Judy Kamens Compliance Specialist View Bio

HHS Finalizes Rule to Strengthen Reproductive Health Care Privacy

HIGHLIGHTS

• April 22, 2024: HHS releases the final rule.
• Dec. 23, 2024: Regulated entities must comply with the final rule by this date, including new attestation requirement, except as noted below.
• Feb. 16, 2026: Regulated entities must update their HIPAA notice of privacy practices by this date.

The U.S. Department of Health and Human Services (HHS) has issued a final rule that strengthens the HIPAA Privacy Rule by prohibiting the disclosure of protected health information (PHI) related to lawful reproductive health care in certain situations.

The final rule prohibits regulated entities from using or disclosing PHI for the criminal, civil or administrative investigation of (or proceeding against) any person in connection with seeking, obtaining, providing or facilitating reproductive health care where such health care is lawful under the circumstances in which it is provided.

Under the final rule, a regulated entity must obtain a valid attestation before it uses or discloses PHI potentially related to reproductive health care for certain purposes, such as health oversight activities, judicial and administrative proceedings, law enforcement purposes, or disclosures to coroners or medical examiners.

The U.S. Department of Health and Human Services (HHS) has updated its webpage on reproductive health care privacy to provide additional resources, including a HIPAA model attestation form, that covered entities and business associates may use to comply with new protections for reproductive health care privacy.

CLICK HERE to read the entire statement.