On April 26, 2024, the HHS Office for Civil Rights (OCR) announced that it published a final rule strengthening privacy protections for information relating to reproductive healthcare. The agency proposed the rule on April 23, 2023, which we covered in the April 27, 2023, edition of Compliance Corner.

The final rule prohibits the use or disclosure of PHI by individuals, covered entities (which includes group health plans), or their business associates (collectively, “regulated entities”) for either of the following purposes:

• To conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive healthcare, where such healthcare is lawful under the circumstances in which it is provided.
• The identification of any person for the purpose of conducting such investigation or imposing such liability.

The prohibition applies when a regulated entity determines that one or more of the following conditions exist:

• The reproductive healthcare is lawful under the law of the state in which such healthcare is provided under the circumstances in which it is provided.
• The reproductive healthcare is protected, required, or authorized by federal law, including the US Constitution, regardless of the state in which such healthcare is provided.
• The reproductive healthcare was provided by a person other than the covered healthcare provider, health plan, or healthcare clearinghouse (or business associates) that receives the request for PHI, and the receipt of reproductive healthcare was presumed lawful under the circumstances (in accordance with the specifications of the final rule).

Note that the final rule allows a regulated entity to use or disclose PHI for purposes otherwise permitted under the Privacy Rule. However, regulated entities can use or disclose PHI, if the request for PHI is not made primarily for the purpose of investigating or imposing liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive healthcare.

The final rule requires regulated entities to obtain a signed attestation from whomever submits a request for PHI potentially related to reproductive healthcare. This attestation requirement would apply when the request is for PHI in any of the following circumstances:

• Health oversight activities
• Judicial and administrative proceedings
• Law enforcement purposes
• Disclosures to coroners and medical examiners

Finally, the final rule requires that the Notice of Privacy Practices, provided to all participants in a health plan, must be revised to reflect these new requirements.

Employers, particularly those with self-insured plans, should be aware of this final rule. The final rule effective date is June 25, 2024, but plans must comply with the requirements imposed by this rule by December 23, 2024, although changes to the Notice of Privacy Practices have a delayed effective date of February 16, 2026.

Fact Sheet »
Final Rule »