The Latest on the Reproductive Health Care Rule: HHS Publishes Model Attestation while Texas AG Seeks to Enjoin Enforcement

The HIPAA Privacy Rule to support Reproductive Health Care Privacy (“Reproductive Health Care Rule”) went into effect on June 25, 2024, and compliance with most of the Final Rule is required by December 23, 2024.  One of the most significant aspects of the Reproductive Health Care Rule in terms of changing work flow is the requirement to obtain an attestation in many common disclosure scenarios.  The Reproductive Health Care Rule requires that the covered entity or business associate obtain an attestation from the requesting entity/individual for any disclosure of protected health information that potentially relates to reproductive health care if the request is for purposes of health oversight, judicial and administrative proceedings, law enforcement, or to coroners and medical examiners.  The requirement to obtain this attestation will be burdensome on health care providers and their business associates as the scenarios in which the attestation will be required are expansive.  For example, if CMS initiates an EMTALA survey at a hospital, before the hospital can disclose the log of patients seen in the Emergency Department for a specified time period, the hospital will need to obtain an attestation from the surveyors before providing the log of names if any name is of an individual with information in the medical record that potentially relates to reproductive health care.  The name alone on the log would potentially relate to reproductive health care. 

Not only is determining when an attestation will be required challenging but the contents of the attestation also must be precise.  To aid covered entities and business associates in meeting the attestation requirements, HHS recently released a model attestation.  Using this model attestation will avoid any later challenge by HHS that the form of attestation was defective.  Covered entities and business associates still have the challenge of assuring it is reasonable to rely on the attestation.  In the preamble to the Reproductive Health Care Rule, HHS notes that covered entities and business associates are “not required to investigate the validity of an attestation” but nevertheless require such entities to reasonably determine that the request is not for one of the prohibited purposes. The preamble notes that examination of adequate supporting documentation provided by the person making the request would be a method of reasonably determining that the requested disclosure is not for a prohibited purpose.  They encourage a review of: (i) who is requesting the PHI; (ii) the permission upon which the person making the request is relying; (iii) the information provided to satisfy other conditions of the relevant permission; and (iv) the PHI requested and its relationship to the stated purpose of the request.  89 Fed. Red. at 33036 (April 26, 2024).

While covered entities and business associates are preparing for the compliance deadline, the Texas Attorney General recently filed suit against HHS in the Northern District of Texas seeking to enjoin enforcement of not only the Reproductive Health Care Rule but also a portion of the 2000 HIPAA Privacy Rule addressing what can be disclosed to state investigators—both of which they say exceed statutory authority and are arbitrary and capricious.  The Texas AG argues that “the original HIPAA statue explicitly preserves the investigative authority of State law enforcement, and the law in no way gives HHS the authority to allow HIPAA-regulated institutions to refuse to cooperate with State investigations.”  Texas AG Press Release, September 4, 2024.  Texas courts have a recent history of entering decisions that have the effect of imposing nationwide bans on enforcement, as this same Northern District of Texas was the forum for the recent ruling that prevented the FTC from enforcing its proposed rule banning almost all non-compete clauses.  In this case, the Texas AG has asked the court to vacate and set aside the Reproductive Health Care Rule and the 2000 Privacy Rule so we will be watching closely for developments in this case as the compliance deadline draws near.