HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy |
Prohibition
____Covered Entity Name or Business Associate Name Here _______ may not use or disclose PHI for the following purposes:
(1) To conduct a criminal, civil, or administrative investigation into any person for the sole act of seeking, obtaining, providing, or facilitating lawful reproductive health care.
(2) To impose criminal, civil, or administrative liability on any person for the sole act of seeking, obtaining, providing, or facilitating lawful reproductive health care.
(3) To identify any person for any purpose described in (1) or (2).
Prohibition Application
The prohibition applies when the reproductive health care at issue (1) is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided, (2) is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided, or (3) is provided by another person and presumed lawful.
Prohibition Implementation
When _____ Covered Entity Name or Business Associate Name Here ______receives a request for protected health information (PHI) potentially related to reproductive health care, it must obtain a signed attestation that clearly states the requested use or disclosure is not for the prohibited purposes described above, where the request is for PHI for any of the following purposes:
Health oversight activities
Judicial or administrative proceedings
Law enforcement
Regarding decedents, disclosures to coroners and medical examiners
Additional Information
____ Covered Entity Name Or Business Associate Name Here ____ may not rely on the attestation to disclose the requested PHI if any of the following is true:
It is missing any required element or statement or contains other content that is not required.
It is combined with other documents, except for documents provided to support the attestation.
____ Covered Entity Name Or Business Associate Name Here _______ knows that material information in the attestation is false.
A reasonable covered entity or business associate in the same position would not believe the requestor’s statement that the use or disclosure is not for a prohibited purpose as described above.
If ____ Covered Entity Name Or Business Associate Name Here _______ later discovers information that reasonably shows that any representation made in the attestation is materially false, leading to a use or disclosure for a prohibited purpose as described above, ____ Covered Entity Name Or Business Associate Name Here ______ will stop making the requested use or disclosure.
____ Covered Entity Name Or Business Associate Name Here _____ may not make a disclosure if the reproductive health care was provided by a person other than ___ Covered Entity Name Or Business Associate Name Here ______ and the requestor indicates that the PHI requested is for a prohibited purpose as described above, unless the requestor supplies information that demonstrates a substantial factual basis that the reproductive health care was not lawful under the specific circumstances in which it was provided. (Do not include if receiving organization does not perform re-disclosure.)
_____ Covered Entity Name Or Business Associate Name Here _______ must obtain a new attestation for each specific use or disclosure request.
_____ Covered Entity Name Or Business Associate Name Here ____ will maintain a copy of the completed attestation, and any relevant supporting documents.
Comments