 6, 2016); see, e.g., 78 FR 4297 (Jan. 22, 2013) and 78 FR 4295 (Jan. 22, 2013); see also Colleen Curtis, “President Obama Announces New Measures to Prevent Gun Violence,” The White House President Barack Obama (Jan. 16, 2013), https://obamawhitehouse.archives.gov/blog/2013/01/16/president-obama-announces-new-measures-prevent-gun-violence. 130 This PHI includes limited demographic and certain other information needed for the purposes of reporting to NICS. 45 CFR 164.512(k)(7)(iii)(A). In preamble, the Department explained that generally the information described at 45 CFR 164.512(k)(7)(iii)(A) would be limited to the data elements required to create a NICS record and certain other elements to the extent that they are necessary to exclude false matches: Social Security number, State of residence, height, weight, place of birth, eye color, hair color, and race. 81 FR 382, 390 (Jan. 6, 2016). 131 81 FR 382, 386-388 (Jan. 6, 2016). 132 Id. The Department addressed concerns about the possible chilling effect on individuals seeking health care by explaining that (1) the permission is limited to only those covered entities that order the involuntary commitments or make the other adjudications that cause individuals to be subject to the Federal mental health prohibitor, or that serve as repositories of such information for NICS reporting purposes; (2) the specified regulated entities are permitted to disclose NICS data only to designated repositories or the NICS; (3) the information that may be disclosed is limited to certain demographic or other information that is necessary for NICS reporting; and (4) the rulemaking did not expand the permission to encompass State law prohibitor information. 133 Letter from NCVHS Chair Don E. Detmer to HHS Sec'y Donna E. Shalala (June 27, 1997) (forwarding NCVHS recommendations), https://ncvhs.hhs.gov/rrp/june-27-1997-letter-to-the-secretary-with-recommendations-on-health-privacy-and-confidentiality/. Consistent with Congress's directive to promulgate “standards with respect to the privacy of [IIHI]” that, among other things, address the “uses and disclosures of such information that should be authorized or required,” 134 the Department recognizes a variety of interests with respect to health information. These include individuals' interests in the privacy of their health information, society's interests in ensuring the effectiveness of the health care system, and other interests of society in using IIHI for certain non-health care purposes. As part of balancing these interests, the Department has also recognized that it may be necessary to afford additional protection to certain types of health information because those types of information are particularly sensitive and often involve highly personal health care decisions. For example, the Department affords special privacy protections to psychotherapy notes. These protections are afforded in part because of the particularly sensitive information those notes contain and in part because of the unique function of these records, which are by definition maintained separately from an individual's medical record. 135 As we previously explained, the primary value of psychotherapy notes is to the specific provider, and the promise of strict confidentiality helps to ensure that the patient will feel comfortable freely and completely disclosing very personal information essential to successful treatment. 136 The Department elaborated that even the possibility of disclosure may impede development of the confidential relationship necessary for successful treatment because of the sensitive nature of the problems for which individuals consult psychotherapists and the potential embarrassment that may be engendered by the disclosure of confidential communications made during counseling sessions. 137 Therefore, to support the development and maintenance of an individual's trust and protect the relationship between an individual and their therapist, the Privacy Rule permits the disclosure of psychotherapy notes without an individual's authorization only in limited circumstances, such as to avert a serious and imminent threat to health or safety. Those limited circumstances do not include judicial and administrative proceedings or law enforcement purposes unless the disclosure is “necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.” 138 134 42 U.S.C. 1320d-2 note. 135 See 45 CFR 164.501 (definition of “Psychotherapy notes”). 136 See 64 FR 59918, 59941 (Nov. 3, 1999). 137 See id. 138 45 CFR 164.508(a)(2). Information about an individual's reproductive health and associated health care is also especially sensitive and has long been recognized as such. As stated in the AMA's Principles of Medical Ethics, the “decision to terminate a pregnancy should be made privately within the relationship of trust between patient and physician in keeping with the patient's unique values and needs and the physician's best professional judgment.” 139 NCVHS first noted reproductive health information as an example of a category of health information commonly considered to contain sensitive information in 2006. 