Section 1 Short title
This Act may be cited as the “Secure Access for Essential Reproductive Health Act of 2023” or the “SAFER Health Act of 2023”.
Secure Access for Essential Reproductive Health Act of 2023
A BILL
To ensure the privacy of pregnancy termination or loss information under the HIPAA privacy regulations and the HITECH Act.
Sec. 2 Ensuring the privacy of pregnancy termination or loss information under the HIPAA privacy regulations and the HITECH Act
In general—
Prohibition on disclosure— Subject to paragraph (2) and notwithstanding any regulations promulgated pursuant to section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note; Public Law 104–191), a covered entity or a business associate of a covered entity may not disclose pregnancy termination or loss information of an individual in Federal, State, local, or Tribal proceedings, including civil, criminal, administrative, legislative, or other proceedings, without the valid authorization of the individual made in accordance with section 164.508 of title 45, Code of Federal Regulations (or a successor regulation).
Exceptions— Paragraph (1) shall not apply in the case of a disclosure of pregnancy termination or loss information of an individual by a covered entity or a business associate of a covered entity if—
the pregnancy termination or loss information is necessary for use in defense of a professional liability action or proceeding against the covered entity or business associate and the pregnancy termination or loss information is disclosed by—
the covered entity or business associate to the covered entity’s or business associate’s attorney or professional liability insurer or insurer’s agent; or
the authorized attorney of the covered entity or business associate to a court or body hearing the action or proceeding; or
the pregnancy termination or loss information is necessary to investigate physical harm to the individual by another person directly relating to the loss or termination of the pregnancy; and
the individual is unable to provide consent due to death or incapacity.
HITECH—
Privacy exception— The Secretary shall revise section 171.202 of title 45, Code of Federal Regulations, to clarify that an entity’s practice of not fulfilling a request to access, exchange, or use electronic health information in order to comply with subsection (a) shall not be considered information blocking (as defined in section 171.103 of title 45, Code of Federal Regulations (or a successor regulation)) if the information is pregnancy termination or loss information.
Greater security— The Secretary shall revise section 170.401 of title 45, Code of Federal Regulations, to require that as a condition of certification (as described in that section), a health IT developer (as so described) shall implement practices that allow for the segregation of data relating to pregnancy termination or loss information to ensure compliance with subsection (a).
Preemption; modification of State preemption exceptions—
Preemption—
In general— This section shall preempt any State law to the extent that the State law conflicts with or prevents application of this section.
Effect— Nothing in subparagraph (A) shall be construed to preempt a State law to the extent that the State law provides greater privacy protections for pregnancy termination or loss information than provided under this section.
Modification— The Secretary shall revise section 160.203 of title 45, Code of Federal Regulations, to ensure that no exception to the general preemption rule stated in that section applies with respect to pregnancy termination or loss information other than the exception described in paragraph (1)(B).
Outreach— The Secretary shall conduct an outreach campaign to ensure that covered entities, business associates of covered entities, the public, and affected individuals are aware of the requirements of this section and any revisions to regulations made pursuant to this section.
Procedure—
Interim final rule— Not later than 90 days after the date of enactment of this Act, the Secretary shall revise each regulation as required by this section through publication of an interim final rule in the Federal Register.
Final rule— Not later than 270 days after the date on which an interim final rule is published under paragraph (1), the Secretary, after providing opportunity for public comment, shall publish in the Federal Register a final rule with such modifications as the Secretary determines appropriate.
Definitions— In this section:
HIPAA terms— The terms business associate, covered entity, and protected health information have the meanings given those terms in section 160.103 of title 45, Code of Federal Regulations (or a successor regulation).
Pregnancy termination or loss information— The term pregnancy termination or loss information means protected health information of an individual that relates to information that could reveal having or seeking an abortion or care for pregnancy loss, including, without limitation, any request for, or receipt of, items, services, education, counseling, or referrals relating to the termination or loss of a pregnancy of the individual, including abortion, miscarriage, stillbirth, and ectopic pregnancy.
Secretary— The term Secretary means the Secretary of Health and Human Services.