Reproductive Health PHI Attestation Requirements Under HIPAA: What’s Required and Key Deadlines

HIPAA Privacy Rule Amendments for Reproductive Health

In April 2024, HHS finalized HIPAA Privacy Rule changes intended to strengthen protections for Protected Health Information (PHI) related to reproductive health care. The rule took effect on June 25, 2024, with a general compliance date of December 23, 2024, and a later Notice of Privacy Practices (NPP) compliance date of February 16, 2026. These amendments introduced a new prohibition on certain uses and disclosures and, critically, an “attestation” condition for specified requests. ([govinfo.gov](https://www.govinfo.gov/content/pkg/FR-2024-04-26/pdf/2024-08503.pdf))

Key features included: a prohibition on using or disclosing PHI to investigate or impose liability for seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances; a presumption that out‑of‑state care was lawful absent contrary knowledge; and an attestation requirement for certain categories of requests. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

Attestation Requirement Details

The 2024 rule required a signed attestation statement before disclosing PHI potentially related to reproductive health care for four categories: health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners. The attestation could be electronic but could not be combined with other documents (for example, a subpoena), and it verified that the request was not for a prohibited purpose. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

Important update: On June 18, 2025, the U.S. District Court for the Northern District of Texas largely vacated the 2024 reproductive health amendments nationwide. As a result, HIPAA no longer requires an attestation for those requests. Covered entities and business associates should revert to baseline HIPAA permissions and conditions for those disclosures. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

Required Attestation Content

For historical reference (i.e., what the now‑vacated rule required), a valid attestation had to be in plain language and include only these elements:

• A specific description of the PHI requested (naming the individual(s) if practicable or describing the class of individuals). ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.509))
• The identity of the person(s) asked to make the disclosure and the person(s) to receive it. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.509))
• A clear statement that the use or disclosure is not for a prohibited purpose under the HIPAA Privacy Rule’s reproductive health provision. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.509))
• A statement warning of potential criminal penalties under 42 U.S.C. 1320d‑6 for knowingly obtaining or disclosing IIHI in violation of HIPAA. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.509))
• The requester’s signature (electronic allowed) and date; if signed by a representative, a description of the representative’s authority. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.509))

Adding extra content made the attestation defective, and combining it with other documents (a “compound” attestation) was prohibited. HHS also released a model attestation before the December 2024 compliance date, which many organizations adopted at the time. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.509))

Notice of Privacy Practices Updates

The court’s 2025 decision vacated only certain NPP paragraphs tied to reproductive health (45 CFR 164.520(b)(1)(ii)(F)–(H)). However, other NPP modifications—particularly those aligning HIPAA with 42 CFR Part 2 (substance use disorder records)—remained intact, with a compliance deadline of February 16, 2026. If you inserted reproductive‑health‑specific NPP language in 2024–2025, you should remove it and ensure your NPP reflects the surviving HIPAA/Part 2 changes. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

Legal Challenges and Court Decisions

Multiple lawsuits targeted the 2024 amendments. On June 18, 2025, in Carmen Purl, M.D., et al. v. HHS, the Northern District of Texas held that HHS exceeded its statutory authority and vacated most of the reproductive health rule nationwide, including the prohibition and the attestation requirement. The court’s opinion relied on, among other reasoning, limits on curtailing state investigative authority. ([litigationtracker.law.georgetown.edu](https://litigationtracker.law.georgetown.edu/wp-content/uploads/2024/10/Purl_2025.06.18_MEMORANDUM-OPINION-AND-ORDER.pdf?utm_source=openai))

Subsequently, on September 10, 2025, the Fifth Circuit dismissed an appeal, leaving the district court’s vacatur in place. With that dismissal, the reproductive‑health‑specific HIPAA amendments remain vacated nationwide, while the NPP changes unrelated to reproductive health continue to apply. ([litigationtracker.law.georgetown.edu](https://litigationtracker.law.georgetown.edu/wp-content/uploads/2024/10/PURL-M.D.-et-al_2025-09-10_APPELLATE-ORDER.pdf?utm_source=openai))

