HIPAA’s reproductive health attestation put the burden of purpose on the requester

The week

On April 22, 2024, the Department of Health and Human Services (HHS) announced a final rule modifying the HIPAA Privacy Rule to support reproductive health care privacy. HIPAA is the federal law that sets the ground rules for how health information is protected, and the Privacy Rule is the part that says when patient information may be used or shared. The new rule was published in the Federal Register, the government’s official journal of rules, on April 26.

Its weight fell on the release-of-information desk at a hospital: the small, often overlooked team that handles requests for patient records from lawyers, insurers, courts and police. For years, much of their work was clerical. A request arrived, the paperwork looked valid, and the records went out. Now the federal government asked that desk to start asking a new question: why do you want this?

The rule barred covered entities and business associates from using or disclosing protected health information to investigate or impose liability on anyone for seeking, obtaining, providing or facilitating lawful reproductive health care. Covered entities are health plans, most health care providers and similar organizations. Business associates are the outside firms that handle patient data on their behalf. Protected health information is any health information that can be tied to an individual.

The rule’s practical engine was a form. For four kinds of request (health oversight, judicial and administrative proceedings, law enforcement, and coroners and medical examiners), it required a signed attestation when the information sought was potentially related to reproductive health care. An attestation is a signed statement that something is true, in this case a statement about the purpose of the request. HHS published a model attestation form for requesters to use.

The timetable ran in stages. The rule took effect in June 2024, with general compliance due December 23, 2024, and notice of privacy practices changes due February 16, 2026. The notice of privacy practices is the document every provider must give patients explaining how their information may be used.

The effect was to move the first burden from the hospital to whoever wanted the records. That sounded simple, but it left a good deal of hard judgment behind.

The final rule did not depend on hospitals’ ability to segment sensitive data, which most record systems do poorly. Instead of asking providers to find reproductive health information and wall it off, it asked requesters to put their purpose in writing.

That design choice divided the work into three parts: what the attestation moved onto requesters, what it left with the provider, and what no form could settle. Each part holds lessons for any organization that must decide who may see sensitive information and why.

Records that do not sort neatly

HHS chose a form rather than a technical fix because of how health records are actually stored.

A modern hospital keeps an electronic health record, a large software system holding each patient’s history: visits, diagnoses, medications, test results, clinicians’ notes and billing codes. It is not organized like a set of folders labeled by topic. It is more like a long diary in which every entry can touch many subjects at once. A note from a routine visit might mention a past pregnancy, a medication list might include a contraceptive, and a lab result might relate to fertility.

Data segmentation means tagging and separating particular kinds of sensitive information so they can be withheld while the rest is shared. In principle it is straightforward. In practice, most record systems do it poorly. Sensitive details are scattered across free-text notes, codes and attachments. Pulling them out reliably, chart by chart, is slow and error-prone.

A keyword search finds the obvious entries and misses the indirect ones: abbreviations, scanned attachments, passing references in a note about something else. A hospital chart holds a great many of those.

Faced with that reality, the final rule took a different route. Rather than make the records smarter, it made the request more accountable.

How a records request travels through a hospital

Most executives never see the path a records request takes, so it is worth sketching. A request arrives by mail, fax, email or a secure portal. Someone logs it in a tracking system and identifies what kind of request it is: a patient asking for their own records, an insurer, a lawyer, a court, a public health agency or the police. Each category has its own rules under HIPAA about what may be released and what paperwork is needed.

The specialist then checks the paperwork, finds the relevant records in the electronic health record and other systems, decides which pages fall within the request, and assembles a package. A quality check follows, the release is logged, and the records go out. At many hospitals, much of this work is done by an outside release-of-information company working inside the hospital’s systems.

It is high-volume, deadline-driven work. Courts set dates. Lawyers chase. Patients call. The staff doing it are trained in procedure, not in weighing the motives of a police department in another state. That is the setting into which the 2024 rule dropped a new form and a set of new judgments.

What the attestation moved onto requesters

For each of the four covered request types, the requester had to sign and date a statement when the information sought was potentially related to reproductive health care. The statement had to describe the information requested and identify the recipient. It had to confirm that the use or disclosure was not for a prohibited purpose. It also had to warn the signer that knowingly obtaining health information in violation of HIPAA can carry criminal penalties.

That shifted something tangible. Before the rule, a release-of-information clerk facing a facially valid subpoena had little basis to ask why the records were wanted. A subpoena is a legal order to produce documents or testimony, and “facially valid” means it looks proper on its face. After the rule, the requester carried the burden of declaring purpose, under a federal penalty warning.

For an investigator acting in good faith, the form cost a few minutes. For a request that was really a search for evidence against a patient or clinician, it created a signed record that could later be tested. Most requesters would complete it honestly in seconds; for the few who would not, the signature becomes evidence.

