2024 HIPAA Final Rule: The New Attestation Requirement

On June 25, 2024, changes to the HIPAA Privacy Rule aimed at supporting reproductive health care privacy went into effect. Last week, I published a blog post about these changes, including the creation of three new types of prohibited uses and disclosures of protected health information (PHI). This post addresses another major change to the law: a new attestation requirement that applies to four types of uses and disclosures when the PHI at issue is “potentially related” to reproductive health care. It’s not just covered entities and business associates that need to understand this new requirement- judicial officials, law enforcement, health oversight agencies, and medical examiners who frequently request PHI to carry out their official duties will likely encounter situations that require them to comply with the new attestation requirement, too. Background Numerous changes to the HIPAA Privacy Rule, including the new attestation requirement, are the result of a Final Rule that was published by the U.S. Department of Health and Human Services (HHS) on April 26, 2024. For more information about what prompted promulgation of the Final Rule, a summary of key changes, and an in-depth look at the Final Rule’s creation of new prohibited uses and disclosures of PHI, please see this blog post. Important Dates The changes initiated by the Final Rule went into effect on June 25, 2024. Entities that must abide by HIPAA (covered entities and business associates) must come into compliance with these new requirements- including the attestation requirement- no later than December 23, 2024. [...]