Health Information Compliance Alert

OCR augments the definitions of spouse, marriage, and family member.

The U.S. Supreme Court ruled last year that federal law cannot disregard same-sex marriage. Since the ruling, the federal government has been mum on how this would affect HIPAA, but new guidance has finally come through.

On Sept. 17, the HHS Office for Civil Rights (OCR) released guidance to help covered entities (CEs) understand how the United States v. Windsor Supreme Court decision may affect certain HIPAA Privacy Rule requirements. In the Windsor case, the Supreme Court ruled that the Defense of Marriage Act (DOMA), which provided that federal law would recognize only opposite-sex marriages, is unconstitutional. 

Note: And just recently, on Oct. 6, the Supreme Court made yet another ruling, letting stand appeals court rulings allowing same-sex marriage in five states: Indiana, Oklahoma, Utah, Virginia, and Wisconsin. The ruling may be a sign that a nationwide right to same-sex marriage is on the horizon.

Know the New Meaning of 3 Key Terms

“The guidance clarifies that same-sex spouses have the same HIPAA rights as other family members, no matter where services are provided,” explains Jim Sheldon-Dean, founder and director of compliance services for Lewis Creek Systems LLC in Charlotte, VT. The guidance further specifies “that spouses include both same-sex and opposite-sex individuals who are legally married, whether or not they live or receive services in a jurisdiction that recognizes their marriage.”

The Windsor decision has effectively changed the meaning of three key terms contained in the HIPAA regulations: spouse, marriage, and family member. Here’s how you need to consider these terms in light of Windsor:

• Spouse: The term “spouse” includes individuals who are in a legally valid same-sex marriage sanctioned by a state, territory, or foreign jurisdiction (as long as a U.S. jurisdiction would also recognize the marriage in a foreign jurisdiction).
• Marriage: The term “marriage” includes both same-sex and opposite-sex marriages.
• Family Member: The term “family member” includes dependents of those marriages.

How ‘Family Member’ Definition Impacts Your Practices

One of the areas of the HIPAA rules where you’ll see the revised definition of family member is in §164.510(b) Standard: Uses and disclosures for involvement in the individual’s care and notification purposes. Under certain circumstances, covered entities (CEs) may share an individual’s protected health information (PHI) with a family member. 

New: “Legally married same-sex spouses, regardless of where they live, are family members for the purposes of applying this provision,” the guidance states.

For health plans, the revised definition of family member affects §164.502(a)(5)(i) Use and disclosure of genetic information for underwriting purposes. “This provision prohibits health plans, other than issuers of long-term care policies, from using or disclosing genetic information for underwriting purposes,” OCR explains.

Requirement: Plans cannot use information from genetic tests of an individual’s family members, or family members’ diseases or disorders, in making underwriting decisions about that individual. “This includes the genetic tests of a same-sex spouse of the individual, or the manifestation of a disease or disorder in the same-sex spouse,” the guidance says.

Look ahead: The guidance released on Sept. 17 won’t be the only advice on the subject. OCR has promised to issue additional clarifications, through guidance or rulemaking, on same-sex spouses as personal representatives under the Privacy Rule.