HIPAA’s reproductive health attestation put the burden of purpose on the requester

The week

On April 22, 2024, HHS announced a final rule modifying the HIPAA Privacy Rule to support reproductive health care privacy. It was published in the Federal Register on April 26. The rule barred covered entities and business associates from using or disclosing protected health information to investigate or impose liability on anyone for seeking, obtaining, providing or facilitating lawful reproductive health care. For four kinds of request (health oversight, judicial and administrative proceedings, law enforcement, and coroners and medical examiners), it required a signed attestation when the information sought was potentially related to reproductive health care. HHS published a model attestation form. The rule took effect in June 2024, with general compliance due December 23, 2024, and notice of privacy practices changes due February 16, 2026.

Earlier in this series we looked at the 2023 proposal and argued that any version of it would expose how poorly health records segment sensitive data. The final rule leaned on a different mechanism. Instead of asking providers to find reproductive health information and wall it off, it asked requesters to put their purpose in writing. That design choice divided the work into three parts: what the attestation moved onto requesters, what it left with the provider, and what no form could settle.

What the attestation moved onto requesters

For each of the four covered request types, the requester had to sign and date a statement when the information sought was potentially related to reproductive health care. The statement had to describe the information requested and identify the recipient. It had to confirm that the use or disclosure was not for a prohibited purpose. It also had to warn the signer that knowingly obtaining health information in violation of HIPAA can carry criminal penalties.

That shifted something tangible. Before the rule, a release-of-information clerk facing a facially valid subpoena had little basis to ask why the records were wanted. After it, the requester carried the burden of declaring purpose, under a federal penalty warning. For an investigator acting in good faith, the form cost a few minutes. For a request that was really a search for evidence against a patient or clinician, it created a signed record that could later be tested.

The shift had operational edges. The attestation had to be a standalone document, not language folded into a subpoena or another form. Requests that arrived without one had to be paused and returned. That meant a new outbound letter, a new status in the request-tracking system, and a follow-up clock. Outsourced release-of-information vendors, which handle a large share of hospital requests, needed the same logic in their procedures and business associate agreements. And each attestation covered one request. A long relationship with a local police department did not produce a standing attestation.

What stayed with the provider

The form did not end the provider’s judgment. Three tests remained on the hospital’s side of the desk.

The first was scope. The provider had to decide whether a request was potentially related to reproductive health care at all. The rule defined that care broadly, well beyond abortion, to include care affecting the reproductive system across a patient’s life. A request for a full chart could qualify without mentioning pregnancy. Many privacy offices concluded that the simplest intake rule was to require an attestation for every request in the four categories unless its scope clearly excluded such care.

The second was reliance. A provider could not rely on an attestation if it had actual knowledge that material information in it was false. Nor could it rely on one that a reasonable covered entity in the same position would not believe. That standard put weight on context. A request from an out-of-state agency in a state that restricts the care in question looks different from a routine local inquiry. Staff needed written criteria for noticing the difference, or the standard meant nothing in practice.

The third was the presumption of lawfulness. Where someone other than the receiving provider had delivered the care, it was presumed lawful. The presumption fell away if the provider had actual knowledge otherwise, or if the requester supplied a substantial factual basis that the care was unlawful. Weighing whether a factual showing is substantial is legal work. It does not belong with a clerk working a queue.

The workable answer was a two-tier process. Front-line staff applied a short checklist: request category, attestation present, standalone, complete and signed. Anything that failed, or that raised the reliance or presumption questions, went to the privacy office with a target response time. That second tier needed its own staffing and an on-call route to counsel, because court deadlines do not wait for a review queue.

What no form could settle

Some exposure sat outside the attestation entirely. The first was state law. Some states require disclosure to their own investigators. Others had moved the other way, passing shield laws that limit cooperation with out-of-state process against reproductive or gender-affirming care. A health system with patients in several states could face a valid state demand and a federal prohibition on the same request. Only counsel could resolve that, case by case.

The second was the rule’s own footing. Within months it faced lawsuits, including one brought by Texas and another, Purl v. HHS, brought by a Texas physician and her clinic. Compliance teams had to build for a December 2024 date knowing the obligation might not survive. The sensible design was reversible. Teams could implement the attestation as a configurable stage in the request workflow, with its own letter templates and status codes, rather than rebuilding the whole sensitive-request process around it.

The third was evidence. If a disclosure was challenged by a patient, a regulator or a court, the provider would need to show what was requested and which test it applied. It would also need to show who decided and which attestation it relied on. Many release-of-information systems stored the request and the released pages but not the decision. Adding a decision record, with the attestation attached and the reviewer named, was the cheapest durable control the rule prompted.

Taken together, the final rule asked less of health IT than the proposal implied, and more of people and process. The data segmentation gap described in the earlier article did not close. The attestation moved the first line of defense from the record to the request. Organizations should check with counsel on how federal and state requirements apply to their own footprint.

With hindsight

The attestation had a short working life. On December 22, 2024, the day before general compliance, a federal court in the Northern District of Texas barred enforcement against the plaintiffs in Purl v. HHS. On June 18, 2025, the same court vacated most of the rule nationwide, holding that HHS had exceeded its authority. HHS chose not to appeal, and the Fifth Circuit dismissed a related appeal in September 2025. The attestation requirement is no longer in force. The court left in place the notice of privacy practices changes tied to the 42 CFR Part 2 substance use disorder rule, with their February 16, 2026 deadline.

What held up was the process built around the form. Two-tier review, decision records and configurable workflow stages proved useful for every sensitive request type, including behavioral health, substance use and minors’ records. State laws on reproductive and gender-affirming care records continued to diverge, so the scope and reliance questions did not disappear with the federal rule. They moved to state law.