HIPAA Privacy Rule to Support Reproductive Health Care Privacy
HHS modified HIPAA due to changes in state laws and the overturning of Roe v. Wade.
Background
In response to the overturning of Roe v. Wade and various changes in state legislation, the U.S. Department of Health and Human Services (“HHS”) issued modifications to the Health Insurance Portability and Accountability Act (“HIPAA”).
Health plans will have until December 22, 2024, to comply. Notice of Privacy Practices (“NPP”) will need to be updated by February 16, 2026.
December 22, 2024 Changes
New prohibited use and disclosure
A health plan or a business associate may not use or disclose PHI for any of the following activities:
- To conduct a criminal, civil, or administrative investigation into any person for the mereact of seeking, obtaining, providing, or facilitating reproductive health care.
- To impose criminal, civil, or administrative liability on any person for the mere act ofseeking, obtaining, providing, or facilitating reproductive health care.
- To identify any person for any purpose described above.
Attestation
Additionally, an attestation will need to be signed and dated by any party requesting PHI “related to” reproductive healthcare.
HHS has recently released the long awaited model attestation which can be found at the following link: https://www.hhs.gov/sites/default/files/model-attestation.pdf
February 16, 2026 Changes
Notice of Privacy Practices
Health plans will need to revise their Notice of Privacy Practives to explain the new requirements.
These changes must be made by February 16, 2026.
