Organization Logo Here |
Attestation Template | Requests for PHI Potentially Related to Reproductive Healthcare
Prohibition
Covered entities and their business associates may not use or disclose PHI for the following purposes:
(1) To conduct a criminal, civil, or administrative investigation into any person for the sole act of seeking, obtaining, providing, or facilitating lawful reproductive health care.
(2) To impose criminal, civil, or administrative liability on any person for the sole act of seeking, obtaining, providing, or facilitating lawful reproductive health care.
(3) To identify any person for any purpose described in (1) or (2).
Prohibition Application
The prohibition applies when the reproductive health care at issue (1) is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided, (2) is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided, or (3) is provided by another person and presumed lawful.
Prohibition Implementation
When a HIPAA covered entity or business associate receives a request for protected health information (PHI) potentially related to reproductive health care, it must obtain a signed attestation that clearly states the requested use or disclosure is not for the prohibited purposes described above, where the request is for PHI for any of the following purposes:
Health oversight activities
Judicial or administrative proceedings
Law enforcement
Regarding decedents, disclosures to coroners and medical examiners
Attestation | The entire form must be completed for the attestation to be valid.
Instructions
By signing this attestation, you are verifying that you are not requesting PHI for a prohibited purpose and acknowledging that criminal penalties may apply if untrue.
You may not add content that is not required or combine this form with another document except where another document is needed to support your statement that the requested disclosure is not for a prohibited purpose. Include this example only if receiving organization performs re-disclosure: For example, if the requested PHI is potentially related to reproductive health care that was provided by someone other than _____the covered entity name here ____or _____business associate name here ____ from whom you are requesting the PHI, you may submit a document that supplies information that demonstrates a substantial factual basis that the reproductive health care in question was not lawful under the specific circumstances in which it was provided.)
Requesting Organization Name:
____________________________________e.g., name of agency making the request______________________
Requester Full Name:
______________________e.g., name of investigator and/or agency making the request_____________________________
Requester Role: ___________________________________________
Description of specific PHI requested, including name(s) of individual(s), if practicable, or a description of the class of individuals, whose protected health information you are requesting:
____________________________e.g., visit summary for [name of individual] on [date]; list of individuals who obtained [name of prescription medication] between [date range]____________________________________________
________________________________________________________________________
________________________________________________________________________
I attest that the use or disclosure of PHI that I am requesting is not for a purpose prohibited by the HIPAA Privacy Rule at 45 CFR 164.502(a)(5)(iii) because of one of the following (check one box):
☐ The purpose of the use or disclosure of protected health information is not to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care or to identify any person for such purposes.
☐ The purpose of the use or disclosure of protected health information is to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, or to identify any person for such purposes, but the reproductive health care at issue was not lawful under the circumstances in which it was provided. (See permitted uses and disclosures under the privacy rule.)
I understand that I may be subject to criminal penalties pursuant to 42 U.S.C. 1320d-6 if I knowingly and in violation of HIPAA obtain individually identifiable health information relating to an individual or disclose individually identifiable health information to another person.
Requester Signature: __________________________________________
Date: ___ ___ _____
Additional Information
____Receiving Organization Name Here____ may not rely on the attestation to disclose the requested PHI if any of the following is true:
It is missing any required element or statement or contains other content that is not required.
It is combined with other documents, except for documents provided to support the attestation.
____Receiving Organization Name Here _______ knows that material information in the attestation is false.
A reasonable covered entity or business associate in the same position would not believe the requestor’s statement that the use or disclosure is not for a prohibited purpose as described above.
If ____Receiving Organization Name Here _______ later discovers information that reasonably shows that any representation made in the attestation is materially false, leading to a use or disclosure for a prohibited purpose as described above, ____Receiving Organization Name Here ______ will stop making the requested use or disclosure.
____ Receiving Organization Name Here _____ may not make a disclosure if the reproductive health care was provided by a person other than ___ Receiving Organization Name Here ______ and the requestor indicates that the PHI requested is for a prohibited purpose as described above, unless the requestor supplies information that demonstrates a substantial factual basis that the reproductive health care was not lawful under the specific circumstances in which it was provided. (Do not include if receiving organization does not perform re-disclosure)
_____ Receiving Organization Name Here _______ must obtain a new attestation for each specific use or disclosure request.
_____ Receiving Organization Name Here ____ will maintain a copy of the completed attestation, and any relevant supporting documents.
This attestation document may be provided in electronic format, and electronically signed by the person requesting the protected health information when the electronic signature is valid under applicable Federal and state law.
HIPAA Privacy Rule To Support Reproductive Health Care Privacy
Effective Date: 06/25/2024
Compliance Date: by 12/23/2024
45 CFR 164.520 (NPP) in this final rule by 02/16/2026.
Comments