Answer: Federal law cannot discount same-sex marriage, declared the U.S. Supreme Court in a landmark ruling last year. However, there was no directive from the federal government on how this would affect HIPAA, until recently.
On September 17, the HHS Office for Civil Rights (OCR) released guidance to help covered entities (CEs) understand how the United States v. Windsor Supreme Court decision may affect certain HIPAA Privacy Rule requirements. In the Windsor case, the Supreme Court ruled that the Defense of Marriage Act (DOMA), which provided that federal law would recognize only opposite-sex marriages, is unconstitutional. Plus, on October 6, the Supreme Court made yet another ruling, letting stand appeals court rulings allowing same-sex marriage in five states, including yours: Indiana, Oklahoma, Utah, Virginia, and Wisconsin. The ruling may be a sign that a nationwide right to same-sex marriage is on the horizon.
“The guidance clarifies that same-sex spouses have the same HIPAA rights as other family members, no matter where services are provided,” explains Jim Sheldon-Dean, founder and director of compliance services for Lewis Creek Systems LLC in Charlotte, Vt. The guidance further specifies “that spouses include both same-sex and opposite-sex individuals who are legally married, whether or not they live or receive services in a jurisdiction that recognizes their marriage.”
The Windsor decision has effectively changed the meaning of three key terms contained in the HIPAA regulations: spouse, marriage, and family member. Here’s how you need to consider these terms in light of Windsor:
-
Spouse: The term “spouse” includes individuals who are in a legally valid same-sex marriage sanctioned by a state, territory, or foreign jurisdiction (as long as a U.S. jurisdiction would also recognize the marriage in a foreign jurisdiction).
-
Marriage: The term “marriage” includes both same-sex and opposite-sex marriages.
-
Family Member: The term “family member” includes dependents of those marriages.
One of the areas of the HIPAA rules where you’ll see the revised definition of family member is in §164.510(b) Standard: Uses and disclosures for involvement in the individual’s care and notification purposes. Under certain circumstances, covered entities (CEs) may share an individual’s protected health information (PHI) with a family member.
New: “Legally married same-sex spouses, regardless of where they live, are family members for the purposes of applying this provision,” the guidance states.
For health plans, the revised definition of family member affects §164.502(a)(5)(i) Use and disclosure of genetic information for underwriting purposes. “This provision prohibits health plans, other than issuers of long-term care policies, from using or disclosing genetic information for underwriting purposes,” OCR explains.
Requirement: Plans cannot use information from genetic tests of an individual’s family members, or family members’ diseases or disorders, in making underwriting decisions about that individual. “This includes the genetic tests of a same-sex spouse of the individual, or the manifestation of a disease or disorder in the same-sex spouse,” the guidance says.
