HIPAA: Amendments to Protect Reproductive Health Care Information Can Now be Implemented with OCR’s Final Rule

HIPAA regulated entities may now begin implementing the amendments to the HIPAA Privacy Rule to provide additional protections for reproductive health care information issued by the Office for Civil Rights Department of Health and Human Services (OCR) earlier this year. HIPAA regulated entities are not required to comply with the new requirements until December 23, 2024 (with a later compliance date for the required changes to the Notice of Privacy Practices (NPP)). However, the message from OCR is that HIPAA regulated entities are encouraged to begin implementing the changes on June 25, 2024, the effective date of the final rule. On that date, OCR Director Melanie Fontes Rainer stated:

“OCR encourages HIPAA covered entities and business associates to begin implementing the new Privacy Rule requirements today. Patients deserve to have these privacy protections in place as soon as possible.”

“Reproductive health care” is defined broadly under the amendments to the HIPAA Privacy Rule to mean health care that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes. The amendments can be summarized in three main components:

1. Prohibited Uses and Disclosures. HIPAA regulated entities may not use or disclose protected health information (PHI) for any of the following activities (Prohibited Activities):
   • To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.
   • To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.
   • To identify any person for either of the above purposes.

“Seeking, obtaining, providing, or facilitating reproductive health care” broadly includes, but is not limited to, expressing interest in, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, administering, authorizing, providing coverage for, approving, counseling about, assisting, or otherwise taking action to engage in reproductive health care; or attempting any of the same.

This prohibition applies where the activity is in connection with any person seeking, obtaining, providing, or facilitating reproductive health care and the HIPAA regulated entity has determined the reproductive health care is lawful or otherwise protected by law. The reproductive health care is presumed to be lawful unless the HIPAA regulated entity has actual knowledge to the contrary or the requestor provides factual information demonstrating a “substantial factual basis” that the reproductive health care was unlawful.

OCR issued a fact sheet containing examples to assist HIPAA regulated entities in implementing the amendments. The fact sheet states that HIPAA continues to permit HIPAA regulated entities “to use or disclose PHI for purposes otherwise permitted under the Privacy Rule where the request for the use or disclosure of PHI is not made to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.” OCR then provides as one example of such a use or disclosure a covered health care provider using or disclosing PHI “to defend themselves in an investigation or proceeding related to professional misconduct or negligence where the alleged professional misconduct or negligence involved the provision of reproductive health care.”

2. Attestation. HIPAA regulated entities must obtain an attestation before using or disclosing reproductive health care information to health oversight agencies, law enforcement, or coroners or medical examiners, or in judicial or administrative proceedings (including in response to subpoenas and court orders). The attestation must include a statement that the information will not be used for the Prohibited Activities and be signed by the person requesting the information, among other elements. OCR provided a model attestation.

3. NPP Update. By February 16, 2026, all HIPAA covered entities must update their NPP to (i) state that the covered entity will not use or disclose PHI for the Prohibited Activities and include one example of the type of use or disclosure that is prohibited; and (ii) include a description and example of the types of activities that require an attestation.

Next Steps for HIPAA Regulated Entities

HIPAA regulated entities will need to implement the following:

• An internal review of the HIPAA regulated entity’s process for reviewing and disclosing information pursuant to a request for medical records or information to understand what, if any, changes are necessary. This will need to include a process to ensure an attestation is obtained for all disclosures to health oversight agencies, law enforcement, or coroners or medical examiners, or in judicial or administrative proceedings where any reproductive health care information is involved, even if the covered entity does not believe the individual’s reproductive health care is the focus of the request.
• A review and update of the covered entity’s current NPP. Additionally, business associates should also review their upstream covered entities’ NPPs to ensure compliance. 
• Policies and procedures to implement, train, and audit against the prohibited uses and disclosures the new regulations will enforce.

Health care data privacy regulation has been rapidly evolving in the first half of 2024. If you have any questions on implementing the above requirements and other recent changes to health care data privacy laws, please contact any of the authors or any of the Partners or Senior Counsel in Foley’s Cybersecurity and Data Privacy Group or Health Care Practice Group.