140 Between 2005 and 2010, NCVHS held nine hearings that addressed questions about sensitive information in medical records and identified additional categories of sensitive information beyond those addressed in Federal and state law, including “sexuality and reproductive health information.” In several letters to the Secretary during that period, NCVHS recommended that the Department identify and define categories of sensitive information, including “reproductive health.” 141 In a 2010 letter to the Secretary, NCVHS elaborated that, after extensive testimony on sensitive categories of health information, “reproductive health” should be expanded to “sexuality and reproductive health information,” because: 139 Council on Ethical and Judicial Affairs, “Ethics, Amendment to Opinion 4.2.7, Abortion H-140.823,” Am. Med. Ass'n (2022), https://policysearch.ama-assn.org/policyfinder/detail/%224.2.7%20Abortion%22?uri=%2FAMADoc%2FHOD.xml-H-140.823.xml. 140 See Letter from NCVHS Chair Simon P. Cohn (2006), supra note 104. 141 See Letter from NCVHS Chair Simon P. Cohn (2006), supra note 104; Letter from NCVHS Chair Simon P. Cohn (2008), supra note 104; Letter from NCVHS Chair Justine M. Carr (2010), supra note 104. Information about sexuality and reproductive history is often very sensitive. Some reproductive issues may expose people to political controversy (such as protests from abortion proponents), and public knowledge of an individual's reproductive history may place [them] at risk of stigmatization.” Additionally, individuals may wish to have their reproductive history segmented so that it is not viewed by family members who otherwise have access to their records. Parents may wish to delay telling their offspring about adoption, gamete donation, or the use of other forms of assisted reproduction technology in their conception, and, thus, it may be important to have the capacity to segment these records. 142 142 See Letter from NCVHS Chair Justine M. Carr (2010), supra note 104. The Department did not provide specific protections for certain categories of PHI upon receipt of the recommendation or as part of the 2013 Omnibus Rule because of concerns about the ability of regulated entities to segment PHI and the effects on care coordination. While we recognized the sensitive nature of reproductive health information before this rulemaking, the Department believed that the Supreme Court's recognition of a constitutional right to abortion coupled with the privacy protections afforded by the HIPAA Rules provided the necessary trust to promote access to and quality of health care. As a result of the changed legal landscape for reproductive health care broadly, including abortion, the range of circumstances in which PHI about legal reproductive health care could be sought and used in investigations or to impose liability expanded significantly. Now that states have much broader power to criminalize and regulate reproductive choices—and that some states have already exercised that power in a variety of ways 143 —individuals legitimately have a far greater fear that especially sensitive information about lawful health care will not be kept private. This changed environment requires additional privacy protections to help restore the Privacy Rule's carefully-struck balance between individual and societal interests. Because the concerns regarding segmentation and the negative impact on care coordination remain, the Department did not propose and is not establishing a new category of particularly sensitive PHI in this final rule. Instead, as discussed more fully below, the Department is finalizing its proposed purpose-based prohibition against certain uses and disclosures. 143 See LePage v. Center for Reproductive Medicine, SC-2022-0515 (Feb. 16, 2024). B. Developments in the Legal Environment Are Eroding Individuals' Trust in the Health Care System The Supreme Court's decision in Dobbs overturned Roe v. Wade 144 and Planned Parenthood of Southeastern Pennsylvania v. Casey, 145 thereby enabling states to significantly restrict access to abortion. 146 Following the Supreme Court's decision, the legal landscape has shifted as laws significantly restricting access to abortion have in fact become effective in some jurisdictions. This change has also led to questions about both the current and future lawfulness of other types of reproductive health care, and therefore, the ability of individuals to access such health care. 147 Thus, this shift may interfere with the longstanding expectations of individuals, established by HIPAA and the Privacy Rule, with respect to the privacy of their PHI. 148 For example, while the Privacy Rule currently permits, but does not require, uses and disclosures of PHI for certain purposes, 149 including when another law requires a regulated entity to make the use or disclosure, 150 regulated entities after Dobbs may feel compelled by other applicable law to use or disclose PHI to law enforcement or other persons who may use that health information against an individual, a regulated entity, or another person who has sought, obtained, provided, or facilitated reproductive health care, even when such health care is lawful in the circumstances in which the health care is obtained. 