The Department of Health and Human Services Office for Civil Rights (OCR) issued written guidance on Sept. 17, 2014, which stated that covered entities (e.g., health care providers and health plans) and their business associates have the same obligations under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to couples in legally valid same-sex marriages as to couples in opposite-sex marriages.
The guidance stated that consistent with a recent United States Supreme Court case which ruled that the federal Defense of Marriage Act was unconstitutional, a “spouse,” as used in the HIPAA privacy rule, “includes individuals who are in a legally valid same-sex marriage sanctioned by a state, territory, or foreign jurisdiction (as long as, as to marriages performed in a foreign jurisdiction, a U.S. jurisdiction would also recognize the marriage).” The guidance further provides that “marriage” includes “both same-sex and opposite-sex marriages,” and that “family member” includes dependents of those marriages.
The significance of this guidance relates to the definition of those persons who, under HIPAA, are included under the term “family.” Under the HIPAA regulations, a covered entity, such as a physician or hospital, may disclose to a “family member,” other relatives, close personal friends of the individual, or any other person identified by the individual, the protected health information directly relevant to such person’s involvement with the individual’s care or payment related to the individual’s health care. Protected health information may also be disclosed to notify or assist in notifying an individual’s “family member” and certain other persons. The guidance makes it clear that “family member” for these purposes includes a person to whom the individual was validly married, including a valid same-sex marriage.
This guidance will have significance both in states which recognize same-sex marriages and those which do not. For example, if a same-sex couple marries in a state that recognizes same-sex marriage and then moves to (or is temporarily present in) a state such as Ohio, which does not recognize same-sex marriages, then for HIPAA purposes, health care providers, health plans and business associates must treat them as they would treat any married couple.
For more information, please contact:
John T. Mulligan
Rick L. Hindmand
Bridget C. Howard
McDonald Hopkins has a large and diverse healthcare practice, which is national in scope. The firm represents a wide variety of healthcare providers, facilities, vendors, technology companies and associations. Our diverse experience enables us to give our clients a unique perspective on the issues that may confront them in the rapidly evolving healthcare environment.