On June 25, 2024, significant updates to the HIPAA Privacy Rule, designed to bolster reproductive health care privacy, took effect. Building upon previous discussions regarding these changes, this article delves into a critical aspect of the updated rule: the new Reproductive Health Care Attestation requirement. This mandate impacts not only covered entities and business associates but also judicial officials, law enforcement, health oversight agencies, and medical examiners who routinely request Protected Health Information (PHI). Understanding this new requirement is crucial for all involved parties to ensure compliance and protect sensitive health information.
Background to the HIPAA Privacy Rule Changes
The reproductive health care attestation requirement is a key component of the Final Rule issued by the U.S. Department of Health and Human Services (HHS) on April 26, 2024. This Final Rule encompasses several changes to the HIPAA Privacy Rule, all aimed at strengthening privacy protections for individuals seeking reproductive health care. For a comprehensive overview of the motivations behind the Final Rule, a summary of all key changes, and a detailed exploration of the newly prohibited uses and disclosures of PHI, refer to previous resources detailing these updates.
Important Dates for Compliance
The changes introduced by this Final Rule became effective on June 25, 2024. Entities subject to HIPAA regulations, including covered entities and business associates, are required to achieve full compliance with these new requirements, including the reproductive health care attestation, by December 23, 2024.
However, there is an exception concerning the updates to covered entities’ notices of privacy practices (NPPs), as outlined in 45 CFR 164.520. These NPP updates have a later compliance deadline of February 16, 2026.
Decoding the Attestation Requirement
The specific details of the reproductive health care attestation requirement are outlined in the newly established 45 CFR 164.509 within the HIPAA Privacy Rule. This regulation mandates that covered entities and business associates must obtain a valid reproductive health care attestation from any party requesting PHI under specific circumstances. This requirement is triggered when two conditions are met:
- The request for PHI falls under one of four pre-existing permissible uses/disclosures within the Privacy Rule:
- Health oversight activities
- Judicial and administrative proceedings
- Certain law enforcement purposes
- Specific coroner/medical examiner functions.
- The PHI being requested is considered “potentially related” to reproductive health care.
Understanding these two criteria is essential for determining when a reproductive health care attestation is necessary. Let’s first understand the rationale behind this new requirement.
The Purpose of the Attestation: Preventing Misuse of PHI
As previously discussed, the Final Rule introduced new prohibitions against using or disclosing PHI for investigations or to impose liability on individuals or entities for seeking, obtaining, providing, or facilitating lawful reproductive health care. These are known as the “three new prohibited uses/disclosures” as detailed in 45 CFR 164.502(a)(5)(iii). The reproductive health care attestation is directly linked to these prohibitions.
The core function of the reproductive health care attestation is to prevent individuals or entities from exploiting existing, permissible HIPAA pathways for PHI disclosure to circumvent these new prohibitions. Essentially, it acts as a safeguard against using legitimate PHI request mechanisms to obtain information for purposes now deemed impermissible under HIPAA. HHS clarifies that this requirement is designed to reduce the burden on covered entities and business associates in determining whether a PHI request violates the newly established prohibitions. The attestation serves as a formal assurance that the request is not for any of these prohibited purposes.
Four Scenarios Triggering the Attestation Requirement
It’s important to emphasize that the reproductive health care attestation is not universally required for all PHI requests. It is specifically limited to requests for PHI “potentially related” to reproductive health care and only when those requests fall into one of these four categories:
- Health Oversight Activities: This includes audits, investigations, inspections, and licensure actions necessary for government oversight of the health care system.
- Judicial and Administrative Proceedings: This covers disclosures of PHI in response to court orders, subpoenas, and administrative tribunals.
- Certain Law Enforcement Purposes: This is limited to specific law enforcement activities, such as identifying or locating suspects, fugitives, material witnesses, or missing persons, and for certain reporting of crimes in emergencies.
- Specific Coroner/Medical Examiner Uses: This pertains to the identification of a deceased person, determining the cause of death, or other legally authorized duties of coroners and medical examiners.
The reproductive health care attestation is only mandatory in these four specific situations and only when the requested PHI is “potentially related” to reproductive health care. Understanding the scope of “potentially related” PHI is therefore crucial.
Defining “Potentially Related” PHI
While the Final Rule provides a definition for “reproductive health care” in 45 CFR 160.103, it does not explicitly define what makes PHI “potentially related” to reproductive health care. HHS acknowledges this broadness but maintains that this language is intentional. The agency explains that using “potentially related” aims to balance privacy interests with the practicalities of PHI requests, particularly in law enforcement contexts.
The intention is to narrow the scope of requests requiring an attestation, thus reducing the burden on regulated entities and those requesting PHI. By focusing on PHI “potentially related to reproductive health care,” the reproductive health care attestation requirement aims to avoid unnecessary interference with or delays in legitimate law enforcement investigations that are not related to reproductive health care. Despite the potentially wide scope of “potentially related,” HHS emphasizes the necessity of this broad approach to protect the privacy of individuals who have sought reproductive health care.
