Early 2017 has brought notable developments regarding the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and related rules. The Department of Health and Human Services, Office of Civil Right (“HHS”) has clarified that rules related to disclosure of patient information are not restricted or affected by the sex or gender of either the patient or the potential recipient.

The HIPAA Privacy Rule contains several provisions that recognize the integral role that family members, such as spouses, often play in a patient’s health care.  For example, the Privacy Rule allows covered entities to share information about the patient’s care with family members in various circumstances. The Privacy Rule also places restrictions upon whom health care providers may share a patient’s Protected Health Information (“PHI”).

On June 26, 2013, in United States v. Windsor, the Supreme Court held section 3 of the Defense of Marriage Act (DOMA), which provided that federal law would only recognize opposite-sex marriage, to be unconstitutional. Two years later, on June 26, 2015, in Obergefell v. Hodges, the Court held that the Fourteenth Amendment requires a state to license a marriage between two people of the same sex and to recognize same-sex marriages lawfully performed in other States.

After the Supreme Courts’ decisions in Windsor and Obergefell, the HIPAA Privacy Rule at 45 CFR 164.510(b) permits covered entities to share with an individual’s family member, other relative, close personal friend, or any other person identified by the individual, the information directly relevant to the involvement of that person in the patient’s care or payment for health care, without regard to the sex of the patient or the patient’s spouse/representative.

When making disclosures to the persons listed under 45 CFR 164.510(b), a covered entity should get verbal permission from the patient when possible, or otherwise be able to reasonably infer that the patient does not object to the disclosure, before disclosing information to these persons.  If the patient is incapacitated or not available, a covered entity may share information when, in its professional judgment, doing so is in the patient’s best interest.  Finally, if the individual is deceased, a covered entity may share information with a person who was involved in the individual’s care or payment for care prior to the individual’s death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

HHS issued a FAQ emphasizing that HIPAA does not limit any permitted disclosures based on the sex or gender identity of the recipient of the information. The HHS’s FAQ may be found here.

For more information about the new changes to the HIPAA Privacy Rule, contact Bill Kalogredis, Esq. (610) 701-4402 bkalogredis@lambmcerlane.com or Katie LaDow, Esq. (610) 701-3261 kladow@lambmcerlane.com.

Vasilios (“Bill”) J. Kalogredis is Chairman of Lamb McErlane’s Health Law Department. Bill has been practicing health law for over 40 years, representing exclusively physicians, dentists, group practices, other health care professionals and health care-related entities.

*Katherine (“Katie”) E. LaDow, Esquire, an associate with Lamb McErlane P.C., contributed to this article. Katie is an associate in the litigation department. She concentrates her practice in the areas of state civil litigation, family law and health law.