151 144 410 U.S. 113 (1973). 145 505 U.S. 833 (1992). 146 Dobbs, 597 U.S. 299-302. 147 See, e.g., Carmel Shachar et al., “Informational Privacy After Dobbs,” 75 Ala. L. Rev. 1 (2023), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4570500 and Andrzej Kulczycki, “Dobbs: Navigating the New Quagmire and Its Impacts on Abortion and Reproductive Health Care,” Health Education & Behavior (2022), https://doi.org/10.1177/10901981221125430. 148 See, e.g., Kayte Spector-Bagdady & Michelle M. Mello, “Protecting the Privacy of Reproductive Health Information After the Fall of Roe v. Wade,” 3 JAMA Network e222656 (June 30, 2022), https://jamanetwork.com/journals/jama-health-forum/fullarticle/2794032 ; Lisa G. Gill, “What does the overturn of Roe v. Wade mean for you?,” Consumer Reports (June 24, 2022), https://www.consumerreports.org/health-privacy/what-does-the-overturn-of-roe-v-wade-mean-for-you-a1957506408/. 149 45 CFR 164.502(a)(1). 150 45 CFR 164.512(a). 151 See Laura J. Faherty et al. “Consensus Guidelines and State Policies: The Gap Between Principle and Practice at the Intersection of Substance Use and Pregnancy,” American Journal of Obstetrics & Gynecology Maternal-Fetal Medicine (Aug. 2020) (discussing a concern raised by multiple organizations that pregnant women will hesitate to seek prenatal care and addiction treatment during pregnancy because their concerns that disclosing substance use to health care providers will increase the likelihood that they will face legal penalties); see also “Informational Privacy After Dobbs,” supra note 147. As a consequence of these developments in Federal and state law, an individual's expectation of privacy of their health information (irrespective of whether an individual is or was pregnant) is threatened by the potential use or disclosure of PHI to identify persons who seek, obtain, provide, or facilitate lawful reproductive health care. Thus, these developments have created an environment in which individuals are more likely to fear that their PHI will be requested from regulated entities for use against individuals, health care providers, and others, merely because such persons sought, obtained, provided, or facilitated lawful reproductive health care. 152 The potential increased demand for PHI for these purposes is not limited to states in which providing or obtaining certain reproductive health care is no longer legal. Rather, the changes in the legal landscape have nationwide implications, not only because of their effects on the relationship between health care providers and individuals, but also because of the potential effects on the flow of health information across state lines. For example, an individual who travels out-of-state to obtain reproductive health care that is lawful under the circumstances in which it is provided may now be reluctant to have that information disclosed to a health care provider in their home state if they fear that it may then be used against them or a loved one in their home state. A health care provider may be unable to provide appropriate health care if they are unaware of the individual's recent health history, which could have significant negative health consequences. Individuals and health care providers may also be reluctant to disclose PHI to health plans with a multi-state presence because of concerns that one of those states will seek to obtain that PHI to investigate or impose liability on the individual or the health care provider, even if there is no nexus with that state other than the presence of the health plan in that state. Such reluctance may have significant ramifications for access to reproductive health care, given the cost associated with obtaining such health care, and health care generally. 152 See, e.g., Yvonne Lindgren et al., “Reclaiming Tort Law to Protect Reproductive Rights,” 75 Alabama L. Rev. 355 (2023), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4435834. Additionally, PHI is more likely to be transmitted across state lines as the electronic exchange of PHI increases because it is easier and more efficient to send information electronically. For instance, the Trusted Exchange Framework and Common Agreement (TEFCA) initiative established under the 21st Century Cures Act and the Centers for Medicare & Medicaid Services (CMS) Interoperability and Prior Authorization Final Rule will spur greater use and disclosure of PHI by regulated entities and to health apps and others. 153 Different components of a health information exchange/health information network (HIE/HIN) may be located in different states, meaning that the PHI may be transmitted across state lines, and thus affected by laws severely restricting access to reproductive health care, even where both the health care and the recipient of the PHI are located in states where access to such health care is not substantially restricted. 