In light of a recent final rule issued by HHS, all group health plans will need to update their Notice of Privacy Practices and redistribute the updated notice by February 16, 2026 to incorporate (i) notice requirements for covered entities creating or maintaining records protected under 42 CFR part 2 (related to substance use disorder patient records) and (ii) a description of the new prohibition on use or disclosure of certain protected health information (“PHI") related to reproductive health care.
The new final rule prohibits the use or disclosure of PHI for the purpose of investigating or imposing liability related to reproductive health care if the reproductive health care is either (i) lawful in the state in which it was provided under the circumstances in which it was provided or (ii) protected, required or authorized by federal law. In other words, this prohibition limits covered entities from using and disclosing PHI for the purpose of investigating or imposing liability related to reproductive health care that is legally provided under state or federal law, but it does not limit the use or disclosure of PHI related to reproductive health care that was not legally provided under state or federal law, although current HIPAA restrictions regarding use and disclosure of PHI continue to apply.
In addition, the final rule prohibits a covered entity, such as an employer-sponsored group health plan (or its business associate), from using or disclosing PHI potentially related to reproductive health care for health oversight activities, judicial and administrative proceedings, law enforcement purposes, or to coroners and medical examiners, without obtaining a valid attestation that the use or disclosure is not for a prohibited purpose. Group health plans subject to HIPAA must comply with this new prohibition and attestation requirement by December 23, 2024.
The final rule is available here.
The new final rule prohibits the use or disclosure of PHI for the purpose of investigating or imposing liability related to reproductive health care if the reproductive health care is either (i) lawful in the state in which it was provided under the circumstances in which it was provided or (ii) protected, required or authorized by federal law. In other words, this prohibition limits covered entities from using and disclosing PHI for the purpose of investigating or imposing liability related to reproductive health care that is legally provided under state or federal law, but it does not limit the use or disclosure of PHI related to reproductive health care that was not legally provided under state or federal law, although current HIPAA restrictions regarding use and disclosure of PHI continue to apply.
In addition, the final rule prohibits a covered entity, such as an employer-sponsored group health plan (or its business associate), from using or disclosing PHI potentially related to reproductive health care for health oversight activities, judicial and administrative proceedings, law enforcement purposes, or to coroners and medical examiners, without obtaining a valid attestation that the use or disclosure is not for a prohibited purpose. Group health plans subject to HIPAA must comply with this new prohibition and attestation requirement by December 23, 2024.
The final rule is available here.