The Department of Health and Human Services (HHS) recently released the model attestation newly required under HIPAA for inquires seeking Protected Health Information (PHI) potentially related to reproductive health care. For full details on this new requirement, see the prior Leavitt Group article – New HIPAA Privacy Protections for Reproductive Healthcare. What You Need to Know and 5 Steps You Can Take Now. The new requirement requires HIPAA covered entities, including self-funded health plans, and its business associates to obtain an attestation when receiving requests for PHI potentially related to reproductive health care. By December 23, 2024, the additional administrative task of obtaining an attestation for inquiries placed on plan sponsors begins. Additionally, plan sponsors are required to update the Notice of Privacy Practices (NPP) by February 16, 2026. Attestations must be obtained from anyone seeking information “potentially related to reproductive health care.” As written, the requirement is broadly interpreted although the regulations do not itself provide clarity around what information is “potentially related to abortion or other reproductive health care.”
Following the Supreme Court of the United States (SCOTUS) decision in Dobbs v. Jackson Women’s Health Organization, overturning Roe v. Wade, (see the prior Leavitt Group article – Roe v. Wade/Casey Overturned. What’s the Effect on Employers and Health Plans for full details), HHS enacted rules that make use and disclosure of PHI potentially related to reproductive health care for use in a civil or criminal investigation a HIPAA violation if the reproductive health care was obtained legally in a state where such services, such as abortion, are permitted. See the prior Leavitt Group article Employer’s Guide to Workplace Protections for Abortion-Related Decisions.
Conclusion
Group health plans and their business associates must comply with the requirements to obtain attestations by December 23, 2024. Plan sponsor must provide participants an updated Notice of Privacy Practices by February 16, 2026. HHS will release a model NPP ahead of the February 2026 deadline. Be sure you are subscribed to the Leavitt Group news site in order to receive the updated NPP when it is released. A process to obtain and analyze the attestations is advisable, along with updated HIPAA training for employees charged with obtaining attestations. It is also worth considering an update to Business Associate Agreements to include new attestation requirements.
Need help? Contact your Leavitt Group representative. Leavitt Group offers a full suite of HIPAA consulting materials and services.