HHS Enhances HIPAA Privacy Rule to Safeguard Reproductive Healthcare

July 11, 2024

The Office for Civil Rights (OCR) at the U.S. Department of Health & Human Services (HHS), has issued a Final Rule modifying the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to safeguard reproductive healthcare access and privacy along with bolstering patient-physician confidentiality.  

The rule does this by prohibiting the use or disclosure of protected health information (PHI) related to reproductive health by covered entities (e.g., physicians, hospitals, health plans, healthcare clearinghouses) and their business associates. The rule also permits covered entities to use or disclose PHI for non-prohibited purposes under the Privacy Rule. 

Prohibited purposes include using PHI: to investigate any person for seeking, obtaining, providing, or facilitating lawful reproductive healthcare; to impose liability on any person for seeking, obtaining, providing, or facilitating lawful reproductive healthcare; and, to identify any person for the purposes of investigation or liability. 

To enforce the prohibition, the rule mandates that covered entities obtain a signed attestation from requestors affirming that the PHI will not be used for prohibited purposes. This requirement applies to requests for PHI for health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners.  

The Office of the National Coordinator for Health Information Technology (ONC) has confirmed that complying with OCR’s reproductive health regulations will not constitute information blocking. For example, if a request is made to a physician for reproductive health PHI, and the physician requests that an attestation be signed that the PHI will not be used for prohibited purposes and that attestation is not signed, is not complete, or cannot be relied on, a physician can withhold that PHI without being considered an information blocker.  

The AMA has been urging both OCR and ONC to provide much needed education and resources to help physicians implement and comply with the regulations and to protect patient and physician information from misuse. In response to the AMA’s requests, the administration developed the materials below.   

Physicians must be in compliance with the rule by December 23, 2024. 

Here is a fact sheet summary of the rule.