To determine if PHI is “potentially related,” it is essential to review the definition of “reproductive health care” in 45 CFR 160.103. Additional resources provide further clarification, including non-exhaustive lists of health services that HHS considers reproductive health care under HIPAA.
Key Elements of a Valid Attestation
The required elements of a valid reproductive health care attestation are detailed in 45 CFR 164.509. While sharing similarities with HIPAA authorizations, there are notable distinctions. Key components of the reproductive health care attestation include:
- Description of PHI: The attestation must clearly specify the PHI being requested, ideally with enough detail to allow the covered entity or business associate to identify the necessary records.
- Purpose of Disclosure: The requestor must state the purpose for which the PHI is being sought, ensuring it aligns with one of the four permissible uses (health oversight, judicial/administrative proceedings, law enforcement, or coroner/medical examiner).
- Assurance of Non-Prohibited Use: Critically, the attestation must include a statement from the requestor affirming that the PHI is not being requested for any of the three newly prohibited purposes related to reproductive health care.
- Requestor Information: The attestation must identify the requestor, including their name, organization (if applicable), and contact information.
- Date and Signature: The reproductive health care attestation must be dated and signed by the requestor. Electronic signatures are acceptable.
Requestors are not obligated to use a specific form provided by the covered entity or business associate. An attestation created by the requestor is valid as long as it meets all requirements of 45 CFR 164.509. Covered entities and business associates are also prohibited from adding extra elements to the attestation beyond what is legally mandated, ensuring that the process remains efficient for requestors. Similar to HIPAA authorizations, attestations cannot be combined with other forms, though supporting documentation like subpoenas or court orders can be attached.
HHS released a model reproductive health care attestation document on June 28, 2024, available on the HHS website, providing a helpful template for requestors.
Navigating PHI Requests Requiring Attestation: A Step-by-Step Approach
When a covered entity or business associate receives a PHI request, determining if a reproductive health care attestation is needed involves a clear process:
- Initial Assessment: First, evaluate if the request pertains to PHI that is “potentially related” to reproductive health care and if it falls under one of the four specified categories (health oversight, judicial/administrative, law enforcement, or coroner/medical examiner).
- Attestation Check: If both criteria are met, verify if a reproductive health care attestation was submitted with the request.
- Request for Attestation (If Missing): If the attestation is absent, the covered entity or business associate may inform the requestor of the requirement and provide a standard attestation form, if available.
- Attestation Validation: Carefully review any submitted reproductive health care attestation to ensure it is valid and complete, containing all required elements. Releasing PHI based on an invalid attestation constitutes a HIPAA violation.
- Disclosure Criteria Review: If the attestation is valid, proceed with the standard analysis to confirm that all other criteria for the specific type of disclosure are met. For instance, for a subpoena, ensure compliance with 45 CFR 164.512(e)(1)(ii), including reasonable attempts to notify the patient or secure a qualified protective order.
- PHI Release (If Compliant): If both the reproductive health care attestation and all other disclosure requirements are satisfied, the PHI can be released.
- Documentation and Record Keeping: Maintain a copy of the reproductive health care attestation as per 45 CFR 164.530(j) and document the disclosure as required by 45 CFR 164.528.
Frequently Asked Questions about Reproductive Health Care Attestation
Q1: Does the new attestation requirement apply to all PHI requests?
A1: No. The reproductive health care attestation is specifically limited to requests for PHI “potentially related” to reproductive health care and only applies to four types of disclosures: health oversight, judicial/administrative proceedings, certain law enforcement uses, and specific coroner/medical examiner functions. It does not apply to requests from individuals for their own health information or from treating providers for treatment purposes.
Q2: What should we do if we receive a subpoena for PHI potentially related to reproductive health care without an attestation?
A2: Do not ignore subpoenas or court orders. Promptly consult with legal counsel to understand response deadlines and assess the subpoena’s validity. Your attorney can assist in notifying the requesting judicial official about the reproductive health care attestation requirement if it was not included.
Q3: Where can requestors obtain a reproductive health care attestation form?
A3: Covered entities and business associates may develop their own standard forms. Requestors can inquire directly for these forms. Alternatively, requestors can create their own attestation that meets the requirements of 45 CFR 164.509, referencing the HHS model attestation available on the HHS website.
Q4: What if we discover a requestor misrepresented their intentions on an attestation?
A4: Under 45 CFR 164.509(d), if a covered entity or business associate discovers evidence that an attestation was materially false and PHI was disclosed based on it, they must immediately cease further disclosures to that requestor. Furthermore, under 45 CFR 164.509(c)(v), requestors who knowingly obtain PHI for prohibited purposes may face penalties, including significant fines and potential imprisonment under 42 USC 1320d-6.
Additional Resources for HIPAA and Reproductive Health Care Privacy
HHS continues to update its guidance on the Final Rule. Refer to the HHS website for the latest information and resources related to HIPAA and reproductive health care privacy.
Further Inquiries
For any further questions regarding the new reproductive health care attestation requirement, please reach out for clarification and support.
