New Guidance on HIPAA and Same-Sex Marriage
On September 17, 2014, the Office for Civil Rights (“OCR”) published new guidance (the “Guidance”) regarding certain HIPAA provisions in light of the Supreme Court ruling in United States v. Windsor, in which the Court found section 3 of the Defense of Marriage Act—which defined marriage and spouse to exclude same-sex partners—unconstitutional.
The Guidance focuses on the definition of “family member” in 45 CFR 160.103. Following the decision, the term “spouse” encompasses individuals who are in a “legally valid same-sex marriage sanctioned by a state, territory, or foreign jurisdiction”; the term marriage includes both same-sex and opposite-sex marriages; and that the term “family members” includes dependents of both same-sex and opposite-sex marriages. Importantly, these terms apply whether or not the legally married couple lives or receives services in a state that recognizes same-sex marriages.
The Guidance discusses two key HIPAA provisions affected by this definition.
- Section 164.510(b) permits disclosure and notification of patient information to family members under certain circumstances. The Guidance clarifies that “[l]egally married same-sex spouses, regardless of where they live, are family members for the purposes of applying this provision.”
- Section 164.502(a)(5)(i) prohibits a health plan (excluding certain issuers of long-term care policies) from using or disclosing genetic information for underwriting purposes. The Guidance clarifies that genetic tests related to or genetic disease of family members—including an individual’s same-sex spouse—cannot be used in making underwriting decisions for the individual.
All covered entities and business associates—regardless of the legality of same-sex marriage in the state of operation—should take note of these requirements, and respond accordingly. This may include clarification of these standards with staff and updating HIPAA policies as needed. In addition, stay tuned for further updates in coming months from OCR relating to same-sex spouses as personal representatives under the Privacy Rule.