Ensuring the privacy of pregnancy termination or loss information under the HIPAA privacy regulations and the HITECH Act

(a)

In general

(1)

Prohibition on disclosure

Subject to paragraph (2) and nothwithstanding any provision in regulations promulgated pursuant to section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191), a covered entity or business associate of such entity may not disclose pregnancy termination or loss information of an individual in Federal, State, local, or tribal proceedings, including civil, criminal, administrative, legislative, or other proceedings, without the valid authorization of the individual made in accordance with section 164.508 of title 45, Code of Federal Regulations. (2)

Exceptions

Paragraph (1) shall not apply in the case of a disclosure of pregnancy termination or loss information of an individual by a covered entity or business associate of a covered entity if— (A)such information is necessary for use in defense of a professional liability action or proceeding against the covered entity or business associate and such information is disclosed by— (i)the covered entity or business associate to such covered entity’s or business associate’s attorney or professional liability insurer or insurer’s agent; or (ii)the authorized attorney of such covered entity or business associate to a court or body hearing such action or proceeding; or (B)such information is necessary to— (i)investigate physical harm to such individual by another person directly relating to the loss or termination of the pregnancy; and (ii)such individual is unable to provide consent due to death or incapacity. (b)

HITECH

(1)

Privacy exception

The Secretary of Health and Human Services shall revise section 171.202 of title 45, Code of Federal Regulations, to clarify that an entity’s practice of not fulfilling a request to access, exchange, or use electronic health information in order to comply with subsection (a) will not be considered information blocking (as defined for purposes of such section) if such information is pregnancy termination or loss information. (2)

Greater security

The Secretary of Health and Human Services shall revise section 170.401 of title 45, Code of Federal Regulations, to require that as a condition of certification (as described in such section), a health IT developer (as so described) shall implement practices that allow for the segregation of data related to pregnancy termination or loss information to ensure compliance with subsection (a). (c)

Modification of state preemption exceptions

(1)

In general

The provisions of this section shall preempt any State law to the extent such law conflicts with or prevents application of this section. Nothing in the preceding sentence shall be construed to preempt a State law to the extent that such law provides greater privacy protections for pregnancy termination or loss information than provided under this section. (2)

Modification

The Secretary of Health and Human Services shall revise section 160.203 of title 45, Code of Federal Regulations (or a successor regulation), to ensure that no exception to the general preemption rule stated in such section applies with respect to pregnancy termination or loss information other than the exception under the second sentence of paragraph (1). (d)

Outreach

The Secretary of Health and Human Services shall conduct an outreach campaign to covered entities and business associates of such entities to ensure that such entities and associates are aware of the requirements of this section and any changes to regulations made pursuant to this section. (e)

Procedure

Any revisions to regulations required by application of this section shall be made by notice in the Federal Register published not later than 3 months after the date of the enactment of this section as an interim final rule. The Secretary of Health and Human Services shall, after providing opportunity for public comment, finalize any such interim final rule not later than 9 months after such interim final rule is published with such modifications as the Secretary determines appropriate. (f)

Definitions

In this section: (1)

HIPAA terms

The terms business associate, covered entity, and protected health information have the meaning given such terms for purposes of the regulations described in subsection (a)(1). (2)

Pregnancy termination or loss information

The term pregnancy termination or loss information means protected health information of an individual that relates to information that could reveal having or seeking an abortion or care for pregnancy loss, including without limitation, any request for or receipt of items, services, education, counseling, or referrals relating to the termination or loss of a pregnancy of such individual, including abortion, miscarriage, stillbirth, and ectopic pregnancy.