When the U.S. Supreme Court decided United States v. Windsor in 2013 we all expected some revisions to the HIPAA Privacy Rule. After all, while it may have been presumed it wasn’t expressly clear that the Privacy Rule extended to same-sex couples in legally valid marriages. But because the Supreme Court in U.S. v. Windsor held unconstitutional Section 3 of the Federal Defense of Marriage Act (DOMA), which provided that federal law could only recognize opposite-sex marriage, it did seem as if some clarification was in order.
Now that simple clarification has arrived. The OCR has explained that “spouse,” as used in the Privacy Rule, includes individuals “who are in a legally valid same-sex marriage sanctioned by a state….[and] marriage includes both same-sex and opposite-sex marriages, and family member includes dependents of those marriages.” Under the Privacy Rule a “family member” (such as a spouse) can received from a covered entity or business associate information about a patient.
The OCR’s statement says that it will soon initiate rulemaking to address same-sex spouses as personal representatives.