New HIPAA Rule on Protected Health Information and Reproductive Health Care

The Department of Health and Human Services (HHS) issued a final rule that impacts employer-sponsored group health plans and their business associates (“Covered Entities”). This rule prohibits the use or disclosure of protected health information (PHI) when it is requested for the purpose of investigating or penalizing someone for seeking, obtaining, or providing lawful reproductive health care. The same restriction applies to efforts to identify individuals involved in such activities.

Covered Entities that receive requests for PHI related to reproductive health care must now require a signed attestation from the requester, confirming that the requested PHI will not be used for prohibited activities. This attestation is mandatory when the request is made for purposes including:

• Health oversight activities
• Judicial or administrative proceedings
• Law enforcement purposes
• Disclosures to coroners or medical examiners

HHS has provided a model attestation form that Covered Entities may use, but they are also allowed to create their own form. The model form may be accessed by clicking here.

The form must be a standalone document and should include:

• A description of the requested PHI, identifying the individual(s) involved
• The name(s) of the person(s) making the request and the recipient of the PHI
• A statement that the PHI will not be used for prohibited activities
• A warning that obtaining or disclosing PHI in violation of HIPAA may result in criminal penalties
• The signature of the requester, which can be electronic, and the date of the request

By December 23, 2024, Covered Entities must begin obtaining these attestations when PHI related to reproductive health care is requested. Group health plan sponsors should update their HIPAA policies and procedures accordingly.