The U.S. Department of Health and Human Services Office for Civil Rights (OCR) recently released guidance extending Health Insurance Portability and Accountability Act Privacy Rule protections for family members to same-sex spouses, in light of the 2013 Supreme Court ruling in United States v. Windsor.

The HIPAA Privacy Rule grants consumers certain privacy rights with respect to their health information, including important controls over how their health information is used and disclosed by health plans and health care providers.  The Rule includes provisions allowing covered entities to share patient information with family members in some circumstances and prohibiting health plans from using or disclosing genetic information about family members for underwriting purposes.

OCR’s recent guidance, “HIPAA and Same-sex Marriage:  Understanding Spouse, Family Member, and Marriage in the Privacy Rule,” addresses the Windsor decision’s effect on HIPAA provisions relating to family members.  The guidance clarifies that, for purposes of the Privacy Rule, “spouse” includes both same-sex and opposite-sex individuals who are legally married.  The guidance also notes that the term “marriage” includes same-sex marriages, and “family member” includes dependents of those marriages.  All of these terms apply to all legally married individuals, even if the individual is living or receiving services in a jurisdiction that does not recognize same-sex marriage.

The guidance also addresses two specific HIPAA provisions altered by the updated definitions:

• 45 C.F.R. § 165.510(b): this provision permits covered entities to share an individual’s protected health information with family members in some circumstances.  Legally married same-sex spouses are now considered family members for the purposes of this provision.
• 45 C.F.R. §164.502(a)(5)(i): this provision prohibits health plans, other than issuers of long-term care policies, from using or disclosing genetic information of family members for underwriting purposes.  The definition of “family member” in this provision now includes same-sex spouses.

OCR’s guidance does not address whether a patient’s personal representative, authorized to act on the patient’s behalf when the patient is legally or otherwise incapable of exercising their rights, may include a same-sex spouse.  Generally, the Privacy Rule defers to state law to define who counts as a patient’s personal representative.  However, OCR has stated that it plans to issue further clarification regarding same-sex spouses as personal representatives under the Privacy Rule.