HHS Finalizes HIPAA Privacy Changes for Reproductive Health

The U.S. Department of Health and Human Services (HHS) issued a final rule that strengthens the HIPAA Privacy Rule by prohibiting the disclosure of protected health information (PHI) related to lawful reproductive health care in certain situations. According to HHS, these new protections are necessary to protect access to and privacy of reproductive health care following the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization.

The HIPAA Privacy Rule sets strict limits on the use, disclosure, and protection of PHI by healthcare providers, health plans, healthcare clearinghouses, and their business associates (regulated entities).

Effective Dec. 23, 2024, the final rule prohibits regulated entities from using or disclosing PHI for the criminal, civil, or administrative investigation of (or proceeding against) any person in connection with seeking, obtaining, providing, or facilitating reproductive health care where such health care is lawful under the circumstances in which it is provided. To implement the prohibition, when a regulated entity receives a request for PHI potentially related to reproductive health care, the regulated entity generally must obtain a signed attestation that the use or disclosure is not for a prohibited purpose.

In addition, the final rule requires entities to revise their notice of privacy practices to support reproductive health care privacy by Feb. 16, 2026.