The U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) released guidance last Wednesday to help covered entities and business associates understand the privacy implications of the 2013 Supreme Court decision in United States v. Windsor (“Windsor”).

The Supreme Court ruled in Windsor that Section 3 of the Defense of Marriage Act (“DOMA”), which provided that federal law would recognize only opposite-sex marriages, was unconstitutional.  Since Windsor, HHS has already extended Medicare coverage to same-sex couples.

The HIPAA Privacy Rule provides some protections to family members, including spouses, of patients.  For example, Protected Health Information relating to the patient’s care may sometimes be shared with family members of patients.  In addition, the protections against the use of individuals’ genetic information for underwriting purposes under the Genetic Information Nondiscrimination Act (“GINA”) extend to certain information about family members.

OCR’s guidance on HIPAA and Same-sex Marriage addresses the effect of Windsor on HIPAA provisions relating to family members.  The guidance clarifies that, under the Privacy Rule, “spouse” includes both same-sex and opposite-sex individuals who are legally married.  The term “marriage” extends to same-sex marriages, and “family member” includes dependents of those marriages.

These terms apply to legally married same-sex individuals, regardless of whether or not they live in or receive services in a jurisdiction that recognizes their marriage.

One big question remains: Do same-sex spouses qualify as “personal representatives” under the Privacy Rule?  OCR stated that it intends to issue clarifications on this topic through guidance or rulemaking.  We will continue to post updates on HIPAA and same-sex marriage issues as additional guidance is released.