153 See section 3001(c) of the PHSA, as amended by section 4003(b) of the 21st Century Cures Act, Public Law 114-255, 130 Stat. 1165 (codified at 42 U.S.C. 300jj-11(c)). For more information, see Office of the Nat'l Coordinator for Health Info. Tech., “Trusted Exchange Framework and Common Agreement (TEFCA),” https://www.healthit.gov/topic/interoperability/policy/trusted-exchange-framework-and-common-agreement-tefca; See also 89 FR 8758 (Feb. 8, 2024); “CMS Interoperability and Prior Authorization Final Rule CMS-0057-F,” Centers for Medicare & Medicaid (Jan. 17, 2024), https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f. According to commenters, individuals are increasingly concerned about the confidentiality of discussions with their health care providers. As a result, some individuals are not confiding fully in their health care providers, increasing the risk that their medical records will not be complete and accurate, leading to decreases in health care quality and safety. This lack of openness is also likely to affect the information and treatment recommendations health care providers provide to individuals because health care providers will not be sufficiently informed to provide thorough and accurate information and guidance. 154 154 See Eric Boodman, “In a doctor's suspicion after a miscarriage, a glimpse of expanding medical mistrust,” STAT News (June 29, 2022), https://www.statnews.com/2022/06/29/doctor-suspicion-after-miscarriage-glimpse-of-expanding-medical-mistrust/#:~:text=In%20a%20doctor's%20suspicion%20after,glimpse%20of%20expanding%20medical%20mistrust&text=The%20idea%20that%20she,used%20contraceptives%20and%20trusted%20them. Individuals are not alone in their fears. Indeed, according to commenters, some health care providers are afraid to provide lawful health care because they are concerned that in doing so, they risk being subjected to investigation and possible liability. 155 The Department is aware that some health care providers, such as clinicians and pharmacies, are hesitant to provide lawful health care or lawfully prescribe or fill prescriptions for medications that can result in pregnancy loss, even when the health care or those prescriptions are intended to treat individuals for other health matters, because of fear of law enforcement action. 156 Some health care providers are also not providing individuals with information to address concerns about their reproductive health, even where their communications would be lawful, out of fear of criminal prosecution, civil suit, or loss of their clinical license. 157 This may result in individuals making decisions about their health care with incomplete information, which could have serious implications for health outcomes. These fears also increase the risk that individual medical records will not be maintained with completeness and accuracy, which will in turn affect the quality of health care provided to individuals and their safety. Fears about potential prosecution, even when Federal law protects the actions of health care providers, are likely to negatively affect the accuracy of medical records maintained by health care providers and thereby harm individuals. 155 See also Melissa Suran, “As Laws Restricting Health Care Surge, Some US Physicians Choose Between Fight or Flight,” JAMA, 329(22):1899-1903 (May 17, 2023) (discussing a maternal-fetal medicine specialist who stated that she moved to another state because of legislation that restricts evidence-based health care and prevents her from fulfilling her ethical obligation to protect her patients' health.), https://pubmed.ncbi.nlm.nih.gov/37195699/. 156 See Off. for Civil Rights, “HHS Office for Civil Rights Resolves Complaints with CVS and Walgreens to Ensure Timely Access to Medications for Women and Support Persons with Disabilities,” U.S. Dep't of Health and Human Servs. (June 16, 2023), https://www.hhs.gov/civil-rights/for-providers/compliance-enforcement/agreements/cvs-walgreens/index.html. See also Kathryn Starzyk et al., “More than half of patients with a rheumatic disease or immunologic condition undergoing methotrexate treatment reside in states in which the overturning of Roe v. Wade can jeopardize access to medications with abortifacient potential,” 75 Arthritis Rheumatol 328 (Feb. 2023); see also Celine Castronuovo, “Many Female Arthritis Drug Users Face Restrictions After Dobbs,” Bloomberg Law (Nov. 14, 2022) (noting that 16 out of 524 patients responding to a survey indicated that they've had trouble getting methotrexate, their arthritis medication, since the Dobbs decision.) https://news.bloomberglaw.com/health-law-and-business/many-female-arthritis-drug-users-face-restrictions-after-dobbs; Interview with Donald Miller, PharmD, “Methotrexate access becomes challenging for some patients following Supreme Court decision on abortion,” Pharmacy Times (July 20, 2022), https://www.pharmacytimes.com/view/methotrexate-access-becomes-challenging-for-patients-following-supreme-court-decision-on-abortion; Jamie Ducharme, “Abortion restrictions may be making it harder for patients to get a cancer and arthritis drug,” Time (July 6, 2022), https://time.com/6194179/abortion-restrictions-methotrexate-cancer-arthritis/; Katie Shepherd & Frances Stead Sellers, “Abortion bans complicate access to drugs for cancer, arthritis, even ulcers,” The Washington Post (Aug. 8, 2022), https://www.washingtonpost.com/health/2022/08/08/abortion-bans-methotrexate-mifepristone-rheumatoid-arthritis/. 