Skip to content
Baldwin Bulletin

HHS Finalizes Rule to Strengthen Reproductive Health Care Privacy

The Baldwin Group
Updated: June 7, 2024
3 minute read

On April 22, 2024, the Department of Health and Human Services (“HHS”) issued a final rule to modify certain provisions of the HIPAA Privacy Rule to support reproductive health care privacy in response to the U.S. Supreme Court’s holding in Dobbs v. Jackson Women’s Health Organization, as well as several subsequent state abortion bans. The new rulemaking strengthens protections concerning the use and disclosure of reproductive health care information. In doing so, the Final Rule seeks to protect access to and the privacy of reproductive health care and bolster patient-provider confidentiality.

Employer Action Items

The Final Rule has significant implications for covered entities and business associates that handle reproductive health information, such as health plans, health care providers, health care clearinghouses, their contractors, and other vendors. These entities should take the following steps to ensure compliance with the new requirement before the deadline:

  • Review and update policies and procedures regarding the use and disclosure of protected reproductive health information, providing training where appropriate to their workforce members regarding such changes.
  • Implement appropriate safeguards to protect the privacy and security of protected reproductive health information, such as encryption, access controls, and audit trails.
  • Revise notices of privacy practices and other communications to inform individuals of their rights and responsibilities related to reproductive health information.
  • Obtain written authorizations from individuals before using or disclosing such information for purposes other than treatment, payment, health care operations, or as required by law.
  • Develop a process to respond to requests from individuals to access, amend, restrict, or delete their reproductive health information, to file complaints, or report breaches involving such information.


On April 22, 2024, HHS’ Office for Civil Rights (“OCR”) issued a final rule to modify certain provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule. These modifications aim to support reproductive health care privacy in response to the U.S. Supreme Court’s holding in Dobbs v. Jackson Women’s Health Organization and subsequent state-level abortion bans. The Final Rule is effective June 25, 2024.

Covered health care providers, health plans, health care clearinghouses, and their business associates (collectively, “Regulated Entities”) must comply with all provisions of the Final Rule by December 22, 2024, except for updating their Notice of Privacy Practices, which they have until February 16, 2026, to perfect.

In response to the Dobbs decision, OCR released guidance materials in June 2022 emphasizing HIPAA’s role in safeguarding women’s protected health information (“PHI”). The purpose-based motivations are to ensure that developments in federal and state law do not diminish individuals’ expectations of privacy regarding their health information, leading to distrust and refusal to access health care.

The final rule prohibits covered entities from using or disclosing PHI for the criminal, civil or administrative investigation of (or any other proceeding against) any person in connection with seeking, obtaining, providing or facilitating reproductive healthcare, where such healthcare is lawful under the circumstances in which it is provided. It also prohibits the identification of any person for the purpose of initiating an investigation or proceeding. This prohibition applies where a regulated entity reasonably determines that:

  • The reproductive healthcare is lawful under the law of the state in which such healthcare is provided (and under the circumstances in which it is provided). Or,
  • The reproductive healthcare is protected, required or authorized by federal law, including the U.S. Constitution, regardless of the state in which such health care is provided.

When a covered entity did not provide the reproductive health care at issue, the final rule prohibits the use or disclosure of PHI if the person making the request does not provide sufficient information to overcome a presumption of illegality. To implement the prohibition, when a regulated entity receives a request for PHI potentially related to reproductive health care, the regulated entity must obtain a signed attestation that the use or disclosure is not for a prohibited purpose.

The Final Rule aims to protect access to and privacy of reproductive health care while bolstering patient-provider confidentiality.

For More Information

LINK to the Federal Register for April 26, 2024.

Related Insights

Stay in the know

Our experts monitor your industry and global events to provide meaningful insights and help break down what you need to know, potential impacts, and how you should respond.

Baldwin Bulletin
Question of the Month
Question: Can a company shareholder with >2% shares in an S Corporation be an HSA-Eligible Individual?  IRS Publication 969 appears...
Baldwin Bulletin
Change Healthcare, a U.S. Healthcare Company, is Confirmed as a Cyberattack
On February 21, 2024, UnitedHealth Group disclosed that one of its companies, Change Healthcare, experienced a cyberattack. This was a...
Baldwin Bulletin
Navigating Healthcare Costs: Update on Advanced Explanation of Benefits (AEOB)
On April 23, 2024, the Centers for Medicare & Medicaid Services (“CMS”) provided a status update on the implementation of...
Baldwin Bulletin
DOL Rescinds 2018 Final Rule on Association Health Plans
The Department of Labor (“DOL”) rescinded their 2018 rule entitled ‘‘Definition of Employer Under Section 3(5) of ERISA—Association Health Plans’’...
Baldwin Bulletin
IRS Announces 2025 Affordable Care Act Pay-or-Play Penalties
On February 12, 2024, the Internal Revenue Service (“IRS”) announced updated penalty amounts for 2025 related to the employer shared...
Let's make it possible

Partner with us to build solutions that align with your business, individual, or employee needs and open new possibilities for your future.

Connect with us