On April 22, 2024, the Office for Civil Rights (OCR) issued a Final Rule entitled HIPAA Privacy Rule to Support Reproductive Health Care Privacy. This Final Rule modifies the HIPAA Privacy Rule to enhance reproductive health care privacy. This initiative aims to safeguard access to and confidentiality of reproductive health care, including protecting the confidentiality of individuals seeking or providing reproductive health care.
Key aspects of the Final Rule include:
Prohibition on Use or Disclosure of PHI for Certain Investigations
- Prohibits covered entities from using or disclosing PHI to investigate or impose liability for seeking, obtaining, or providing lawful reproductive health care.
- Conditions for applying this prohibition include whether the health care is lawful under state or federal law or presumed lawful unless proven otherwise.
Presumption of Lawfulness
- A presumption exists that reproductive health care provided by others is lawful unless the covered entity has knowledge or evidence to the contrary.
Attestation Requirement
- Covered entities must obtain a signed attestation for PHI requests in specific scenarios (e.g., law enforcement or judicial proceedings) to ensure the request is not for prohibited purposes.
Revisions to Notice of Privacy Practices (NPP)
- Requires updates to NPPs to reflect enhanced protections for reproductive health care privacy and align with the CARES Act’s requirements on substance use disorder confidentiality.
Disclosures to Law Enforcement
- Permits PHI disclosure to law enforcement only when required by law, not subject to the prohibition, and compliant with Privacy Rule conditions.
The rule became effective on June 25, 2024, with most compliance obligations required by December 23, 2024. The Notice of Privacy Practices changes must be made by February 16, 2026.
