In late May, we authored an article describing the new HIPAA Privacy Rule to support reproductive healthcare privacy referred to as the 2024 HIPAA Privacy Rule. HHS has issued the promised Model Attestation for a Requested Use or Disclosure of Protected Health Information Potentially Related to Reproductive Health Care.
This form is a necessary component for HIPAA-regulated entities (like group health plans) to be able to comply with the new category of prohibited uses and disclosures of Protected Health Information (PHI) that is potentially related to reproductive health care, as introduced in the 2024 Privacy Rule that was released in late April and goes into effect in December 2024.
The Model Attestation, along with other informational materials on the 2024 Privacy Rule (including a Social Media Toolkit and Fact Sheet) can be found here: https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/index.html.
Group health plan administrators will need to use the attestation if there is a request for PHI potentially related to reproductive healthcare. The requirement for an attestation will apply when the request for PHI is for any of the following reasons: health oversight activities; judicial and administrative proceedings; law enforcement purposes; and disclosures to coroners and medical examiners.
Next Steps
Employers/plan administrators will need to download and save the attestation form in their HIPAA policies & procedures file to ensure it’s used in the appropriate setting described above.
Current HIPAA policies and procedures will need to be updated to account for the new category of prohibited use or disclosure of PHI as well as update their HIPAA training provided to any employees with access to PHI by December 22, 2024.
Lastly, employers will also need to update their Notice of Privacy Practices by February 16, 2026, though we do expect an updated model Notice of Privacy Practices to be issued by that time.