157 See Michelle Oberman & Lisa Soleymani Lehmann, “Doctors' duty to provide abortion information,” J. of Law and Biosciences. (Sept. 1, 2023) https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10474560/; Whitney Arey et al., “Abortion Access and Medically Complex Pregnancies Before and After Texas Senate Bill 8,” 141 Obstet Gynecol. 995 (May 1, 2023) (concluding that “Abortion restrictions limit shared decision making, compromise patient care, and put pregnant people's health at risk.”); “1 Year Without Roe,” Center for American Progress (Jun. 23, 2023) (where a physician detailed her fear about speaking freely with her patients after Dobbs “worried a vigilante posing as a new patient would attempt to bait her into talking about abortion and attempt to sue her, and she sometimes skirts the topic of abortion when speaking with patients about their health care options.”) As explained by commenters and supported by research, these impingements on the privacy of health information about reproductive health care are likely to have a disproportionately greater effect on women, individuals of reproductive age, and individuals from communities that have been historically underserved, marginalized, or subject to discrimination or systemic disadvantage by virtue of their race, disability, social or economic status, geographic location, or environment. 158 Historically underserved and marginalized individuals are also more likely to be the subjects of investigations and other activities to impose liability for seeking or obtaining reproductive health care, even where such health care is lawful under the circumstances in which it is provided. 159 They are also less likely to have adequate access to legal counsel to defend themselves from such actions. 160 These inequities may be exacerbated where individuals face multiple, intersecting disparities, such as having limited English proficiency 161 and disability. 162 Such individuals are thus especially likely to be concerned that information they share with their health care providers about their reproductive health care will not remain private. This is particularly true considering the historic lack of trust, negative experiences, and fear of discrimination that many members of historically underrepresented and marginalized communities and communities of color have in the health care system; 163 such individuals are more likely to be deterred from seeking or obtaining health care—or from giving their health care providers full information. 158 See Christine Dehlendorf et al., “Disparities in Abortion Rates: A Public Health Approach,” Am. J. of Pub. Health (Oct. 2013), https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3780732/. See also Kiara Alfonseca, “Why Abortion Restrictions Disproportionately Impact People of Color,” ABC News (June 24, 2022), https://abcnews.go.com/Health/abortion-restrictions-disproportionately-impact-people-color/story?id=84467809; Dulce Gonzalez et al., Robert Wood Johnson Foundation, “Perceptions of Discrimination and Unfair Judgment While Seeking Health Care” (Mar. 31, 2021), https://www.rwjf.org/en/insights/our-research/2021/03/perceptions-of-discrimination-and-unfair-judgment-while-seeking-health-care.html; Susan A. Cohen, “Abortion and Women of Color: The Bigger Picture,” 11 Guttmacher Pol'y Rev. (Aug. 6, 2008), https://www.guttmacher.org/gpr/2008/08/abortion-and-women-color-bigger-picture; “The Disproportionate Harm of Abortion Bans: Spotlight on Dobbs v. Jackson Women's Health,” Center for Reproductive Rights (Nov. 29, 2021), https://reproductiverights.org/supreme-court-case-mississippi-abortion-ban-disproportionate-harm/ (“Abuses such as forced sterilization of Black, Indigenous, and other people of color and individuals with disabilities specifically exacerbate medical mistrust within reproductive healthcare.”). 159 See Brief of Amici Curiae for Organizations Dedicated to the Fight for Reproductive Justice—Mississippi in Action, et al. at *35-36, Dobbs, 597 U.S. 215 (discussing the likelihood that individuals, particularly those from marginalized communities who terminate their pregnancies and anyone who assists them may be disproportionally likely to face criminal investigation or arrest, given the rates of incarceration of persons from such communities.); see also Elizabeth Yuko, “Women of Color Will Face More Criminalized Pregnancies in Post-` Roe' America,” Rolling Stone (Jul. 7, 2020) (“Historically, we've seen the criminalization of people of color, young people, and people with lower incomes who've had miscarriages and other types of pregnancy losses that the state deemed were their fault [. . .] These groups are the most likely to be reported to law enforcement and investigated”); see also Sentencing Project, State-by-State Data, https://www.sentencingproject.org/research/us-criminal-justice-data/ (last visited Feb. 16, 2024) (U.S. Total: Imprisonment rate per 100,000 residents—355; Black/White disparity—4.8:1; Latinx/White disparity—1.3:1); Racial Disparities in Incarceration, Vera Institute of Justice (Aug. 21, 2023), https://trends.vera.org/ (Prison population rate per 100,000 residents ages 15 to 64. U.S. total incarceration rate 2021 Q2—298, Asian American/Pacific Islander incarceration rate 2021 Q2—100, Black/African American incarceration rate 2021 Q2—1,310, Latinx incarceration rate 2021 Q2—671, Native American incarceration rate 2021 Q2—1,021, White incarceration rate 2021 Q2—281). 