HHS Issues Guidance on HIPAA and Same-Sex Marriage

On September 17, the Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) issued guidance to assist covered entities and business associates in understanding their obligations under the privacy rule. The guidance follows the U.S. Supreme Court’s June 2013 decision in United States v. Windsor, which held that Section 3 of the Defense of Marriage Act (DOMA) – a provision that said federal law recognizes only opposite-sex marriages – is unconstitutional.  As a result of the Supreme Court’s decision, covered entities and business associates must consider their privacy rule obligations regarding lawfully married same-sex spouses and same-sex marriage.

OCR’s guidance clarifies the terms “spouse,” “marriage,” and “family member” as these terms are used in 45 C.F.R. § 160.103.  Based on the Supreme Court’s decision, OCR states tha

t the term “spouse” includes individuals who are in a legally valid same-sex marriage sanctioned by a state, territory, or foreign jurisdiction (as long as a U.S. jurisdiction would recognize a marriage performed in a foreign jurisdiction).  OCR clarifies that the term “marriage” includes same-sex and opposite-sex marriages, and “family member” includes dependents of those marriages.  Finally, OCR states that these terms apply to individuals who are legally married, whether or not they live or receive services in a jurisdiction that recognizes their marriage.

These definitions are relevant to the application of at least two sections of the Health Insurance Portability and Accountability Act (HIPAA) privacy rule.  The definition of “family member” is relevant to the application of 45 C.F.R. § 164.510(b), which relates to sharing an individual’s protected health information with a family member.  According to OCR, legally married same-sex spouses, regardless of where they live, are family members for the purposes of applying this provision.  The definition of “family member” also applies to 45 C.F.R. § 164.502(a)(5)(i), relating to use and disclosure of genetic information for underwriting purposes.

OCR indicates that it plans to issue additional clarifications through guidance or to initiate rulemaking to address same-sex spouses as personal representatives under the privacy rule.

Covered entities and business associates should provide training on this guidance, as well as update policies and procedures.