Mid-Atlantic Health Law TOPICS

In an effort to support reproductive health care privacy, as of December 23, 2024, providers must comply with a Final Rule promulgated by the Department of Health and Human Services (HHS). 

The Final Rule was issued in response to state abortion bans and other restrictions on reproductive freedom across the country following the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization. 

The goal of the Final Rule is to bolster patient-provider confidentiality and reproductive health privacy; however, it is unclear whether the Final Rule will be altered, and unclear how the Final Rule will be enforced, even if unaltered, by the newly elected Administration.  

Prohibition Requirement  

Now, covered entities and business associates are prohibited from responding to requests for the disclosure of protected health information (PHI) related to reproductive health care if it is reasonably determined that the PHI is being used for any of the following purposes: 

1. To conduct a criminal, civil, or administrative investigation into that care; 
2. To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided; or
3. To identify any person for the purpose of conducting such investigation or imposing such liability. 

If the reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided or if it is protected, required, or authorized by federal law (regardless of the state), then the prohibition applies. 

Additional Updates    

When a covered entity receives a request for PHI potentially related to reproductive health care, the entity must obtain a signed attestation from the requester that the use or disclosure is not for a prohibited purpose. This attestation requirement applies when the request for PHI is for health oversight activities, judicial or administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners. 

The Final Rule also includes a presumption that any reproductive health care provided by a person other than the covered entity receiving the request was lawfully provided. 

The only time this presumption does not apply is if the covered entity has actual knowledge that the reproductive health care was not lawful (that is, an individual discloses to their doctor that they received care from an unlicensed provider), or the covered entity receives factual information from the person making the request for disclosure of PHI that demonstrates a substantial factual basis that the reproductive health care was not lawful. 

Finally, the Rule requires covered entities to revise their Notice of Privacy Practices to support reproductive health care privacy by February 16, 2026.

Kennedy Hagens
410-576-4146 • khagens@gfrlaw.com