HIPAA’s reproductive health proposal asked records to know what they hold

The week

On April 17, 2023, the HHS Office for Civil Rights published in the Federal Register a proposed amendment to the HIPAA Privacy Rule, announced the previous week. It would bar covered entities and business associates from using or disclosing protected health information to investigate or impose liability on anyone for seeking, obtaining, providing or facilitating reproductive health care that was lawful where it was provided. Some requests for information potentially related to reproductive health care would need a signed attestation that the purpose was not prohibited. These included requests for health oversight, judicial and administrative proceedings, law enforcement, and coroners and medical examiners. The proposal followed the Supreme Court’s June 2022 decision in Dobbs v. Jackson Women’s Health Organization and the state abortion laws that changed after it. Comments were due on June 16.

Debate about the proposal centered on federal authority and its interaction with state law. Those are questions for courts and counsel. For health system technology leaders, the proposal carried an assumption that would outlast any version of the rule. It assumed a hospital could tell which parts of a patient’s record related to reproductive health care, and treat those parts differently. A purpose-based rule depends on that, because a request for a whole chart has to be answered by deciding which pages are at issue. That capability, usually called data segmentation, breaks into three tasks with different owners and different limits: identifying the information, enforcing a policy on it inside the organization’s own systems, and keeping that policy attached when data leaves automatically.

Identifying the information

Reproductive health information is not stored in one place. It appears in diagnosis and procedure codes, medication lists, lab results, problem lists, clinical notes, imaging reports, scheduling records, claims and referral letters. Much of it is ambiguous. A pregnancy test is routine in an emergency department workup. Methotrexate treats rheumatoid arthritis as well as ectopic pregnancy. A note about an unrelated visit may mention a past pregnancy loss in a single line. Code lists therefore flag too much and too little at the same time.

Electronic health records already supported some sensitivity flags. Substance use disorder records under 42 CFR Part 2, psychotherapy notes and confidential adolescent encounters were common examples. Most of these depended on a clinician or registrar applying the flag at the time of entry, and practice varied widely between departments.

A workable approach combines three methods. A named clinical informatics owner maintains value sets of diagnosis, procedure, medication and lab codes, with documented reasons for each inclusion. Text analysis, including natural language processing, finds mentions in notes and scanned documents that codes miss. Clinicians review a sample of the results to measure how often the classifier is wrong in each direction. Historical records are the hardest part. Labeling new data at entry is manageable. Labeling years of existing notes requires batch processing and a decision about how far back to go.

Every classifier makes errors, so the organization has to choose which error it prefers. Missing sensitive content exposes patients. Over-labeling can hide information clinicians need, such as a prior pregnancy complication relevant to surgery. That trade-off belongs to clinical leadership and the privacy officer together, and it should be written down with the error rates that informed it.

Enforcing a policy inside the organization

A label is only useful if something acts on it. Inside a health system there are three main places where it can. Clinical access is the first. Care teams generally need to see the whole record, so labels there usually trigger an audit trail or a break-the-glass prompt rather than a block. Disclosure for purposes other than treatment is the second, and the one the proposal targeted. Release-of-information staff answering a subpoena or an investigator’s request cannot read every page of a long chart for every request. A label lets the system show them which documents need a purpose check and an attestation, so staff can review those documents and nothing else.

Proxy and portal access is the third, and the least discussed. The same labels decide what a parent sees in a teenager’s portal and what a caregiver with proxy access can open. A segmentation project that ignores the portal can produce a release desk that withholds correctly while the patient app shows everything.

Each of these needs measurement. Useful figures include the share of release requests where the system identified sensitive documents automatically, the review time per request, and the number of labeled documents disclosed without a recorded purpose check. Vendors that handle release of information, coding or transcription as business associates need the same labels and the same workflow. Otherwise the control stops at the organization’s edge.

Keeping the policy attached when data leaves

Much health data leaves without anyone handling a request. Records flow to health information exchanges and national exchange networks, to payers with claims and attachments, to public health registries, to prescription drug monitoring programs, and to apps patients choose through federally required interfaces. These flows exist to move whole records or standard summaries quickly, and they do it well.

HL7 standards include ways to attach security labels to data, and a data segmentation for privacy specification had existed for years. Adoption was thin. A label only protects information if the receiving system reads it and honors it. Many receivers ignore labels or strip them when they reformat data. A health system therefore depends on its EHR vendor, its exchange partners and their downstream recipients, not just on its own configuration.

Withholding data also carries legal risk of its own. Federal information blocking rules penalize interfering with access to electronic health information unless an exception applies. A decision to exclude certain document types from automated exchange needs counsel’s review against those exceptions, as well as clinical review of the effect on care elsewhere.

The practical step in 2023 was an inventory of outbound interfaces. For each one, it recorded what data the interface sends, whether it can carry or filter by label, and who could change it. That list shows which flows can enforce a policy now and which depend on vendor roadmaps. It also gives procurement a specific request for every EHR and exchange contract renewal. The same three tasks apply to Part 2 records, behavioral health, HIV status and gender-affirming care. A health system that builds identification, enforcement and propagation once can apply them to each category as the law requires.

With hindsight

OCR finalized the rule in April 2024, with compliance required from December 2024. In June 2025 a federal court in Texas vacated most of it nationwide, holding that HHS had exceeded its authority. The segmentation problem did not go away. California’s AB 352, enacted in 2023, required EHR developers and other businesses storing medical information for California providers to build capabilities to segregate and limit access to sensitive services data by July 2024. Other states passed their own shield laws. In December 2024 federal health IT regulators added a Protecting Care Access exception to the information blocking rules, which recognized that withholding some reproductive health data could be justified. The 2024 Part 2 final rule, with compliance due in February 2026, kept substance use records on the same path. Labeling has improved inside EHRs. Automated exchange still moves most records with little regard for labels.