160 See Columbia Law Sch. Hum. Rts. Inst. & and Ne. Univ. Sch. of Law Program on Hum. Rts. and the Glob. Econ.,” Equal Access to Justice: Ensuring Meaningful Access to Counsel in Civil Cases, Including Immigration Proceedings” (July 2014), https://hri.law.columbia.edu/sites/default/files/publications/equal_access_to_justice_-_cerd_shadow_report.pdf. See also Lauren Hoffman et al., Ctr. For Am. Progress, “Report: State Abortion Bans Will Harm Women and Families' Economic Security Across the US” (Aug. 25, 2022), https://www.americanprogress.org/article/state-abortion-bans-will-harm-women-and-families-economic-security-across-the-us/. 161 See Myasar Ihmud, “Lost in Translation: Language Barriers to Accessing Justice in the American Court System,” UIC Law Review (2023) (discussing “access to justice for [limited English proficient (LEP)] individuals is hindered because they are unable to communicate with the court or understand the proceedings. Case law shows that, when unable to communicate with the court, LEP litigants are unable to defend themselves appropriately in criminal or immigration hearings, protect their homes, or keep custody of their children.”), https://repository.law.uic.edu/cgi/viewcontent.cgi?article=2908&context=lawreview; see also “Language Access & Cultural Sensitivity,” Legal Services Corporation (last visited Feb. 21, 2024) (describing how legal aid organizations should plan for providing meaningful access to language services. As of 2013, “close to 25 million people, about 8 percent of the population, has limited English proficiency.”), https://www.lsc.gov/i-am-grantee/model-practices-innovations/language-access-cultural-sensitivity. 162 See, e.g., Gautam Gulati et al., “The experience of law enforcement officers interfacing with suspects who have an intellectual disability—A systematic review,” International Journal of Law and Psychiatry (Sept.-Oct. 2020) (“It is not uncommon for people with [intellectual disability] to be suspects or accused persons when interfacing with Law Enforcement Officers (LEOs) and therefore face arrest, interview and/or custody.”), https://www.sciencedirect.com/science/article/pii/S016025272030073X. 163 See Leslie Read et al., The Deloitte Ctr. for Health Solutions, “Rebuilding Trust in Health Care: What Do Consumers Want—and Need—Organizations to Do?,” at 3 (Aug. 5, 2021) (With focus groups of 525 individuals in the United States who identify as Black, Hispanic, Asian, or Native American, “[f]ifty-five percent reported a negative experience where they lost trust in a health care provider.”), https://www2.deloitte.com/us/en/insights/industry/health-care/trust-in-health-care-system.html; Liz Hamel et al., Kaiser Family Foundation, “The Undefeated Survey on Race and Health,” at 23 (Oct. 2020) (Percent who say they can trust the health care system to do what is right for them or their community almost all of the time or most of the time: Black adults: 44%; Hispanic adults: 50%; White adults: 55%), https://files.kff.org/attachment/Report-Race-Health-and-COVID-19-The-Views-and-Experiences-of-Black-Americans.pdf; U.S. Dep't of Health and Hum. Servs., Assistant Sec'y for Pol. & Eval., Off. of Health Pol., “Issue Brief: Health Insurance Coverage and Access to Care for LGBTQ+ Individuals: Current Trends and Key Challenges,” at 9 (June 2021) (A 2021 survey found that 18 percent of LGBTQ+ individuals reported avoiding going to a doctor or seeking health care out of concern that they would face discrimination or poor treatment because of their sexual orientation or gender identity.), https://aspe.hhs.gov/sites/default/files/2021-07/lgbt-health-ib.pdf; Abigail A. Sewell, “Disaggregating Ethnoracial Disparities in Physician Trust,” Soc. Science Rsch. (Nov. 2015), https://pubmed.ncbi.nlm.nih.gov/26463531/; Irena Stepanikova et al., “Patients' Race, Ethnicity, Language, and Trust in a Physician,” J. of Health and Soc. Behavior (Dec. 2006), https://pubmed.ncbi.nlm.nih.gov/17240927/. Congress contemplated that the Department would need to modify standards adopted under HIPAA's Administrative Simplification provisions and directed the Secretary to review standards adopted under 42 U.S.C. 1320d-2 periodically. 164 In accordance with this directive and based on the Department's expertise and analysis and the recent developments in the legal landscape, there is a compelling need to provide additional protections to PHI about lawful reproductive health care. Accordingly, consistent with Congress's directions to the Department, in HIPAA, as amended by Genetic Information Nondiscrimination Act (GINA) and the HITECH Act, to establish standards and requirements for the electronic transmission of certain health information, including the privacy thereof, for the development of a health information system, the Department is restricting certain uses and disclosures of PHI for particular non-health care purposes to provide such protections. 