Lawmakers urge HHS to expand HIPAA privacy regulations

Written by Abby Grifno | July 26, 2023

In a recent letter to the Biden administration, several senators suggest that handing over PHI information should require a warrant.

What happened

The U.S. Department of Health and Human Services (HHS) issued a Notice of Proposed Rulemaking in April 2023, designed to strengthen the HIPAA Privacy Rule by prohibiting the use of protected health information (PHI) to investigate or prosecute patients and their reproductive healthcare providers.

The proposal came after the Supreme Court’s Decision in Dobbs v. Jackson, overruling federal rights to abortion and leaving it up to states to regulate access. The ruling subsequently triggered the enactment of many state laws that ban or restrict abortion.

Now, many lawmakers suggest that HIPAA regulations don’t do enough to protect patient privacy and that even the Notice of Prosed Rulemaking isn’t sufficient to protect reproductive healthcare information.

In a letter to HHS Secretary Xaviar Beccera, Senators Ron Wyden (D-OR), Patty Murray (D-WA), and Representative Sara Jacobs (D-CA) asked HHS to expand requirements under HIPAA so that all PHI is given the same privacy protections.

Going deeper

The lawmakers are specifically asking for the following:

Requiring law enforcement agencies to obtain a warrant before asking health care providers to turn over PHI. This request would ensure PHI is rightfully protected under the Fourth Amendment and would be consistent with current protections of other sensitive data.
Requiring a warrant before PHI can be shared with additional law enforcement agencies to further ensure that PHI is rightfully protected under the Fourth Amendment.
Requiring that patients be notified when their PHI is disclosed to law enforcement. This change would ensure consistency with other privacy regulations (such as for wiretapping and bank subpoenas).

What was said

Alongside their requests, the lawmakers stated that “Americans should be able to trust that the information they share in confidence with their doctors when seeking care will receive the highest protections under the law, regardless of the specific medical issue.” The lawmakers also said that current privacy protections are “woefully insufficient.”

The letter explained that current doctors cannot be forced to testify, but the same information can be subpoenaed by law enforcement without showing probable cause. “The ability of law enforcement agencies to subpoena these records undermines patients’ legal protections, particularly in an era of digital health records, where every patient interaction is carefully documented,” the letter read.

The big picture

Requiring a warrant for law enforcement agencies to obtain PHI would create more oversight and ensure privacy protections are at the forefront of legal matters.

To lawmakers, passing these more stringent requirements would help stop the lag in privacy regulations as laws and technology continue to evolve.

View full post