In 2022, the Supreme Court issued a decision in the Dobbs v. Jackson Women's Health Organization case, prompting the federal Health and Human Services (HHS) to take action. The proposed changes aim to protect the privacy of reproductive health care information and align with federal law, preempting contrary state laws in certain situations. Covered entities and business associates in the healthcare industry need to anticipate and prepare for these changes, ensuring they comply with the updated regulations when they become law in 2023. This topic is crucial for healthcare professionals and organizations to understand how the evolving HIPAA regulations will affect the handling of reproductive health care information and overall privacy practices. Adhering to these changes will help avoid risks and liabilities associated with non-compliance and ensure the proper protection of sensitive health information. Register, https://conferencepanel.com/conference/hipaa-and-proposed-changes-for-2023

1. HIPAA and Proposed Changes for 2023
Conference Panel
By
Mark R. Brengelman, JD, MA
Attorney at Law
Frankfort, Kentucky
1

2. About Mark R. Brengelman
• Holds Bachelor's and Master's Degrees in Philosophy from Emory University, Atlanta,
Georgia
• Earned a Juris Doctorate from the University of Kentucky College of Law, Lexington,
Kentucky
• Served out a successful twenty year career with state government in Kentucky, including….
now in private practice since 2012
• Was a former Assistant Attorney General assigned to multiple state licensure boards in health
care and other professions – General Counsel and Prosecuting Attorney
• Has presented Continuing Education for over 50 national and state organizations and private
companies, including the Kentucky Office of the Attorney General, the Kentucky Bar
Association, the National Attorneys General Training and Research Institute, the Federation
of Associations of Regulatory Boards, and eight of its member associations in psychology,
physical therapy, dentistry, nursing, veterinary medicine, emergency medical services, state
licensed contractors, and athletic trainers
• Has represented all three branches of state government and now a local municipality in
governmental ethics and now a state licensure board
Represents:
• licensees before state boards and in other professional matters
• a government ethics commission and two state licensure boards
• parents and kids in confidential child abuse and neglect cases, termination of parental
rights, and adoption proceedings
I help health care practitioners, kids/parents, and government agencies navigate the law and
ethics and make the rules understandable as applied to them.

3. Based upon the content of this program, you will be able effectively to identify:
• Introduction to federal regulatory process-notice and comment rulemaking
• Overview of proposed HIPAA Privacy Rule changes for 2023
• Examination of existing guidance
• Updated general prohibitions
• Attestation requirements
• Changes to definitions
HIPAA and Proposed Changes for 2023
3

4. Based upon the content of this program, you will be able effectively to identify:
• Law enforcement requests
• Changes to notice of privacy practices
• Other various changes
• Alternative changes not made yet
• Next steps for Covered Entities and Business Associates
• Conclusion: avoiding risk and liability with best practices to anticipate HIPAA changes for 2023
but not yet in effect
HIPAA and Proposed Changes for 2023
4

5. Disclaimer! Goals of the content of this program – what this does and does not cover:
• Does provide a broad overview of proposed HIPAA changes for 2023 in the federal notice and
comment rulemaking system
• Does not cover everything about proposed HIPAA changes for 2023 – 48 pages in the Federal
Register!
• Does educate the person attending to ask the right questions in their own profession/health
care entity about changes in compliance with federal law under HIPAA to look for in 2023-24
• Additional disclaimer – I do not work in the area of federal administrative rulemaking (state
rulemaking, yes), and I do not work daily in the area of HIPAA compliance; I work in
professional licensure and regulation of health care professionals – all aspects touch in some
part on HIPAA as to confidentiality
HIPAA and Proposed Changes for 2023
5

6. Introduction to HIPAA and proposed changes for 2023:
• The Department of Health and Human Services published proposed amendments to HIPAA to
further safeguard the privacy of reproductive health care information in 2023 – April 17, 2023
• Comments were due sixty days later by June 16, 2023; nearly 26,000 comments were filed; some
publicly released and searchable (more to come? all to come?) – preliminary conclusions from the
comments
• The proposed amended HIPAA rule prohibits the use and disclosure of this information for certain
criminal, civil, and administrative investigations and proceedings where reproductive health care is
legal in the state that it was provided or under federal law
• This HIPAA update would preempt contrary state law in these narrow situations -- for 2023, there
are also proposed corresponding changes, such as to the requirements for notices of privacy
practices and requiring attestations for certain requests for information potentially related to
reproductive health care
HIPAA and Proposed Changes for 2023
6

