OB/GYN Compliance: HIPAA + State Mandatory Reporting + Specialty Codes

OB/GYN practices operate under HIPAA at 45 CFR Part 164, state mandatory-reporting statutes that vary significantly by state, ACOG-published standards-of-care that surveyors and plaintiff experts treat as authoritative, and CMS billing rules for the global obstetric package and the bundling of antepartum, delivery, and postpartum services. Compliance turns on chart segmentation for sensitive records, accurate global-package billing, and state-specific reporting workflows.

What the regulators actually require for OB/GYN

The federal baseline is HIPAA — Privacy Rule and Security Rule at 45 CFR Parts 160 and 164. What makes OB/GYN distinct is the interaction with state minor-consent laws. HIPAA defers to state law on whether a parent is the personal representative for a minor's protected health information under 45 CFR § 164.502(g)(3). State law often grants minors the right to consent to reproductive and sexual-health services without parental notification, which means the practice must segment those records in the EHR.

State mandatory-reporting requirements apply to OB/GYN providers in several distinct categories — child abuse, elder or dependent adult abuse, sexual assault, intimate partner violence (in mandatory-report states), specified communicable diseases, and in some states minors in pregnancy below specified thresholds. The penalty for non-reporting is personal to the provider — fines and possible license discipline — not just institutional. Every state's reporting statute is different.

The CMS global obstetric package is defined by CPT and reinforced in CMS NCCI Policy Manual. CPT codes 59400 (vaginal delivery global), 59510 (cesarean global), 59610 (VBAC global), 59618 (attempted VBAC with cesarean delivery) bundle routine antepartum care, delivery, and routine postpartum care. Misbilling the global components is one of the most common OB/GYN audit findings.

HRSA Title X regulations at 42 CFR Part 59 apply only to Title X grant recipients. They impose confidentiality, counseling, and adolescent-services requirements distinct from HIPAA. A practice that does not receive Title X funding is not directly subject to Title X, but ACOG and many state Medicaid programs cite Title X standards as best practice for family-planning documentation.

ACOG Committee Opinions and Practice Bulletins, while not legally binding, are treated by accreditation surveyors and plaintiff experts as the standard of care. Documentation that departs from a current ACOG opinion without a documented clinical rationale is a litigation exposure.

CMS BPCI Advanced (Bundled Payments for Care Improvement Advanced), which historically included a maternity bundle, concluded its performance period on December 31, 2025; participation is now a historical exposure for any look-back audit of services furnished during the program rather than an active operational obligation. Practices that participated should retain BPCI-A documentation and quality-measure records for the applicable post-program audit window.

The documents you must maintain

The OB/GYN compliance binder should hold:

• Notice of Privacy Practices including the state-specific provisions for sensitive services and confidential communications
• State-specific mandatory-reporting reference at every workstation, updated annually against the current state statute
• Minor-consent and chart-segmentation policy with the EHR configuration documented (sensitive note tagging, portal release rules)
• Confidential communications protocol for sensitive-service EOB redirection and patient-preferred-address requests
• Global obstetric package billing policy documenting which encounters are inside the global, which bill separately, and the chart-documentation standard that justifies separately billable services
• Antepartum visit log for every pregnant patient with the count of antepartum visits documented (necessary if the patient transfers care and partial antepartum billing applies)
• Informed consent forms for sterilization (sterilization consent under 42 CFR Part 50 Subpart B for any federally funded sterilization — including Medicaid), cesarean, VBAC, intrauterine procedures
• Mandatory-reporting log documenting every report made (without the patient PHI in the log, only the date and statute cited)
• IPV (intimate partner violence) screening documentation per ACOG Committee Opinion 829 — screening is recommended at annual exams and at first prenatal visit
• Quality measure submission records for MIPS-eligible practices, plus retained BPCI-A records for any practice that participated before the program's December 31, 2025 sunset

What OB/GYN practices most often miss is the federally funded sterilization consent form at 42 CFR § 50.205 — the form, the 30-day waiting period (with limited exceptions), and the specific timing requirements. Failure to follow the form is a denial of payment under Medicaid and a potential False Claims Act exposure.

How audits actually work in OB/GYN

Commercial payer audits of OB/GYN routinely target the global obstetric package — pulling charts to verify the antepartum visit count, confirming that separately billed services (ultrasounds, NSTs) had documented medical necessity beyond routine prenatal monitoring, and checking that postpartum care was documented and within the global window.

Medicaid audits add the sterilization-consent and family-planning documentation. Medicaid claims for sterilization without the properly executed federal sterilization consent form (Form HHS-687) are denied even after payment if found in post-payment review. The 30-day waiting period is rigid; documented exceptions are narrow.

