The Department of Health and Human Services (HHS) recently released the model attestation newly required under HIPAA for inquires seeking Protected Health Information (PHI) potentially related to reproductive health care. The new requirement requires HIPAA covered entities, including self-funded health plans, and its business associates to obtain an attestation when receiving requests for PHI potentially related to reproductive health care. By December 23, 2024, the additional administrative task of obtaining an attestation for inquiries placed on plan sponsors begins. Additionally, plan sponsors are required to update the Notice of Privacy Practices (NPP) by February 16, 2026. Attestations must be obtained from anyone seeking information “potentially related to reproductive health care.” As written, the requirement is broadly interpreted although the regulations do not itself provide clarity around what information is “potentially related to abortion or other reproductive health care.”

Following the Supreme Court of the United States (SCOTUS) decision in Dobbs v. Jackson Women’s Health Organization, overturning Roe v. Wade, HHS enacted rules that make use and disclosure of PHI potentially related to reproductive health care for use in a civil or criminal investigation a HIPAA violation if the reproductive health care was obtained legally in a state where such services, such as abortion, are permitted.