Summary of article from Polsinelli, by Hiba AI-Ramahi, Iliana Peters, Rebecca Frigy Romine:
The U.S. Department of Health and Human Services (HHS) and Office for Civil Rights (OCR) issued a “Final Rule” providing special protections and obligations related to Protected Health Information (PHI) about reproductive health care. The Rule applies to all HIPAA regulated entities and covers a broad range of reproductive health care services. It prohibits the use or disclosure of PHI for the purpose of conducting a criminal, civil, or administrative investigation into or imposing liability on any person for seeking, obtaining, providing, or facilitating reproductive health care. Regulated entities must obtain a signed, written attestation from the person or entity requesting the PHI that the intended use or disclosure of the requested PHI is not for one of the prohibited purposes. This Rule is effective on June 25, 2024, with regulated entities given 180 days for compliance and until February 16, 2026 for Notice of Privacy Practices (NPP) modification compliance.