The Department of Health and Human Services' Office for Civil Rights recently published guidance to assist covered entities by explaining how the United States Supreme Court's decision regarding the Defense of Marriage Act ("DOMA") affects certain provisions under the HIPAA Privacy Rule.

In United States v. Windsor, 133 S.Ct. 2675 (2013), Edith Windsor and Thea Syer, then resident in New York, were married in a lawful ceremony in Ontario, Canada. Subsequently, Syer died and left her entire estate to Windsor. When Windsor claimed the estate tax exemption for surviving spouses, she was barred from doing so by Section 3 of DOMA, which excluded a same-sex partner from the definition of "spouse" as the term is used in federal statutes. The Court ruled that Section 3 of DOMA was unconstitutional.

In light of this ruling by the Court, OCR states that for purposes of HIPAA the term "spouse" must be interpreted to include individuals who are in a legally valid same-sex marriage sanctioned by a state, territory, or foreign jurisdiction, provided marriages in this last category are recognized by a U.S. jurisdiction. In addition, the term "marriage" includes both opposite-sex and same-sex marriages, and "family member" includes dependents of those marriages. Further, OCR explains that these terms are applicable to individuals who are legally married, regardless if they live or receive services in a jurisdiction that recognizes the marriage.

OCR acknowledges that the definition of "family member" is relevant to the application of 45 CFR §164.510(b) for uses and disclosures of information to persons involved in the individual's care and for notification purposes. Under the HIPAA Privacy Rule, covered entities are permitted to disclose an individual's protected health information with an individual's family member. According to OCR, legally married same-sex spouses are family members for purposes of applying this standard.

The definition is also relevant under 45 CFR §164.502(a)(5)(i) relating to uses and disclosures of genetic information for underwriting purposes. Under this provision, health plans are prohibited from using and disclosing genetic information for underwriting purposes. Thus, a health plan is prohibited from using the genetic information (e.g., genetic tests, manifestation of disease or disorder) of a family member of an individual in making underwriting decisions about the individual. According to OCR, this prohibition includes the genetic tests of a same-sex spouse of the individual, or the manifestation of a disease or disorder in the same-sex spouse of the individual.

Thus, covered entities, including business associates, must consider this guidance regarding their uses and disclosures of protected health information. In the near future, OCR intends to publish additional guidance or initiate rulemaking to address same-sex spouses as personal representatives under the HIPAA Privacy Rule. Additional information regarding OCR's guidance is available at: HIPAA and Same-Sex Marriage: Understanding Spouse, Family Member, and Marriage in the Privacy Rule.