On April 22, 2024, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published a final rule titled: HIPAA Privacy Rule to Support Reproductive Health Care Privacy (Final Rule).I The 2024 Final Rule is a general HIPAA law that allows covered entities (health care providers, health plans, or health information exchanges) to disclose protected health information (PHI) in certain cases. Refine your disclosure rules. This final rule was enacted by HHS in response to a Supreme Court ruling to protect reproductive health access and privacy. Dobbs v. Jackson Women’s Health Organization That led to state abortion bans and other restrictions..
Restrictions on disclosure
The final rule requires covered entities to comply with disclosure restrictions by December 23, 2024. Before providing information to a personal representative or under the permissible provisions of the HIPAA Privacy Rule, a covered entity must first obtain the following certifications: The PHI requested is not for the purpose of investigating individuals or subjecting them to liability solely for the purpose of seeking, obtaining, providing, or facilitating lawful reproductive health care. there is no.
Covered entities must obtain certification when PHI is disclosed without the individual’s written authorization under certain circumstances:
- When there is a request from the person’s representative.
- Comply with a court order or court-ordered warrant, a judicial subpoena or subpoena, or a grand jury subpoena.
- To respond to administrative requests.
- To respond to requests for PHI for purposes of identifying or locating suspects, fugitives, material witnesses, or missing persons.
- To respond to requests for PHI related to crime victims and for victims to consent to such requests.
- To report PHI to law enforcement authorities as required by law.
- Report PHI that the covered entity believes in good faith to be evidence of a crime that occurred on the covered entity’s premises.
At the end of July, OCR Model Authorization Form for Requests to Use Protected Health Information that May Be Related to Reproductive Health Care. The certificate states that federal law prohibits individuals from fraudulently obtaining PHI, and those who knowingly obtain PHI under a false pretense are subject to fines of up to $100,000 and five years in prison. It is stated that there may be penalties.
Updated Notice of Privacy Practices
Additionally, covered entities must update their Notice of Privacy Practices by February 16, 2026. We are still waiting for HHS to issue a new model for the Notice of Privacy Practices.
next step
To ensure compliance with the final rule’s enhanced privacy protections for reproductive health care information, covered entities must implement internal HIPAA policies and procedures related to the provision of reproductive health care information, whether authorized or not. It needs to be reviewed and corrected. Covered entities and their business partners should review the final rule and develop compliance plans regarding updates to policies and procedures, health plan documents, business partner agreements, and privacy notices. Staff will need to be trained on the new requirements.
Employers and health care providers should take this opportunity to review the covered entity’s entire policies and procedures to ensure they are current, compliant, and accurately reflect the company’s current operations. It would be a good idea to check. If discrepancies are identified, covered entity employers must change their HIPAA policies and procedures to reflect their current practices (if legally permissible) or otherwise modify and adjust their practices. There is.
[i] The 2024 Final Privacy Rule became effective on June 25, 2024. The compliance date, the date by which persons subject to this rule must comply with the applicable requirements of this final rule, except for the Notice of Privacy Practices, is December 23, 2024. The compliance date for the amended Notice of Privacy Practices is February 16, 2026. https://www.federalregister.gov/d/2024-08503.
[View source.]
