This post has been archived and contains information that may be out of date.
What’s happening: The Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) issued a final rule prohibiting entities regulated by the Health Insurance Portability and Accountability Act Privacy Rule from using or disclosing protected health information (PHI) to investigate or prosecute patients, providers, or others involved in providing legal reproductive health services.
What else to know: The final rule is effective June 25, and covered entities are required to comply within 240 days. Hospitals will need to update their policies and procedures to comply with these new rules.
The final rule requires covered entities to obtain a signed attestation that certain requests for PHI potentially related to reproductive health care are not for these prohibited purposes. The rule clarifies that hospitals can rely on the attestation and are not required to investigate the validity of an attestation provided by a person requesting a use or disclosure of PHI. OCR plans to issue a model attestation form before the compliance date.
Additional information is available in an HHS fact sheet.
