In response to the Dobbs v. Jackson Women’s Health Organization decision, the U.S. Department of Health and Human Services (HHS) issued new HIPAA Privacy Rules to protect reproductive healthcare privacy that became effective on June 25, 2024. The new rules prohibit covered entities and business associates from using or disclosing Protected Health Information (PHI) for investigating or imposing liability related to lawful “reproductive healthcare” unless there is substantial evidence that the care was unlawful. The new rules contain attestation and privacy notice requirements which may impact employers.
“Reproductive healthcare” is broadly defined under the rules and can include services like contraception, pregnancy-related care, fertility treatment, peri and post-menopausal treatments, and the provision of medications and devices, including over-the-counter medications or devices.
Attestation Requirements
Group health plans must obtain a signed, dated attestation from the requesting party when receiving a request for reproductive health care PHI. The attestation must describe the information requested and confirm the request is unrelated to a prohibited purpose. Failure to obtain required attestations could result in civil or criminal penalties.
HHS was tasked with providing a model attestation for compliance by December 23, 2024, and has since released the model attestation. Where applicable, covered entities or business associates should begin providing this attestation to those requesting reproductive PHI as soon as possible but by no later than December 23, 2024.
Privacy Practices Notice Requirements
Plans have until February 16, 2026, to update their Privacy Notices to include new prohibitions on uses and disclosures related to reproductive health care PHI. The updated Privacy Notice should be distributed to all participants.
Self-insured group health plans with access to PHI must provide a Privacy Notice to participants upon enrollment and upon request. Insured group health plans should confirm with their carrier that the updated notice will be provided to plan participants. Plan sponsors and third-party administrators should also periodically check for model language updates from HHS and ensure the required updates are made by the deadline.
Next Steps
Employers who receive requests related to reproductive-related PHI should ensure that they have updated their procedures to incorporate having the requesting third party complete the required attestation form. This should be incorporated into their processes by December 23, 2024.
Employers should consider training relevant staff (i.e., human resources and benefits administrators) on the revised HIPAA privacy rules and how they impact handling employee health information. Employers may want to communicate the changes to employees through benefit updates.
HR Works will continue to monitor this topic and provide updates as more information becomes available.
