Notice of Privacy Practices: Is it Time to Amend Yet?

You may recall when the HIPAA Privacy Rule to Support Reproductive Health Care Privacy final rule (“RHC Rule”) was published in April of last year, it carried an effective date of June 25, 2024.  Covered entities had 180 days from the effective date to comply with the RHC Rule’s provisions, except the requirements related to the Notice of Privacy Practices (“NPP”).  At the same time that it finalized the RHC Rule, the Department of Health and Human Services also finalized the NPP provisions of the 2024 Part 2 Rule.  Because the 2024 Part 2 Rule also included several revisions to the NPP, the Department aligned the compliance date for the NPP provisions of both final rules to February 16, 2026.

With the change of Administration in January, there was a great deal of speculation around the future of the RHC Rule and whether there would be immediate actions taken to attempt to repeal or rescind the RHC Rule.  This uncertainty was compounded by four separate lawsuits representing at least 17 states that had already been filed challenging the RHC Rule.  Fast forward to the end of May and instead of actions to repeal or replace, we have seen the Department reference sensitive reproductive health care information in its enforcement actions.  Also, the Department has filed various motions in the pending lawsuits that appear to be attempting to preserve the federal government’s autonomy to make rules that are outside of judicial challenge.  This legal and political posturing is likely to go on for some time in the future.

Thus, we believe it is time to review your current NPP and prepare new drafts based on the provisions of the RHC Rule and the 2024 Part 2 Rule.  The new provisions include, among other things, a requirement to provide a description, including at least one example, of the types of uses and disclosures prohibited under the RHC Rule and a description, including at least one example, of the types of uses and disclosures for which an attestation is required.  Covered entities that create or maintain Part 2 records are required to include several new provisions, including providing notice to individuals of the ways in which the covered entity may use and disclose such records and of the individual’s rights and the covered entity’s responsibilities with respect to such records.  Unrelated specifically to reproductive health care or Part 2, the NPP must also include a new provision informing individuals that once their information is disclosed, it may be subject to redisclosure by the recipient and no longer protected by HIPAA.  These are only a few examples of the new requirements.

Also, do not forget the provisions of the May 2024 final rule under Section 1557 of the Patient Protection & Affordable Care Act (“Section 1557 Rule”) which requires covered entities to include the Notice of Availability in certain publications and communications, including the Notice of Privacy Practices, on or before July 7, 2025.  The Notice of Availability is a short statement in English and in the top 15 non-English languages in the state where the covered entity is located that informs individuals that the covered entity, in its health programs or activities, provides language assistance services and appropriate auxiliary aids and services free of charge, when necessary for compliance with Section 1557 or its implementing regulations, to patients and members of the public.  If your covered entity has physical locations in multiple states, you are permitted to utilize an aggregated list for all of the states you provide services for all of your locations.

Because compliance with the RHC Rule is already required, you can include the RHC Rule and 2024 Part 2 Rule updates in the version that will be updated by July 7, 2025 for Section 1557 Rule compliance.  Please let us know if you need any assistance with reviewing and updating your NPP.