Updated HIPAA Privacy Rule Protects Reproductive Healthcare Privacy & Physician Resources

The U.S. Department of Health & Human Services Office of Civil Rights (OCR) has modified a Final Rule updating the HIPAA Privacy Rule. This rule prohibits the use or disclosure of reproductive protected health information (PHI) by covered entities, including hospitals, health plans, health care clearinghouses, and their business associates.

Modifications and next steps are:

• Prohibits use of PHI to investigate, impose liability or identify individuals for seeking, providing or facilitating lawful reproductive health care.
  
• Allows PHI use or disclosure for non-prohibited purposes.
• Requires covered entities to obtain a signed attestation from requestors affirming the PHI will not be used for prohibited purposes, applicable to health oversight, judicial proceedings, law enforcement, and disclosures to coroners and medical examiners.
  

Physicians must comply with the Final Rule by December 23, 2024.

Below are additional resources by OCR on this modification:  

• Resources to help communicate with other clinicians and community members.
  
• A factsheet summary of the rule.
• A recorded briefing by OCR staff reviewing the rule.
  
• Model attestation for a requested use or disclosure of protected health information.