H.R. 9470: Secure Access for Essential Reproductive Health Act of 2026

This bill would change federal health privacy rules to give extra protection to information that could reveal whether someone had, sought, or discussed an abortion or pregnancy loss care. It applies to covered entities under HIPAA, such as health plans, most health care providers, and health care clearinghouses, as well as their business associates.

What information is covered

The bill defines “pregnancy termination or loss information” broadly. It includes protected health information that could reveal:

• having or seeking an abortion
• care for pregnancy loss
• requests for, or receipt of, related items or services
• education, counseling, or referrals connected to abortion, miscarriage, stillbirth, or ectopic pregnancy

Limits on disclosure in proceedings

The bill would generally prohibit covered entities and their business associates from disclosing this information in federal, state, local, tribal, or other proceedings, including civil, criminal, administrative, and legislative proceedings, unless the individual gives valid HIPAA authorization.

Exceptions

The disclosure ban would not apply in two situations:

• Professional liability defense: if the information is needed to defend a malpractice or similar claim against the covered entity or business associate, and it is shared with an attorney, insurer, insurer’s agent, court, or hearing body as needed for that defense.
• Investigating harm by another person: if the information is needed to investigate physical harm caused by someone else directly related to the pregnancy termination or loss, and the person whose records are involved is dead or unable to consent.

Changes to federal health IT rules

The bill would direct the Department of Health and Human Services to update federal regulations under the HITECH Act so that a health care organization would not be treated as “information blocking” for refusing to access, exchange, or use electronic health information when doing so would conflict with the new privacy protections for pregnancy termination or loss information.

It would also require certified health IT developers to build in data-segregation practices so this kind of information can be separated and handled in a way that supports compliance with the privacy rules.

Effect on state laws

The bill would override any state law that conflicts with these requirements. However, it would not stop states from providing stronger privacy protections for this information. It would also narrow certain existing HIPAA preemption exceptions so that they do not apply to this category of information, except as described in the bill.

Rulemaking and outreach

HHS would have to issue an interim final rule within 90 days of enactment, then publish a final rule within 270 days after that, after taking public comments. The department would also have to conduct an outreach campaign to explain the new requirements to health care entities, the public, and affected individuals.

Relevant Companies

None found