164 Congress' directions regarding the issuance of standards for the privacy of IIHI are codified at 42 U.S.C. 1320d-2 note. See also 45 CFR 160.104(a). C. To Protect the Trust Between Individuals and Health Care Providers, the Department Is Restricting Certain Uses and Disclosures of PHI for Particular Non-Health Care Purposes As discussed above, Congress enacted HIPAA to improve the efficiency and effectiveness of the health care system, which includes ensuring that individuals have trust in the health care system. Congress also directed the Department to develop standards with respect to the privacy of IIHI as part of its decision to encourage the development of a health information system. To preserve such trust, and to encourage the development and use of a nationwide health information system, it is appropriate and necessary for Federal law and policy to protect the confidentiality of medical records, especially those that are highly sensitive. Accordingly, to protect the trust between individuals and health care providers, this rule restricts certain uses and disclosures of PHI for particular non-health care purposes, i.e., for using or disclosing PHI to conduct a criminal, civil, or administrative investigation into or to impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care, or to identify any person to initiate such activities. Information about reproductive health care is particularly sensitive and requires heightened privacy protection. The Department's approach is consistent with efforts across the Federal Government. For example, the Department of Defense (DOD) has recognized such privacy concerns. In a memorandum to DOD leaders, the Secretary of Defense directed the DOD to “[e]stablish additional privacy protections for reproductive health care information” for service members and “[d]isseminate guidance that directs Department of Defense health care providers that they may not notify or disclose reproductive health information to commanders unless this presumption is overcome by specific exceptions set forth in policy.” 165 The Federal Trade Commission (FTC) has also recognized that information about personal reproductive matters is “particularly sensitive” and has committed to using the full scope of its authorities to protect consumers' privacy, including the privacy of their health information and other sensitive data. 166 In business guidance, the FTC explained that “[t]he exposure of health information and medical conditions, especially data related to sexual activity or reproductive health, may subject people to discrimination, stigma, mental anguish, or other serious harms.” 167 165 Dep't of Defense, Memorandum Re: Ensuring Access to Reproductive Health Care, at 1 (Oct. 20, 2022) (removed emphasis on “not” in original), https://media.defense.gov/2022/Oct/20/2003099747/-1/-1/1/MEMORANDUM-ENSURING-ACCESS-TO-REPRODUCTIVE-HEALTH-CARE.PDF. 166 Kristin Cohen, “Location, health, and other sensitive information: FTC committed to fully enforcing the law against illegal use and sharing of highly sensitive data”, Federal Trade Commission Business Blog (July 11, 2022), https://www.ftc.gov/business-guidance/blog/2022/07/location-health-and-other-sensitive-information-ftc-committed-fully-enforcing-law-against-illegal (last accessed Nov. 15, 2022). 167 Id. As discussed above, the Department has long provided special protections for psychotherapy notes because of the sensitivity around this information. However, unlike psychotherapy notes, which by their very nature are easily segregated, reproductive health information is not easily segregated. Additionally, regulated entities generally do not have the ability to segment certain PHI such that regulated entities could afford special protections for specific categories of PHI. 168 Where such technology is available, it is generally cost prohibitive and burdensome to implement. 169 Therefore, the Department did not propose, and is not finalizing, a newly defined subset of PHI. Creating such a subset would create barriers to disclosing PHI for care coordination because the PHI would need to be segregated from the remaining medical record. Instead, consistent with the Privacy Rule's longstanding overall approach, 170 the Department is finalizing a purpose-based prohibition against certain uses and disclosures. This rule seeks to protect individuals' privacy interests in their PHI about reproductive health care and the interests of society in an effective health care system by enabling individuals and licensed health care professionals to make decisions about reproductive health care based on a complete medical record, while balancing those interests with other interests of society in obtaining PHI for certain non-health care purposes. 