The U.S. Department of Health and Human Services (“HHS”) issued guidance explaining that for purposes of the HIPAA privacy rule, the term “spouse” includes individuals who are in a legally valid same-sex marriage sanctioned by a state, territory, or foreign jurisdiction; the term “marriage” includes both same-sex and opposite-sex marriages; and the term “family member” includes dependents of those marriages. Legally married same-sex spouses, regardless of where they live, are family members for the purposes of applying rules permitting HIPAA covered entities to share an individual’s protected health information with a family member of the individual.

The HHS guidance can be found here.