The U.S. Department of Health and Human Services Office for Civil Rights (“OCR”) has issued guidance concerning how the U.S. Supreme Court’s decision recognizing same-sex marriages may affect certain provisions relating to “family members” in the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule.

The HIPAA Privacy Rule recognizes that spouses, dependents and other family members often need access to information about patients in order to participate in their care as well as have privacy rights of their own regarding genetic information. The definition of family member under the HIPAA Privacy Rule includes the terms “spouse” and “marriage” but does not further define those terms.

In United States v. Windsor, the Supreme Court held as unconstitutional the section of the Defense of Marriage Act (“DOMA”) that excludes a same-sex partner from the definition of “spouse.” In light of the Windsor ruling, OCR advises health care providers and insurance companies (and business associates, as applicable) that the term “family member” in the HIPAA Privacy Rule will include same-sex spouses who are lawfully married, whether or not the state in which they live or get services recognizes same-sex marriages, as well as their dependents. OCR points out that this affects two standards under HIPAA:

• Standard: Uses and disclosures for involvement in the individual’s care and notification purposes. Under certain circumstances, covered entities are permitted to share an individual’s protected health information with a family member of the individual. Legally married same-sex spouses, regardless of where they live, are family members for the purposes of applying this provision. See 45 C.F.R. § 164.510(b).
• Standard: Use and disclosure of genetic information for underwriting purposes. This provision prohibits health plans, other than issuers of long-term care policies, from using or disclosing genetic information for underwriting purposes. For example, such plans may not use information regarding the genetic tests of a family member of the individual, or the manifestation of a disease or disorder in a family member of the individual, in making underwriting decisions about the individual. This includes the genetic tests of a same-sex spouse of the individual, or the manifestation of a disease or disorder in the same-sex spouse of the individual. See 45 C.F.R. § 164.502(a)(5)(i).

OCR has announced it will also issue additional guidance or regulations to address same-sex spouses as personal representatives under the HIPAA Privacy Rule.