Last year, the U.S. Supreme Court ruled in United States v. Windsor that same-sex couples be treated the same as married opposite-sex couples when it comes to federal benefits. In addition to changing the coverage for certain employee benefit plans, the ruling impacts the application of many federal laws, including the HIPAA Privacy Rule.
The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has published guidance to help “covered entities” understand how the Supreme Court decision impacts their responsibilities under the HIPAA Privacy Rule. Covered entities include hospitals, academic medical centers, physicians, clinics, psychologists, dentists, chiropractors, nursing homes, pharmacies, and local health department health care clinics, that transmit electronic claims transactions. They also include health insurance companies, HMOs, ACOs, company health plans, Medicare and Medicaid. Health care clearinghouses, such as billing services, medical repricing companies, and community health management information systems, also fall under covered entities..
These entities are subject to the HIPAA Privacy Rule, which protects a patient’s identifiable health information (e.g., medical records, billing information, and conversations with doctors), by regulating disclosure of the patient information. The patient is guaranteed access to his or her health information and the covered entity is allowed to disclose certain information to the patient’s spouse and family members as long as the patient does not object to the disclosure. This allows those who are involved in a patient’s care to obtain important health information and work with the health care provider for the patient’s benefit. The OCR’s guidance reveals how the Supreme Court’s Windsor decision has broadened the scope of who a covered entity can disclose patient health information under the Privacy Rule.
The OCR makes clear that when the term “spouse” is found in the Privacy Rule it “includes individuals who are in a legally valid same-sex marriage sanctioned by a state, territory, or foreign jurisdiction (as long as, as to marriages performed in a foreign jurisdiction, a U.S. jurisdiction would also recognize the marriage).” Additionally, the guidance clarifies that the term “marriage” covers “both same-sex and opposite-sex marriages” and “family member” includes dependents of same-sex as well as opposite-sex marriages. Importantly, OCR’s guidance also states that all the terms “apply to individuals who are legally married, whether or not they live or receive services in a jurisdiction that recognizes their marriage.”
Covered entities that follow the guidance will avoid instances of failing to disclose a patient’s health information to the patient’s same sex spouse. Such an instance was recently reported in Ohio where a local hospital denied a woman access to her spouse’s medical records after her spouse’s death. According to a news report, North Bethesda Hospital cited state and federal privacy rules for its failure to disclose the information. Hopefully, the new guidance will help patients and their spouses access necessary health information and improve the patient’s care.
OCR also notes that it intends to issue additional guidance or begin rulemaking to address same-sex spouses as personal representatives under the Privacy Rule. Finally, those who believe their(or someone else’s) health information privacy rights under HIPAA have been violated, may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
This blog post was prepared by Andy Baker-White, J.D., M.P.H., associate director for the Network for Public Health Law – Mid-States Region at the University of Michigan School of Public Health.
The Network for Public Health Law provides information and technical assistance on issues related to public health. The legal information and assistance provided in this document does not constitute legal advice or legal representation. For legal advice, readers should consult a lawyer in their state.
Support for the Network is provided by the Robert Wood Johnson Foundation (RWJF). The views expressed in this post do not necessarily represent the views of, and should not be attributed to, RWJF