The landscape of healthcare privacy is constantly evolving, and recent changes to the HIPAA Privacy Rule underscore this dynamic nature. Effective June 25, 2024, pivotal updates designed to bolster the privacy of reproductive health care information came into effect. Building upon previous discussions regarding these amendments, this article delves into a critical component of these changes: the new attestation requirement. This requirement mandates specific protocols for obtaining protected health information (PHI) potentially related to reproductive health care. It’s crucial to understand that this isn’t solely for entities traditionally bound by HIPAA like covered entities and business associates. Judicial officials, law enforcement, health oversight agencies, and medical examiners – entities regularly involved in requesting PHI – must also be keenly aware of and prepared to comply with this new attestation process.
The Genesis of the Attestation Rule
The attestation requirement is a direct outcome of the comprehensive Final Rule issued by the U.S. Department of Health and Human Services (HHS) on April 26, 2024. This rule encompasses a suite of modifications to the HIPAA Privacy Rule, all aimed at reinforcing privacy protections for individuals seeking reproductive health care. For a broader understanding of the motivations behind this Final Rule, a summary of its key provisions, and an in-depth analysis of the newly established prohibitions on using and disclosing PHI, further reading is available here.
Key Dates for Compliance
The implementation date for the changes initiated by this Final Rule was June 25, 2024. HIPAA-covered entities and business associates are granted a grace period to fully implement these new mandates, including the attestation requirement, with a final compliance deadline of December 23, 2024.
A notable exception exists for updates to covered entities’ notices of privacy practices (NPPs), as outlined in 45 CFR 164.520. These specific updates have a later implementation deadline of February 16, 2026.
Decoding the Attestation Mandate
The formal language detailing the attestation requirement is codified in the newly introduced 45 CFR 164.509. This provision of the HIPAA Privacy Rule sets forth the conditions under which covered entities and business associates are obligated to secure an attestation from parties requesting PHI. This obligation arises when two specific conditions are simultaneously met:
- The request for PHI falls into one of four pre-existing categories of permissible uses/disclosures under the Privacy Rule: health oversight activities, judicial and administrative proceedings, specific law enforcement purposes, and certain uses by coroners or medical examiners.
- The PHI being sought is “potentially related” to reproductive health care.
To fully grasp the scope of this new requirement, it’s essential to understand the rationale behind its implementation and the nuances of its applicability criteria.
The Purpose of Attestations
As previously discussed, the Final Rule brought about new restrictions on the use and disclosure of PHI. Specifically, it prohibits using or disclosing PHI for investigations or to impose liability on individuals for seeking, obtaining, providing, or facilitating lawful reproductive health care. It also restricts using or disclosing PHI to identify individuals for these very purposes. These are termed the “three new prohibited uses/disclosures” and are detailed in 45 CFR 164.502(a)(5)(iii). The attestation requirement is intrinsically linked to these prohibitions. It serves as a safeguard, ensuring that entities requesting PHI for legitimate purposes, such as law enforcement or judicial proceedings, are not using these pathways to circumvent the newly established prohibitions. The written attestation acts as a formal pledge from the requestor, affirming that they are not seeking PHI for any of the three newly prohibited purposes.
The HHS, in the preamble to the Final Rule, clarified the intent behind the attestation: “This requirement will help ensure that these Privacy Rule permissions cannot be used to circumvent the new prohibition at 45 CFR 164.502(a)(5)(iii) […]. The attestation requirement is intended to reduce the burden [on covered entities and business associates] of determining whether the PHI request is for a purpose prohibited under 45 CFR 164.502(a)(5)(iii)[…].” 89 FR 33030. Essentially, it streamlines the process for covered entities and business associates by shifting some of the responsibility for ensuring appropriate PHI use to the requestor through the attestation.
The Four Triggering Uses/Disclosures
It’s important to emphasize that the attestation requirement is not a blanket rule for all PHI requests. It is specifically triggered only when PHI “potentially related” to reproductive health care is sought for one of these four defined purposes:
- Health Oversight Activities: This pertains to disclosures to health oversight agencies for legally authorized activities, such as audits, investigations, inspections, and licensure actions.