State medical board investigations of OB/GYN providers typically begin with a patient complaint or a mandatory-reporting referral. State boards subpoena the chart and the practice's policies on the relevant area (e.g., minor confidentiality, IPV screening, controlled-substance prescribing for pelvic-pain management). The board's expert reviewer scores the documentation against the ACOG-defined standard of care for the specific clinical situation.

What OB/GYN practices most often miss is the chart-segmentation discipline. A minor's confidential reproductive-health visit needs to be tagged in the EHR so that the visit summary does not auto-release to the parent portal. Practices that allow auto-release breach state minor-consent statutes and HIPAA simultaneously.

Common gaps unique to OB/GYN

In OB/GYN audits we have responded to, the recurring gaps:

• Global obstetric package billed when the patient transferred care mid-pregnancy — the previous provider's antepartum visits are not in the global; itemized billing for the visits actually performed is required.
• Separately billed ultrasounds without documented medical necessity beyond routine pregnancy dating and anatomy survey — CPT 76817, 76801, 76805 each have specific indications; routine repeat ultrasound for reassurance without medical indication is not separately billable.
• NST (non-stress test) billed for routine surveillance without documented indication — CPT 59025 requires a documented medical indication (decreased fetal movement, hypertension, diabetes, post-dates).
• Sterilization consent form executed less than 30 days before the procedure without a documented qualifying exception (premature delivery, emergency abdominal surgery) — Medicaid claim is denied.
• Confidential communications request not honored — sensitive-service EOB sent to the policyholder triggers HIPAA complaint and state-statute complaint.
• IPV screening not documented — ACOG Committee Opinion 829 expects screening at annual exam and first prenatal visit; the absence of screening documentation is a plaintiff-expert finding.
• Mandatory report not made within statutory timeframe — most state statutes require immediate verbal report followed by written report within 36-48 hours.
• Sensitive notes released through patient portal to parent of consenting minor — EHR configuration error; root cause is missing chart-segmentation policy.

Maintenance cadence

• Daily: chart-segmentation verification for any minor-consent encounter; mandatory-reporting log entry for any report made
• Weekly: confidential communications request log review
• Monthly: global obstetric package billing reconciliation; sterilization consent form audit on any Medicaid sterilization claims
• Quarterly: chart sample audit (10-15 charts) for documentation-to-billing fit and ACOG standard-of-care adherence
• Annually: state mandatory-reporting reference refresh; ACOG Committee Opinion library refresh; HIPAA risk analysis; sterilization consent form retraining for clinical and billing staff
• On every staff onboard: state-specific mandatory-reporting training within 30 days; minor-consent and chart-segmentation training before independent patient care

State preemption: where state law adds materially

California — Family Code § 6925 grants minors the right to consent to pregnancy-related care without parental notification, with no statutory age minimum (other minor-consent provisions in the Family Code have age thresholds — § 6925 itself does not). Health and Safety Code § 1374.92 (Confidential Communications) requires payers to honor patient requests for confidential delivery of EOBs and related communications. Penal Code § 11166 governs child-abuse reporting with strict immediacy requirements. CMIA at Civil Code §§ 56-56.37 layers additional disclosure restrictions on PHI.

Texas — Family Code § 32.003 governs minor consent for limited services; the threshold is narrower than California's. Texas Family Code Chapter 261 mandates child-abuse reporting within 48 hours. HB 300 adds 15-business-day patient-access response. Texas additionally has a state-specific sterilization-consent form for Medicaid that must accompany the federal form.

New York — Public Health Law § 17 grants minors 18 and older access to their records; PHL § 2504 governs minor consent for emergency, reproductive, and certain mental-health services. New York Social Services Law § 413 governs child-abuse reporting. I-STOP applies to any controlled-substance prescribing for chronic pelvic pain or post-surgical analgesia.

Florida — Florida Statute § 743.065 governs minor consent for pregnancy-related services. F.S. § 39.201 governs child-abuse reporting (immediate hotline call required). FIPA at F.S. § 501.171 imposes 30-day breach notification. Florida additionally requires Medicaid sterilization consent on the Florida-specific form alongside the federal form.

How d3rx fits

The d3rx specialty compliance binder maintains the OB/GYN module: state mandatory-reporting reference, minor-consent and chart-segmentation policy, confidential communications workflow, global obstetric package billing policy, sterilization-consent tracker, IPV screening documentation tracker, and ACOG Committee Opinion library cross-reference. It is a source-grounded administrative documentation aid. It does not certify compliance, provide legal advice, or replace counsel. See compliance binder for the binder structure.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.