July 16, 2024
On June 27, 2024, HHS updated its “HIPAA and Reproductive Health” web page with resources to help covered entities, including group health plans, and business associates comply with the 2024 final HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the 2024 Final Rule).
On April 26, 2024, HHS published the 2024 Final Rule, which modifies the existing HIPAA Privacy Rule. The 2024 Final Rule follows the US Supreme Court ruling in Dobbs v. Jackson Women’s Health Organization, which removed the federal right to an abortion. As a result, several states enacted laws banning or restricting access to abortion.
Accordingly, the 2024 Final Rule was issued in part to protect the privacy of individuals crossing state lines to seek an abortion in a state where it is lawful. More broadly, the 2024 Final Rule aims to limit the circumstances under which an individual’s reproductive healthcare information can be used for non-healthcare purposes if such use or disclosure could be damaging to the privacy of the individual or another person or the individual’s relationship with their healthcare providers.
As explained in our May 7, 2024, Compliance Corner article, the 2024 Final Rule prohibits HIPAA-covered entities and business associates from using or disclosing protected health information (PHI) related to lawful reproductive healthcare under certain circumstances, such as to conduct a criminal, civil, or other legal proceeding. By December 23, 2024, covered entities and business associates will need to comply with a new attestation requirement that applies when HIPAA-covered entities or business associates receive a request for PHI that is potentially related to reproductive healthcare to ensure the use or disclosure is not for a prohibited purpose.
The updated HHS web page provides a Model Attestation Form to assist covered entities and business associates with this new compliance obligation related to reproductive healthcare. The Model Attestation Form includes instructions for the person requesting PHI and information for covered entities and business associates. This information explains that covered entities and business associates must obtain a new attestation for each applicable use or disclosure request, the circumstances under which the attestation can be relied upon, and the requirement to maintain a written copy of each completed attestation and any relevant supporting documents.
Additionally, by February 16, 2026, covered entities will need to update their Notice of Privacy Practices (NPP) to inform individuals that their PHI may not be used or disclosed for a prohibited purpose under the 2024 Final Rule. The delayed NPP deadline is designed to align with the deadline for covered entities to update the NPP for changes under the Confidentiality of Substance Use Disorder Patient Records Final Rule, which we covered in our February 13, 2024, Compliance Corner article, thus preventing a situation in which the NPP would need to be updated twice within a short period.
The new HHS resources include a slide presentation that provides an overview of the 2024 Final Rule, including key dates, definitions, compliance requirements, and links to other resources. This presentation is accompanied by a new video that explains how the 2024 Final Rule addresses individuals’ concerns about sharing reproductive healthcare information with providers that could be disclosed to and used by law enforcement. Additionally, a social media toolkit and other reproductive healthcare summaries are provided for educational purposes.
Employers, particularly those that sponsor self-insured plans, and their business associates should review the Model Attestation Form and other HHS resources and ensure their HIPAA privacy policies and procedures are updated by December 23, 2024, to reflect the 2024 Final Rule requirements. Employers should also be aware that the NPP provided to participants will require modification by February 16, 2026.
HIPAA and Reproductive Health
PPI Benefit Solutions does not provide legal or tax advice. Compliance, regulatory and related content is for general informational purposes and is not guaranteed to be accurate or complete. You should consult an attorney or tax professional regarding the application or potential implications of laws, regulations or policies to your specific circumstances.
Sign up to have it delivered straight to your inbox.
Sign up