In May 2024, the Department of Health and Human Services issued a final rule amending HIPAA’s Privacy Rule to address reproductive health care privacy. The final rule was prompted by the Supreme Court’s 2022 ruling in Dobbs v. Jackson Women’s Health Organization, which concluded that the U.S. Constitution does not prohibit states from regulating or banning abortion. The final rule provides guidance to “business associates” and “covered entities,” including employer-sponsored group health plans, on handling requests for protected health information (PHI) related to reproductive health care.

The final rule prohibits the use or disclosure of PHI for criminal, civil, or administrative investigations or proceedings against individuals involved in lawful reproductive health care, and also prohibits using PHI to identify such individuals and health care providers. However, group health plans may disclose PHI related to reproductive health care with attestation from the individual or their representative. The final rule specifies the required content and distribution of these attestations, outlining criteria for validity. An attestation may be invalid if it contains less or more information than what the final rule requires.

Group health plans should take action to comply with the reproductive health care privacy changes. HIPAA privacy policies and procedures, as well as workforce training, should be updated promptly, as compliance is required by December 22, 2024. The final rule also mandates that a HIPAA-required Notice of Privacy Practices be revised by February 16, 2026 to reflect these reproductive health care privacy changes, as well as existing rules on the confidentiality of medical records for individuals with substance use disorders.