Meghan O’Connor Quoted in Healthcare Risk Management Article About Purl Decision Impact on Reproductive Health HIPAA Compliance
Insight from Meghan O’Connor, co-chair of the Quarles & Brady Data Privacy & Security Industry Team, was included in a Healthcare Risk Management article about the significance of a Texas district court ruling regarding HIPAA compliance in reproductive health care.
The judge in Carmen Purl et al. v. U.S. Department of Health and Human Services et al vacated most of a Health and Human Services (HHS) rule that had tightened HIPAA privacy protections for reproductive health. The recent court ruling provides relief from the HHS rule to HIPAA-covered entities.
O’Connor outlined what this development means for these organizations in terms of HIPAA compliance. An excerpt:
HIPAA-covered entities should immediately stop using their attestation process for responding to reproductive health rule records requests, says Meghan O’Connor, JD, partner with the Quarles law firm in Milwaukee. “Covered entities should shift back to the HIPAA compliance obligations in place before the 2024 Reproductive Health Rule but post-Dobbs decision,” she says. “Understanding the compliance obligations sandwiched between the Dobbs decision and publication of the final HIPAA Reproductive Health Rule are key for covered entities because states (are) legislating regarding reproductive healthcare — sometimes falling within gender-affirming care — since Dobbs.”
Covered entities should revise workforce training materials — particularly role-based training for health information management, release of information (ROI), and legal departments — to account for new procedures, she says.
Covered entities also should update BAAs and other contracts, such as ROI vendors, as necessary to address changes in HIPAA but remain compliant under state law. “With the Purl order, enforcement of the HIPAA Reproductive Health Rule’s extra protections for reproductive health data is halted nationwide, effective immediately. However, the HIPAA Privacy Rule is still in effect, and entities subject to HIPAA must comply with its requirements regarding use and disclosure of protected health information when assessing law enforcement requests,” O’Connor says. “HIPAA still includes requirements for protected health information regarding reproductive health care.”
“While we do not have a crystal ball, there is potential for continued litigation. Certain stakeholders have noted that the Purl court’s decision that HHS lacked the specific congressional authorization to promulgate rulemaking regarding ‘politically favored medical procedures’ would not be preferable to the current administration, including as potential precedent for rulemaking regarding other types of potentially ‘political healthcare,’ such as gender-affirming care, vaccines, and in vitro fertilization,” O’Connor says. “While the time to appeal runs, stakeholders and lobbyists are considering opportunities to push the administration to appeal the Purl decision, arguing the appeal makes room for future rulemaking.”