HIPAA reproductive health PHI final rule

Hey Plan Sponsors, make sure this gets done this week.

The HIPAA Reproductive PHI (rPHI) Final Rule goes into effect next Monday (December 23, 2024).

Here’s what you need to know before then:

In April, HHS finalized HIPAA updates to protect reproductive healthcare privacy.
Starting next Monday, December 23, group health plans cannot use or disclose PHI related to lawful or presumed lawful reproductive healthcare if it’s sought to:

1. Conduct an investigation.

2. Impose civil, criminal, or administrative liability.

3. Identify someone for liability or investigation purposes.

Action Items by December 23, 2024:

• Prepare a reproductive health PHI attestation form (HHS model here: https://lnkd.in/ez88Gy2h).

• Update HIPAA policies, procedures, and training.

• Review and revise business associate agreements for compliance.

Don’t forget:
By February 16, 2026, update your Notice of Privacy Practices (NPP) to reflect the new requirements.

Pro tip: Do it sooner—material changes require participant notifications.

Where’s your organization on this compliance timeline?

P.S. Bookmark this post for quick access to the model attestation form and action steps.