{"id":23412,"date":"2024-05-13T09:32:03","date_gmt":"2024-05-13T13:32:03","guid":{"rendered":"https:\/\/healthit-gov.go-vip.net\/buzz-blog\/?p=23412"},"modified":"2026-01-17T21:35:23","modified_gmt":"2026-01-17T21:35:23","slug":"supporting-information-privacy-for-patients-now-and-always-four-reminders-of-how-hhs-information-blocking-regulations-recognize-privacy-rules","status":"publish","type":"post","link":"https:\/\/healthit.gov\/blog\/information-blocking\/supporting-information-privacy-for-patients-now-and-always-four-reminders-of-how-hhs-information-blocking-regulations-recognize-privacy-rules\/","title":{"rendered":"Supporting Information Privacy for Patients, Now and Always: Four Reminders of How HHS Information Blocking Regulations Recognize Privacy Rules"},"content":{"rendered":"\n

On April 22, 2024, the Biden-Harris Administration, through the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a final rule, entitled HIPAA Privacy Rule to Support Reproductive Health Care Privacy<\/em>. HHS issued this final rule after hearing from communities that changes were needed to better protect patient confidentiality and prevent medical records from being used against people for providing or obtaining lawful reproductive health care. The final rule strengthens the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule by prohibiting the disclosure of protected health information (PHI) where the PHI is sought for use against any person for merely seeking, obtaining, providing, or facilitating lawful reproductive health care. The Office of the National Coordinator for Health Information Technology (ONC) and OCR work together on all of our policies, and the development of this final rule was no different. As I discuss below, ONC\u2019s information blocking regulations consider applicable law<\/a>, and that now includes the HIPAA Privacy Rule to Support Reproductive Health Care Privacy Final Rule. <\/em>In short, complying with this new federal rule will not <\/u><\/strong>result in a determination of information blocking under ONC\u2019s regulations.
<\/p>\n\n\n\n

Reminder 1: The information blocking regulations are designed to consider applicable law, including HIPAA rules.<\/h2>\n\n\n\n

ONC\u2019s information blocking regulations advance the access, exchange, and use of electronic health information<\/a> (EHI) as defined <\/a>in the information blocking regulations<\/a>. Many information blocking \u201cactors\u201d (IB actors) (as defined)<\/a> are also subject to the HIPAA Privacy Rule. An IB actor may also need to comply with other federal, state, or tribal laws that prohibit or place additional preconditions on sharing EHI in circumstances where these other laws apply. ONC designed the information blocking regulations to accommodate these IB actors\u2019 needs to comply with the HIPAA Privacy Rule and other privacy laws.<\/p>\n\n\n\n

Reminder # 2: When sharing EHI would violate another law that applies to an IB actor, it is not<\/u> information blocking when the IB actor follows that law and does not share the EHI.<\/h2>\n\n\n\n

The information blocking<\/a> definition (45 CFR 171.103<\/a>) excludes practices likely to interfere with access, exchange, or use of EHI when the practices are required by law<\/em>. The 21st Century Cures Act:  Interoperability, Information Blocking, and the ONC Health IT Certification Program final rule (ONC Cures Act Final Rule) explained that this reference to \u201crequired by law\u201d includes practices required by Federal and State law, including statutes, regulations, court orders, and binding administrative decisions or settlements. It also includes tribal laws where applicable. (85 FR 25794<\/a>)<\/p>\n\n\n\n

Interferences with EHI access, exchange, or use that are required by law include (among other mandatory practices) compliance with a prohibition on using or disclosing EHI for a particular purpose. The HIPAA Privacy Rule to Support Reproductive Health Care Privacy <\/em>final rule establishes a new prohibition (in 45 CFR 164.502(a)(5)(iii)(A)<\/a>) on HIPAA regulated entities using or disclosing PHI for any of the following activities:<\/p>\n\n\n\n