New HIPAA Protections for
Reproductive Health PHI
After the Supreme Court’s 2022 decision in Dobbs v. Jackson Women’s Health Organization, federal agencies were directed to research what could be done to protect women’s health and privacy. HHS has consequently released HIPAA guidance related to reproductive health care services under a health plan, with a focus on the information required to be disclosed by law. In August 2024, a Final Rule was released that changes specific provisions of the Health Insurance Portability and Accountability Act of 1996 and it’s implementing regulations to support reproductive healthcare privacy.
The Final Rule became effective on June 25, 2024, and applies to covered healthcare providers, health plans, healthcare clearinghouses, and their business associates (collectively, Regulated Entities). The Final Rule seeks to further protect the privacy of a person legally seeking abortion-related services by explicitly prohibiting the use or disclosure of protected health information by Regulated Entities for:
- Conducting a criminal or administrative investigation into any person for seeking, obtaining, providing, or facilitating reproductive health care where such health care is lawful;
- Imposing criminal, civil, or administrative liability on any person for the act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful; and/or
- Identifying any person for the purpose of conducting an investigation or imposing liability.
The prohibition on using or disclosing PHI applies where the health care provided is lawful under federal law or the state’s laws. The prohibition preempts state laws mandating the use or disclosure of PHI under a court order or other legal process for a prohibited purpose. The prohibition applies where a Regulated Entity has reasonably determined that:
- Reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided; or
- Reproductive health care is protected, required, or authorized by federal law, including the U.S. Constitution, regardless of the state in which health care is provided; and/or
- The reproductive health care was provided by a person other than the Regulated Entity that receives the request for PHI, and the presumption is that the care provided was lawful.
If any of these conditions are not satisfied (for example, if the Regulated Entity knows the reproductive health care to have been delivered unlawfully), then the Final Rule’s protections would not apply. In addition, even if disclosure is allowed under the final rule, disclosures of PHI for reproductive health care must:
- Comply with the new prohibitions;
- Be required by law; and
- Meet all conditions of the HIPAA privacy rule.
HIPAA allows PHI to be used or disclosed for a finite number of additional reasons listed in the privacy rule. For example, it may be used so that a provider can defend itself in a criminal, civil, or administrative proceeding seeking to impose liability for reproductive health care services. The Final Rule provides that covered entities and their business associates may continue to use or disclose PHI for those permitted purposes, as long as the use or disclosure is not prohibited by one of the new provisions.
To help facilitate compliance with the Final Rule and assist Regulated Entities in determining when a use/disclosure of PHI is permissible, this new guidance requires that such entities obtain a signed and dated attestation from the person or entity requesting PHI potentially related to reproductive health care for (1) health care oversight activities, (2) judicial and administrative proceedings, (3) law enforcement purposes, and (4) disclosures to coroners and medical examiners. HHS has now provided a model attestation, which can be accessed here.
Finally, the Final Rule requires that health care providers, health plans, and health care clearinghouses revise their Notice of Privacy Practices to strengthen privacy. Specifically, they must revise their NPPs to inform individuals about how their PHI may or may not be used or disclosed and provide examples. Regulated entities have until February 26, 2026 to make these updates:
- Update HIPAA Policies and Procedures and NPPs.
- Incorporation Use of a compliant Attestation.
- Update Compliance Training form requirement.
As indicated earlier, Regulated Entities must comply with most aspects of this new guidance by December 23, 2024, but have until February 2026 to update the Notice of Privacy Practices. Moreton will be providing updated information as more information is available.
Stay Interviews
Conducting exit interviews are often viewed in the same light as visiting your favorite medical provider: usually helpful, but typically not a lot of fun. Although exit interviews can be a hassle, they can reveal important information regarding the health of an organization. And just like advice from a provider, the key is how you act on the advice received. If the feedback gained from an exit interview is not acted upon, it becomes a useless exercise.
Many feel that exit interviews come too late in the employee timeline to be truly beneficial. After all, the employee is already leaving when these questions are asked. This is why “Stay Interviews” have become increasingly common in business. While these are nearly identical to exit interviews in terms of the format and questions asked, they serve slightly different purposes.
Are They Worth Doing?
While Stay Interviews can act as a powerful retention tool for talented employees, cutting down on training costs, exit interviews can often prompt more honest, uninhibited answers, which can provide a perspective that would not otherwise be seen. Conducting either type of interview provides many benefits, including:
Insights: They can be a valuable resource for a company to improve employee satisfaction and retention. Your employees have a different perspective on the company than management, which means they may be privy to issues with company policies, culture, personnel, management, or ethics that decision-makers were not aware of. This can be a treasure-trove of valuable information to help prevent future turnover.
Improvements: Employees who are leaving the company are often more likely to be candid about why they are leaving the company, which can provide a road map to improving operations for future employees. Employees participating in Stay Interviews may be slightly more reserved in their responses, but they are more likely to be invested in any future improvements that occur as a result of their feedback.
Protection: These interviews can also uncover harassment or other legal concerns and allow the employer to take action before the former employee turns to litigation. If the employee perceives that his or her claim is being taken seriously and that action will be taken, the employee may not be inclined to leave the company or pursue legal action. In these cases, it is important to fully document the interview and any steps taken thereafter.
The Format
Stay Interviews should be structured in the way that best fits your company and culture. For some, that may involve an anonymous survey form through a company intranet. For others, an in-person, informal dialogue helps to build trust and communication between management and their employees. Whatever format is chosen, it’s important to ask a wide range of questions to allow for many different types and areas of feedback. When available, as with in-person interviews, ask follow-up questions for clarification and better understanding.
Here are just a few ideas for relevant and appropriate questions to ask:
-
- Why have you decided to leave the company?
- What does the new company/position offer that we don’t?
- What could we have done to retain you?
- How was your relationship with your manager/supervisor?
- Were your manager’s expectations of you clearly articulated?
- Were you comfortable talking with your manager about any concerns you had?
- What could he or she have done differently or better?
- Did you receive adequate training to do your job properly?
- Did you receive adequate feedback on your performance?
- Did you feel valued here?
- What were the best and worst aspects of your job?
- What improvements do you suggest to make this job better, more challenging and/or more interesting?
- How would you describe (and how do you feel about) our company culture?
- How can we improve employee morale and engagement?
- What other suggestions do you have for the company?
- Would you consider working for this company again in the future?
- Would you recommend it as a good place to work for your friends and family?
- Did you ever witness or experience any behavior that you felt was inappropriate or unethical? If so, did you report your concerns to management?
Ongoing Communication
Open and honest dialogue between employees of all levels and decision-makers creates a culture of improvement that can increased retention. Exit interviews are a valuable tool, but should not be the first time you collect feedback from employees. Stay Interviews can help you keep in touch with the inner workings of your organization, while helping employees to feel that their voice has been heard.
