GBS Health & Benefits Compliance
New HIPAA Privacy Protections for Reproductive Healthcare:
What You Need to Know and 5 Steps You Can Take Now
A new final rule under HIPAA adds more compliance requirements aimed at supporting reproductive healthcare privacy – so you need to take note if you are a healthcare provider, employer-sponsored group health plan, or other covered entity. While the rule may not significantly change the scope of health information that is protected under HIPAA, you will need to implement certain changes to comply, including revising your HIPAA Notice of Privacy Practices. See the Department of Health and Human Services (HHS) Fact Sheet to Support Reproductive Health Care Privacy. We’ll explain everything you need to know and give you five steps you should considering taking to comply before the applicable deadlines.
What Happened?
The U.S. Department of Health and Human Services (HHS) issued a final rule on April 22, 2024, as part of a larger effort to protect access to and privacy of reproductive healthcare, after a Supreme Court ruling overturned Roe v. Wade in 2022. That ruling lifted the federal right to abortion access, which led to stricter abortion laws in 21 states and many employer questions about abortion-related employment protections and healthcare benefits.
The final rule adds new privacy protections for reproductive healthcare to federal regulations known as the “Privacy Rule” under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA’s Privacy Rule provides national standards for safeguarding individuals’ “protected health information” (PHI) such as their medical records and other individually identifiable health information.
Who Does This Impact and When Does This Take Effect?
You must comply with the new rules if you are a “covered entity” (such as a healthcare provider, healthcare clearinghouse, or health plan) or a “business associate” under HIPAA.
The rule takes effect on June 25, 2024, and if you are a covered entity or business associate, you must comply with the new requirements by December 23, 2024 — except that you will have until February 16, 2026, to update your Notice of Privacy Practices.
Each signed attestation must have the person requesting PHI confirm that their request is not for a prohibited purpose and acknowledge that improper uses and disclosures of PHI could result in criminal penalties. There are other specific attestation content requirements under the new rule, and HHS is expected to release model language, so you should stay tuned for more information. Covered entities refusing to provide PHI in the above circumstances because the attestation requirement is not satisfied should consult with legal counsel.
Mandate to Revise Notice
You will need to update your Notice of Privacy Practices (NPP) to incorporate the new reproductive healthcare privacy protections. You’ll need to explain when an attestation is required and add descriptions and examples of prohibited uses and disclosures of PHI under the new rule.
The compliance deadline for updating your NPP is February 16, 2026.
5 Steps You Should Consider Taking Now
To ensure you are in full compliance by the applicable deadlines, consider taking these five steps:
- Update your HIPAA Policies and Procedures. Make sure to address when you can and cannot use or disclose PHI for certain activities related to an individual’s reproductive healthcare and when a signed attestation is needed before doing so.
- Train Your Workforce on the New Rules. Your employees and other insiders are a common cause of healthcare data breaches. Bring your workforce (including your own employees, contractors, or third-party vendors who have authorized access to your sensitive data and systems) up to speed on the new privacy rules related to reproductive healthcare.
- Keep Up With Applicable Laws Related to Reproductive Healthcare. Because some of the prohibitions under the new rule apply only when the PHI at issue involves lawful reproductive healthcare, you will need to know what is and is not lawful in your jurisdiction and neighboring jurisdictions. Consult with counsel, particularly when the PHI is related to care provided in another jurisdiction.
- Prepare a Form Document for the Required Acknowledgements. You will want to have this form ready in advance so that you can provide it as soon as you receive a request for PHI that requires a signed attestation. Look out for model language from HHS.
- Revise your Notice of Privacy Practices. Work with your Trusted Advisor to update your NPP to comply with the new final rule and address reproductive healthcare privacy protections.
Conclusion
Plan sponsors should ensure their plan documents have been updated to include clear protections for reproductive healthcare, as well as updating the health plan HIPAA policies and procedures and NPP ahead of the compliance deadlines.
August 2024
This document is not intended to be exhaustive, nor should any information be construed as tax or legal advice. Readers should contact a tax professional or attorney if legal advice is needed. Although we have made every effort to provide complete, up-to-date, and accurate information in this document, such information is meant to be used for reference only. If there is any inconsistency between the information contained in this document and any applicable law, then such law will control.
