HHS Guidance Recognizes HIPAA Privacy Rights of Same-Sex Spouses and Dependents

On September 17^th, the Department of Health and Human Services Office for Civil Rights (“HHS”) issued guidance to assist covered entities and business associates in complying with the privacy requirements under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) following the decision issued by the Supreme Court in United States v. Windsor.  The guidance clarifies that same-sex spouses, determined under the “state of celebration rule,” must be afforded the same privacy rights as opposite-sex spouses.

The guidance from HHS clarifies that for purposes of the HIPAA privacy rules, the term “spouse” includes individuals who are in a legally valid same-sex marriage sanctioned by a state, territory or foreign jurisdiction (as long as a U.S. jurisdiction would also recognize the marriage) whether or not they live or receive services in a jurisdiction that recognizes their marriage.  Similarly, the guidance provides that the term “marriage” includes both same-sex and opposite-sex marriages.  Finally, the guidance recognizes that the term “family member” includes dependents from those marriages.

In the guidance, HHS describes two specific areas in which these definitions are relevant.  First, HHS indicates that legally married same-sex spouses must be considered spouses for purposes of 45 CFR § 164.510(b) which permits the use and disclosure of protected health information to family members when relevant to the family member’s involvement with care or payment or to facilitate notification of family members regarding the individual’s location, general condition or death.

Second, the guidance indicates that the definitions are relevant in applying the rules under 45 CFR § 164.502(a)(5)(i) which prohibits health plans, other than issuers of long-term care policies, from using and disclosing genetic information for underwriting purposes pursuant to the Genetic Information Nondiscrimination Act of 2008 (“GINA”).  HHS clarifies that a same-sex spouse must be considered a family member for purposes of the GINA rule prohibiting plans from using information regarding the genetic tests of family members or the manifestation of a disease or disorder in a family member in making underwriting decisions.

Finally, HHS announced that it intends to issue additional clarifications addressing same-sex spouses as personal representatives under the privacy rules.  In the meantime, covered entities and business associates should review their practices, policies, contracts and other documents to confirm that they are in compliance with this guidance.