- Judicial and Administrative Proceedings: This covers disclosures in response to court orders, subpoenas, and other lawful processes in judicial or administrative proceedings.
- Certain Law Enforcement Purposes: This category is narrowly defined under HIPAA and includes disclosures to law enforcement officials for specific reasons, such as identifying or locating a suspect, fugitive, material witness, or missing person; or in response to a grand jury subpoena or court order.
- Certain Coroner/Medical Examiner Uses: This allows for disclosures to coroners and medical examiners for the purpose of identifying a deceased person, determining the cause of death, or other duties as authorized by law.
Crucially, an attestation is only mandated in these four scenarios if the requested PHI is “potentially related” to reproductive health care. The next section will explore the meaning of this key phrase.
Defining PHI “Potentially Related” to Reproductive Health Care
While the Final Rule provided a new definition for “reproductive health care” in 45 CFR 160.103, the HHS deliberately chose not to provide a precise definition for what constitutes PHI “potentially related” to reproductive health care. The agency acknowledged in the preamble to the Final Rule that this ambiguity might pose operational challenges. However, HHS maintained that the broad “potentially related” language was intentional. The rationale behind this approach was to strike a balance. By using a broader scope of “potentially related”, the HHS aims to maximize the privacy protections for individuals’ reproductive health care choices. Conversely, by not requiring attestations for all PHI requests, they seek to limit the burden on regulated entities and those requesting information, ensuring that routine law enforcement or oversight activities are not unduly hampered.
HHS clarified this balance by stating: “[T]his will limit the number of requests that require an attestation, and therefore, the burden of the attestation requirement on regulated entities and persons requesting PHI. […] By narrowing the scope of the attestation to PHI ‘potentially related to reproductive health care,’ the attestation requirement will not unnecessarily interfere with or delay law enforcement investigations that do not involve PHI ‘potentially related to reproductive health care.’ While in practice this scope may be wide, we believe the privacy interests of individuals who have obtained reproductive health care necessitates the inclusion of ‘potentially related’ PHI.”
To navigate the determination of whether PHI is “potentially related,” entities should consult the definition of “reproductive health care” in 45 CFR 160.103. Further clarification, including a non-exhaustive list of health services categorized by HHS as reproductive health care under HIPAA, can be found in this blog post. Ultimately, a cautious approach is advisable. When in doubt, it is prudent to treat PHI as potentially related to reproductive health care, thereby triggering the attestation requirement when the other criteria are met.
Key Components of a Valid Attestation
The mandatory elements of an attestation are detailed in 45 CFR 164.509. While many aspects of an attestation mirror the core requirements of a HIPAA authorization, certain distinctions are noteworthy. Two key elements deserve particular attention:
- Specific Statement of Purpose: The attestation must include an explicit statement from the requestor confirming that the PHI is not being sought for any of the three newly prohibited purposes outlined in 45 CFR 164.502(a)(5)(iii). This statement must be affirmative, directly addressing the prohibited uses.
- Requestor Signature: The attestation must be signed by the requestor. Electronic signatures are explicitly permitted, offering flexibility in the attestation process.
It’s important to note that requestors are not obligated to use a specific form provided by the covered entity or business associate. An attestation created by the requestor is acceptable as long as it fulfills all the requirements of 45 CFR 164.509. Conversely, covered entities and business associates are prohibited from adding extra elements to an attestation beyond what is legally mandated. They cannot demand additional information from the requestor beyond the necessary components of the attestation itself. Similar to HIPAA authorizations, attestations cannot be combined with other forms. However, requestors can submit supporting documentation, such as a subpoena or court order, alongside the attestation. 89 FR 33030.
To facilitate compliance, HHS released a model attestation document on June 28, 2024, available on their website here. This model provides a helpful template for requestors and covered entities alike.
