Around the corner is the Dec. 23 deadline to have your organization bring its HIPAA Notice of Privacy Practices into compliance with the U.S. Department of Health & Human Services’ Office for Civil Rights Final Rule modifying the HIPAA Privacy Rule to enhance reproductive health care privacy. Compliance requires not just a review of the Final Rule, but revised policies and procedures, updated personnel training and effective implementation.
We previously provided a brief overview of the Final Rule and included links for information about key provisions, the attestation requirement and updates to your organization’s HIPAA Notice of Privacy Practices. While the deadline to update the NPP is Feb. 16, 2026, to coincide with a similar obligation in the Part 2 Regulations Final Rule (see here), most compliance obligations must be in place by Dec. 23, 2024.
In this reminder, we would like to address a couple of potential misunderstandings about the Final Rule. First, the Final Rule applies to all HIPAA Covered Entities and their Business Associates — not just to those Covered Entities that provide or cover reproductive health services. Second, the attestation standard at 45 C.F.R. § 164.509(a) specifically references disclosures of PHI potentially related to reproductive health care for (1) health oversight activities, (2) judicial and administrative proceedings, (3) law enforcement purposes and (4) regarding decedents to coroners and medical examiners (i.e., 45 C.F.R. § 164.512(d)-(g)(1)). However, the Final Rule is not limited to disclosures for those specific purposes that require an attestation. That is, the Final Rule prohibits a Covered Entity or Business Associate from using or disclosing any PHI for a prohibited purpose (e.g., “[t]o conduct a criminal, civil or administrative investigation into any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care.”).
[View source.]
