Dobbs follow-up: First court decision addresses HIPAA's privacy provisions.

After the Supreme Court's Dobbs v. Jackson Women's Health Organization decision, which overruled Roe v. Wade, some states began enacting or enforcing restrictive reproductive health care laws. That spurred lots of people to become reacquainted with the extent of HIPAA's privacy provisions.

Reminder: HIPAA requires group health plans, business associates, hospitals and health care providers to protect employees' personal health information, unless courts and law enforcement agencies subpoena HIPAA-protected medical records. In addition, HIPAA doesn't override state criminal laws.

The first federal trial court to address how HIPAA's privacy provisions interact with a state's restrictive reproductive health laws has ruled HIPAA's privacy protections apply to forms health care providers in Kentucky are obliged to file because the data collected, although depersonalized, could still identify individual patients.

19 data elements

Kentucky law H.B. 3 (Ch. 210) requires health care providers performing abortions to complete various forms and send them to the Bureau of Vital Statistics. Patient information required to be disclosed includes:

* The pregnant patient's city or town, county, state, country of residence and zip code

* Their age, race and ethnicity

* Their pre-existing medical conditions

* Whether they returned for a follow-up examination and, if they did, the date and the results.

The forms and the law specifically prohibit the reporting of patients' names, Social Security numbers and driver's license numbers. A catch-all exception excluded from disclosure any other information that would make it possible to ascertain a patient's identity.

The plaintiffs in this lawsuit are health care providers. They want the reporting requirements tossed because they allegedly violate HIPAA's privacy provisions. The court compromised and acknowledged HIPAA's preemption of state law and H.B. 3's catchall exception to disclosure. Reading the two together, the court ruled the plaintiffs could complete the forms and leave out the identifying information without the risk of being fined.

Information...