HIPAA's New Requirements for Reproductive Health Information

Effective December 23, 2024, all covered entities and business associates that have protected health information (PHI) that is "potentially related" to reproductive healthcare have new requirements and obligations to fulfill before releasing PHI. On Thursday, June 20, 2024, the Department of Health and Human Services’ Office of Civil Rights and Office of Health Information Technology (collectively, “HHS”) jointly presented a webinar on the HIPAA Privacy Rule to Support Reproductive Health Privacy (the “Reproductive Health Privacy Rule” or “Rule”). HHS published the final Reproductive Health Privacy Rule on April 26, 2024, to build out the agency’s guidance on the Rule’s novel requirements. NOTE: As of publication, there has been no decision rendered in the legal challenge to these regulations in the U.S. District Court for the Northern District of Texas.

Defining Reproductive Health Information

In amending the HIPAA Privacy Rule, the Reproductive Health Privacy Rule defines “reproductive health care” as “health care, as defined in 45 CFR 160.103, that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.” This includes but is not limited to: contraception, including emergency contraception; pregnancy-related health care; fertility or infertility-related health care; and other types of care, services, or supplies used for the diagnosis and treatment of conditions related to the reproductive system. This definition shall not be construed to set forth a standard of care or regulate what constitutes clinically appropriate reproductive health care. Furthermore, the term includes reproductive health care the individual determines is appropriate, such as over-the-counter contraceptives.

Who Is Impacted?

The new HIPAA requirements apply to all covered entities and business associates whenever you receive a request for medical records not related to Treatment, Payment, or Healthcare Operations (TPO). Specifically, these obligations apply if you receive a request for any of the following purposes:

• For Health Oversight: such as requests from state, local, or federal agencies.
• For Judicial or Administrative Proceedings: such as a subpoena for records or testimony.
• For Law Enforcement: such as requests from a police officer, district attorney, or attorney general.
• Coroners or Medical Examiners: regarding a deceased person.

Next, you must determine if the records contain information potentially related to reproductive healthcare. If you can verify a record does NOT contain any information potentially related to reproductive health, you do NOT need to continue with the attestation process.

Restrictions on Using and Disclosing PHI

Regulated entities will be unilaterally prohibited from using or disclosing protected health information (PHI) in response to a request to the extent that the use or disclosure is intended to conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care. This applies where such health care is lawful under the circumstances in which it is provided.

The Presumption of Lawful Care

This presumption states that reproductive health care is presumed lawful for purposes of the Reproductive Health Privacy Rule unless the regulated entity has either a substantial factual basis supplied by the person requesting the use or disclosure, or actual knowledge, that the reproductive health care was not lawful in the circumstances in which it was provided. Where the regulated entity receives a request for information about reproductive health care that was rendered by another provider but is in their patient’s medical record, they should rely on the presumption of lawfulness instead of investigating or analyzing the other provider’s practices.

New Attestation Requirements

If the medical record does contain health information potentially related to reproductive health, then the next step is to obtain an attestation from the requestor. HHS published a model attestation form to support compliance with the Rule. It is strongly recommended to use this model as your template because the attestation will be void if it does not contain all the required elements, or if it has too much information. This attestation cannot be combined with any other documents for signature; it must stand alone.

Compliance Deadlines and Updates

Regulated entities must prepare for the following implementation timeline and regulatory changes:

• Effective Date: December 23, 2024.
• Notice of Privacy Practices (NPP): Changes to the NPP are not required until February 16, 2026.
• Business Associate Agreements (BAA): Covered entities must update BAAs to either require the business associate to follow the updated rules or restrict the release of PHI potentially related to reproductive healthcare so that only the covered entity can disclose it.