Impact of Court Rulings on Compliance

What you must do now

• Do not require a HIPAA reproductive health attestation for disclosures to health oversight agencies, in judicial proceedings, for law enforcement access, or to coroners/medical examiners; that condition was vacated on June 18, 2025. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))
• Apply baseline HIPAA Privacy Rule standards to all requests, including the “required by law” condition, minimum necessary (where applicable), and existing permissions in 45 CFR 164.512 for health oversight, judicial/administrative proceedings, and law enforcement. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))
• Update internal policies, request‑handling workflows, training, and templates to remove now‑inoperative attestation steps, and document your revised decision trees for responding to subpoenas, court orders, and government inquiries. ([alston.com](https://www.alston.com/en/insights/publications/2025/06/texas-2024-hipaa-reproductive-rule?utm_source=openai))

What still has a deadline

• NPP updates were due February 16, 2026 for the surviving modifications, primarily to incorporate Part 2 alignment. If you have not completed this update, prioritize immediate compliance and distribution. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html?utm_source=openai))

Current Compliance Status and Deadlines

Timeline at a glance

• April 26, 2024: Final rule published; effective June 25, 2024; general compliance by December 23, 2024. ([govinfo.gov](https://www.govinfo.gov/content/pkg/FR-2024-04-26/pdf/2024-08503.pdf))
• June 18, 2025: Federal district court vacates most of the reproductive‑health amendments nationwide, eliminating the HIPAA attestation requirement. ([litigationtracker.law.georgetown.edu](https://litigationtracker.law.georgetown.edu/wp-content/uploads/2024/10/Purl_2025.06.18_MEMORANDUM-OPINION-AND-ORDER.pdf?utm_source=openai))
• September 10, 2025: Fifth Circuit dismisses appeal; vacatur remains in effect. ([litigationtracker.law.georgetown.edu](https://litigationtracker.law.georgetown.edu/wp-content/uploads/2024/10/PURL-M.D.-et-al_2025-09-10_APPELLATE-ORDER.pdf?utm_source=openai))
• February 16, 2026: Deadline to implement remaining NPP updates (e.g., Part 2 alignment); reproductive‑health‑specific NPP items are not required due to the vacatur. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html?utm_source=openai))

Conclusion

Bottom line: The HIPAA attestation requirement for reproductive health PHI is not in force following the June 18, 2025 ruling, and entities should follow the standard HIPAA Privacy Rule pathways for Health Oversight Activities, Judicial Proceedings Disclosure, and Law Enforcement Access. Ensure your NPP reflects the surviving, non‑reproductive‑health updates by the February 16, 2026 deadline. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

FAQs

What are the attestation requirements for reproductive health PHI under HIPAA?

As of June 18, 2025, there is no HIPAA attestation requirement for reproductive health PHI. The 2024 rule had required a signed, stand‑alone attestation for certain requests, but the Purl decision vacated that requirement nationwide. Entities must instead apply the usual HIPAA permissions and conditions in 45 CFR 164.512 when responding to requests. ([litigationtracker.law.georgetown.edu](https://litigationtracker.law.georgetown.edu/wp-content/uploads/2024/10/Purl_2025.06.18_MEMORANDUM-OPINION-AND-ORDER.pdf?utm_source=openai))

When must covered entities update their Notice of Privacy Practices for reproductive health?

Reproductive‑health‑specific NPP language was vacated with the court’s 2025 ruling. However, covered entities still had to meet the February 16, 2026 NPP deadline for surviving changes—primarily to align HIPAA with 42 CFR Part 2 (SUD records). If you added reproductive‑health NPP examples in 2024–2025, remove them and ensure Part 2 content is in place. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html?utm_source=openai))

How did the 2025 court decision affect the attestation requirement?

The Northern District of Texas vacated most of the 2024 reproductive health amendments on June 18, 2025, eliminating the attestation requirement nationwide. The Fifth Circuit later dismissed an appeal, so the vacatur remains operative. ([litigationtracker.law.georgetown.edu](https://litigationtracker.law.georgetown.edu/wp-content/uploads/2024/10/Purl_2025.06.18_MEMORANDUM-OPINION-AND-ORDER.pdf?utm_source=openai))

What are the penalties for unauthorized disclosure of reproductive health PHI?

Unauthorized disclosure of reproductive health PHI is treated like any impermissible HIPAA use or disclosure. Civil money penalties may be imposed under the HIPAA Enforcement Rule (45 CFR Part 160, Subparts C–E), and criminal penalties for knowing wrongful disclosures may be pursued under 42 U.S.C. 1320d‑6. Penalty tiers are inflation‑adjusted and depend on culpability and circumstances. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/enforcement-rule/index.html?utm_source=openai))