168 See Daniel M. Walker et al., “Interoperability in a Post- Roe Era Sustaining Progress While Protecting Reproductive Health Information,” JAMA (Nov. 1, 2022) (discussing that segregation of records for reproductive health care is more difficult than for SUD treatment records because “reproductive health services are often provided in the same settings as other primary and acute care and thus could be inferred or directly reflected in many parts of the record.”), https://jamanetwork-com.ezproxyhhs.nihlibrary.nih.gov/journals/jama/fullarticle/2797865; See, e.g., 87 FR 74216, 74221 (Dec. 2, 2022) (noting that 42 CFR part 2 previously resulted in the separation of SUD treatment records previous from other health records, which led to the creation of data “silos” that hampered the integration of SUD treatment records into covered entities' electronic record systems and billing processes. When considering amendments to the relevant statute, some lawmakers argued that the silos perpetuated negative stereotypes about persons with SUD and inhibited coordination of care during the opioid epidemic.). See also Health Info. Tech. Advisory Comm., “Health Information Technology Advisory Committee (HITAC) Annual Report for Fiscal Year 2019,” 2019 ONC Ann. Rep., at 37 (Feb. 19, 2020), https://www.healthit.gov/sites/default/files/page/2020-03/HITAC%20Annual%20Report%20for%20FY19_508.pdf (“The new certification criteria that support the sharing of data via third-party apps will help advance the use of data segmentation, but adoption of this capability by the industry is not yet widespread.”). 169 See 88 FR 23746, 23898 (Apr. 18, 2023) (explaining that while there are standards for security labels for document-based exchange that the Office of the National Coordinator for Health Information Technology (ONC) adopted in full in 2020 for the criteria in 45 CFR 170.315(b)(7) and (b)(8) to support the application of security labels at a granular level for sending in and receiving, standards to define the technical requirements for the actions described by the security label vocabularies do not yet exist. In the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule, published in 2020, ONC estimated a cost of the certification criteria and standards adopted for security labels in 45 CFR 170.315(b)(7) and (b)(8). The Department estimated the total cost to developers could range from $2,910,400 to $6,933,600 and that it would be a onetime cost. (85 FR 25926) The criteria do not include the ability for health IT to take the actions described by the security labels. Additionally, ONC did not require that health IT be certified to the criteria described above, making it essentially voluntary. Accordingly, the estimates for health IT developer and health care provider costs were likely significantly lower than they would have been if health IT were required to be certified to the criteria for participation. Thus, the total cost of implementing full segmentation capabilities is likely substantially higher than the per-product cost estimates provided by the Department in that rule). See also 88 FR 23746, 23875 (Apr. 18, 2023) (discussing examples of challenges or technical limitations to electronic health information segmentation that have been described to ONC). 170 See 64 FR 59918, at 59924, 59939, and 59955 (Nov. 3, 1999). To assist in effectuating this prohibition, the Department is also requiring regulated entities to obtain an attestation in certain circumstances from the person requesting the use or disclosure stating that the use or disclosure is not for a prohibited purpose. A person (including a regulated entity or someone who requests PHI) who knowingly and in violation of the Administrative Simplification provisions obtains or discloses IIHI relating to another individual would be subject to potential criminal liability. 171 Thus, a person who knowingly and in violation of HIPAA falsifies an attestation ( e.g., makes a material misrepresentation about the intended uses of the PHI requested) to obtain (or cause to be disclosed) an individual's IIHI could be subject to the criminal penalties provided by the statute. 172 Additionally, a regulated entity is subject to potential civil penalties for violations of the HIPAA Rules, including a failure to obtain a valid attestation before disclosing PHI, where an attestation is required. 173 The purpose-based prohibition, in concert with the attestation, will restrict the use and disclosure of PHI about lawful reproductive health care where the use or disclosure could harm HIPAA's overall goals of increasing trust in the health care system, improving health care quality, and protecting individual privacy. At the same time, it will allow uses and disclosures that either support those goals or do not substantially interfere with their achievement. 171 See 42 U.S.C. 1320d-6(a). 172 See 42 U.S.C. 1320d-6(b). 173 See 42 U.S.C. 1320d-5. See also 45 CFR part 160, subparts A, D, and E. Consistent with the Privacy Rule's approach, the Department is clarifying that the purpose-based prohibition applies only in certain circumstances, recognizing the in [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2024-08503. Public record. Not legal advice.