The U.S. Department of Health and Human Services Office for Civil Rights (OCR) recently released guidance extending Health Insurance Portability and Accountability Act Privacy Rule protections for family members to same-sex spouses, in light of the 2013 Supreme Court ruling in United States v. Windsor.

The HIPAA Privacy Rule grants consumers certain privacy rights with respect to their health information, including important controls over how their health information is used and disclosed by health plans and health care providers.  The Rule includes provisions allowing covered entities to share patient information with family members in some circumstances and prohibiting health plans from using or disclosing genetic information about family members for underwriting purposes.

OCR’s recent guidance, “HIPAA and Same-sex Marriage:  Understanding Spouse, Family Member, and Marriage in the Privacy Rule,” addresses the Windsor decision’s effect on HIPAA provisions relating to family members.  The guidance clarifies that, for purposes of the Privacy Rule, “spouse” includes both same-sex and opposite-sex individuals who are legally married.  The guidance also notes that the term “marriage” includes same-sex marriages, and “family member” includes dependents of those marriages.  All of these terms apply to all legally married individuals, even if the individual is living or receiving services in a jurisdiction that does not recognize same-sex marriage.

The guidance also addresses two specific HIPAA provisions altered by the updated definitions:

  • 45 C.F.R. § 165.510(b): this provision permits covered entities to share an individual’s protected health information with family members in some circumstances.  Legally married same-sex spouses are now considered family members for the purposes of this provision.
  • 45 C.F.R. §164.502(a)(5)(i): this provision prohibits health plans, other than issuers of long-term care policies, from using or disclosing genetic information of family members for underwriting purposes.  The definition of “family member” in this provision now includes same-sex spouses.

OCR’s guidance does not address whether a patient’s personal representative, authorized to act on the patient’s behalf when the patient is legally or otherwise incapable of exercising their rights, may include a same-sex spouse.  Generally, the Privacy Rule defers to state law to define who counts as a patient’s personal representative.  However, OCR has stated that it plans to issue further clarification regarding same-sex spouses as personal representatives under the Privacy Rule.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Covington Digital Health Team

Stakeholders across the healthcare, technology and communications industries seek to harness the power of data and information technology to improve the effectiveness and efficiency of their products, solutions and services, create new and cutting-edge innovations, and achieve better outcomes for patients. Partnering with…

Stakeholders across the healthcare, technology and communications industries seek to harness the power of data and information technology to improve the effectiveness and efficiency of their products, solutions and services, create new and cutting-edge innovations, and achieve better outcomes for patients. Partnering with lawyers who understand how the regulatory, IP, and commercial pieces of the digital health puzzle fit together is essential. Covington offers unsurpassed breadth and depth of expertise and experience concerning the legal, regulatory, and policy issues that affect digital health products and services. To learn more, click here.