Navigating PHI Requests Requiring Attestation: A Step-by-Step Guide
To ensure compliance with the new attestation requirement, covered entities and business associates should follow a clear protocol when handling PHI requests. The attestation requirement is triggered only when both of these conditions are met: (1) the requested PHI is “potentially related” to reproductive health care, and (2) the request falls under one of the four specified purposes (health oversight, judicial/administrative proceedings, certain law enforcement uses, or coroner/medical examiner uses).
Step 1: Initial Assessment
Upon receiving a PHI request, the covered entity or business associate must first evaluate whether both triggering criteria are present. This involves determining if the requested PHI could be considered “potentially related” to reproductive health care and if the request falls into one of the four designated categories.
Step 2: Attestation Verification
If both criteria are met, the next step is to verify whether the request includes a valid attestation. If an attestation is absent, the covered entity or business associate should proactively inform the requestor about the new requirement. Providing the organization’s standard attestation form (if available) or directing them to the HHS model form can be helpful.
Step 3: Attestation Validation
If an attestation is provided, it is crucial to meticulously review it to confirm its validity. This includes ensuring that all required elements are present, including the statement of purpose and the requestor’s signature. Releasing PHI based on an incomplete or invalid attestation constitutes a HIPAA violation.
Step 4: Standard Disclosure Analysis
Once a valid attestation is secured, the covered entity or business associate must proceed with their standard analysis to verify that all other prerequisites for the specific type of disclosure are met. For instance, if the request is based on a subpoena for a judicial proceeding, compliance with 45 CFR 164.512(e)(1)(ii) is still necessary. This includes ensuring reasonable efforts to notify the individual about the PHI request or obtaining a qualified protective order.
Step 5: PHI Release and Documentation
If the attestation is valid and all other disclosure requirements are satisfied, the PHI can be released. The covered entity or business associate must retain a copy of the attestation as mandated by 45 CFR 164.530(j) and document the disclosure in accordance with 45 CFR 164.528.
Frequently Asked Questions (FAQs)
Q1: Does this new attestation apply to all PHI requests?
A1: No. The attestation requirement is specifically limited to requests that meet two criteria: (1) the PHI is “potentially related” to reproductive health care, and (2) the request falls under one of the four designated purposes: health oversight, judicial/administrative proceedings, certain law enforcement uses, or coroner/medical examiner uses. It does not apply to requests from individuals for their own health information or requests from treating providers for treatment purposes.
Q2: We received a subpoena for PHI potentially related to reproductive health care, but no attestation was included. Can we ignore it?
A2: Absolutely not. Ignoring subpoenas or court orders can have serious legal repercussions. Upon receiving such a request, immediately consult with legal counsel. They can assist in navigating response deadlines and assessing the subpoena’s validity. Legal counsel can also guide you in communicating with the requesting judicial official to inform them about the attestation requirement if it was not initially provided.
Q3: As a judicial official, law enforcement officer, or similar, how do I obtain an attestation form?
A3: Many covered entities and business associates are likely to develop their own standard attestation forms. Contacting the entity directly to inquire about their form is a good first step. Alternatively, you can create your own attestation, ensuring it includes all the required elements outlined in 45 CFR 164.509. The HHS model attestation, available here, is a valuable resource and template.
Q4: What if we discover a requestor misrepresented their intentions in the attestation and is using the PHI for a prohibited purpose?
A4: The HIPAA Privacy Rule directly addresses this scenario in 45 CFR 164.509(d). If a covered entity or business associate discovers credible information indicating a materially false representation in an attestation, they are legally obligated to immediately cease disclosing PHI based on that attestation.
Furthermore, under 45 CFR 164.509(c)(v) and 42 USC 1320d-6, requestors who knowingly obtain PHI for prohibited purposes can face significant penalties, including substantial fines (up to $250,000) and imprisonment (up to 10 years), depending on the severity of the offense. This underscores the serious legal ramifications of misrepresenting intentions in an attestation.
Additional Resources
HHS continues to provide updated guidance on the Final Rule. Their resource page, available here, is a valuable source of information and updates.
Further Inquiries
For any further questions regarding the new attestation requirement, please reach out via email to [email protected].
