Cybersecurity Policy Report, VITAL BRIEFING: HIPAA rule on privacy of reproductive health records requires attestation, update to Notice of Privacy Practices, (May 9, 2024)

By Sheila Lynch-Afryl, J.D., M.A.

Entities should amend their Notice of Privacy Practices, provide training on the rule, and update their HIPAA policies, procedures, and business associate agreements by OCR’s compliance dates.

On April 26 the Office for Civil Rights updated the Health Insurance Portability and Accountability Act’s (HIPAA) (P.L. 104-191) Privacy Rule to prohibit the disclosure of protected health information (PHI) related to lawful reproductive health care in certain circumstances. The rule, issued to ensure patient trust post-Dobbs, also requires entities to update their Notice of Privacy Practices (NPP) and obtain a signed attestation before disclosing PHI “potentially related” to reproductive health care. OCR will begin enforcing the NPP requirement on February 16, 2026, and all other requirements of the final rule on December 23, 2024.

To read the entire article, click here.

MainStory: StrategicPerspectives ComplianceNews HIPAANews PreemptionNews ReproductiveHealthCareNews CyberPrivacyFeed LegislativeRegulatoryActivity FedTracker HealthCare DataPrivacy DataSecurity