7. Changes to definitions:
• Three added or amended definitions
• First: amends “person” to make clear it means “a human being who is born alive” so an embryo or fetus is not a “person” under
HIPAA
• Second: amends “public health” to make clear the term addresses population-level activities and does not include uses and
disclosures for investigations or proceedings against a specific person related to reproductive health care – important for the
“public health” exceptions in HIPAA
• Under the public health exception, you can still get individual records of medical care, but not for investigations or proceedings
against a specific person
• Third and new one: defines “reproductive health care” as “care, services or supplies related to the reproductive health of an
individual”
• Side note: definition of an abortion in state law and its relation to veterinary medicine: state law – “’Abortion’ means the use of
any means whatsoever to terminate the pregnancy of a woman known to be pregnant with intent to cause fetal death” (emphasis
added) – a woman is not defined here, but surely is not an animal under this state law for the purposes of veterinary medicine
HIPAA and Proposed Changes for 2023
7

8. What’s next for Covered Entities and Business Associates:
• Covered entities should prepare to make implementing changes (and thus required training and
auditing) in a year when this proposed rule is finalized and published
• Consider taking additional steps to safeguard PHI related to reproductive healthcare – it would not hurt
to improve one’s procedures such as informing patients about their right to request restrictions on the
use or disclosure of this information (although this right does not extend to disclosures to law
enforcement or that are required by law) – tighten up who the patient is authorizing to have access to
your PHI
• What systems are in place to limit uses and disclosures if the patient agrees to a restriction? seems like
you may want to segregate reproductive health care records after all
• Consider how you will interact with law enforcement and courts to the extent you receive a request for
reproductive health care information – you may need an attorney to intervene (guarantee they will know
a lot less about these HIPAA changes than you)
HIPAA and Proposed Changes for 2023
8

9. Conclusion: Summary and tips for avoiding liability and risk with coming HIPAA changes:
For individual health care practitioners:
• As to state law: read and understand your profession’s practice act and know what current practice
standards are and current confidentiality in general under state law – usually the standards are very broad
in professional licensure, but more detailed in mental health professions
• Use a nationally recognized and “HIPAA compliant” software and medical records system – it may allow
you to flag and to separate PHI related to reproductive health care
• But how would that work in mental health therapy?
• Train all your staff and re-train them when HIPAA changes
• Note: what I do drills down only to a single health care practitioner as a covered entity
HIPAA and Proposed Changes for 2023
9

10. Conclusion: Summary and tips for avoiding liability and risk with coming HIPAA changes:
For health care facilities:
• Know your HIPAA confidentiality and coming changes or hire someone who does – your facility is liable
• Have regular training on HIPAA rules for everyone (employees/volunteers) – recommended annual
training for anyone who has access to PHI – especially for facilities that provide reproductive health care
• Document your facility’s Risk Assessments accurately to include these changes – that is your best
defense to a federal HIPAA investigation that will mitigate damages if there is a security breach or
improper disclosure of PHI on reproductive health care
• Large entities will have their own IT and HIPAA compliance offices, so just do that!
HIPAA and Proposed Changes for 2023
10

11. Did we cover it all:
• Introduction to federal regulatory process-notice and comment rulemaking
• Overview of proposed HIPAA Privacy Rule changes for 2023
• Examination of existing guidance
• Updated general prohibitions
• Attestation requirements
• Changes to definitions
HIPAA and Proposed Changes for 2023
11

12. Did we cover it all:
• Law enforcement requests
• Changes to notice of privacy practices
• Other various changes
• Alternative changes not made-yet
• Next steps for Covered Entities and Business Associates
• Conclusion: avoiding risk and liability with best practices to anticipate HIPAA changes for 2023 but not yet
in effect
HIPAA and Proposed Changes for 2023
12

13. Questions?
13
Register Now

14. 14
Visit Now