The shift had operational edges. The attestation had to be a standalone document, not language folded into a subpoena or another form. Requests that arrived without one had to be paused and returned. That meant a new outbound letter, a new status in the request-tracking system, and a follow-up clock.

Outsourced release-of-information vendors, which handle a large share of hospital requests, needed the same logic in their procedures and business associate agreements. A business associate agreement is the contract that binds an outside firm to HIPAA’s rules when it handles patient data. If the hospital changes its process but its vendor does not, the change exists only on paper.

And each attestation covered one request. A long relationship with a local police department did not produce a standing attestation. Every new request needed a new signed statement.

For requesters, that was a change in habit. Investigators and court clerks who had sent records requests the same way for years now needed a separate form each time, and some requests inevitably arrived without one. Hospitals that explained the change to their regular requesters in advance, with a copy of the HHS model form, spent less time on returned requests and follow-up calls. Those that simply began returning incomplete requests created friction with partners they would keep working with long after the rule.

What stayed with the provider

The form did not end the provider’s judgment. Three tests remained on the hospital’s side of the desk.

Scope

The first was scope. The provider had to decide whether a request was potentially related to reproductive health care at all. The rule defined that care broadly, well beyond abortion, to include care affecting the reproductive system across a patient’s life. A request for a full chart could qualify without mentioning pregnancy. Many privacy offices concluded that the simplest intake rule was to require an attestation for every request in the four categories unless its scope clearly excluded such care.

Reliance

The second was reliance. A provider could not rely on an attestation if it had actual knowledge that material information in it was false. Nor could it rely on one that a reasonable covered entity in the same position would not believe. That standard put weight on context.

A request from an out-of-state agency in a state that restricts the care in question looks different from a routine local inquiry. Staff needed written criteria for noticing the difference, or the standard meant nothing in practice. A rule that says “use your judgment” without telling front-line staff what to look for usually produces either no judgment or inconsistent judgment.

The presumption of lawfulness

The third was the presumption of lawfulness. Where someone other than the receiving provider had delivered the care, it was presumed lawful. The presumption fell away if the provider had actual knowledge otherwise, or if the requester supplied a substantial factual basis that the care was unlawful. Weighing whether a factual showing is substantial is legal work. It does not belong with a clerk working a queue.

A two-tier desk

The workable answer was a two-tier process. Front-line staff applied a short checklist: request category, attestation present, standalone, complete and signed. Anything that failed, or that raised the reliance or presumption questions, went to the privacy office with a target response time. That second tier needed its own staffing and an on-call route to counsel, because court deadlines do not wait for a review queue.

Suppose a three-hospital system receives a law enforcement request for a patient’s full chart. The front-line specialist checks the category (law enforcement), sees that a full chart could include reproductive care, and looks for an attestation. One is attached, signed and standalone. On the checklist, it passes.

But the request comes from an agency in another state, and the patient’s chart shows care delivered by a different provider. Under the system’s written criteria, that combination routes the request to the privacy office. A privacy analyst reviews it the same day, consults counsel on whether the request supplies a substantial factual basis to overcome the presumption of lawfulness, and records the decision, the reasons and the attestation relied on. Whatever the outcome, the system can later show exactly what it did and why.

Compare that with a single-tier desk, where the same specialist must make every call alone, under time pressure, with no criteria. Some requests will be refused that should have been fulfilled, delaying legitimate investigations. Others will be fulfilled that should have been escalated. Neither error is visible until someone challenges it.

The two-tier model is not new. Banks use the same pattern for suspicious payments: front-line staff apply simple rules and escalate anything unusual to specialists. Its value lies in keeping the routine fast while giving hard cases to people trained to handle them.

What no form could settle

Some exposure sat outside the attestation entirely.

The first was state law. Some states require disclosure to their own investigators. Others had moved the other way, passing shield laws that limit cooperation with out-of-state process against reproductive or gender-affirming care. A shield law is a state law designed to protect patients and clinicians in that state from legal action originating elsewhere. A health system with patients in several states could face a valid state demand and a federal prohibition on the same request. Only counsel could resolve that, case by case.

The second was the rule’s own footing. Within months it faced lawsuits, including one brought by Texas and another, Purl v. HHS, brought by a Texas physician and her clinic. Compliance teams had to build for a December 2024 date knowing the obligation might not survive.

The sensible design was reversible. Teams could implement the attestation as a configurable stage in the request workflow, with its own letter templates and status codes, rather than rebuilding the whole sensitive-request process around it. Configurable here means the step can be switched on, changed or switched off through settings, without rewriting the system.

The third was evidence. If a disclosure was challenged by a patient, a regulator or a court, the provider would need to show what was requested and which test it applied. It would also need to show who decided and which attestation it relied on. Many release-of-information systems stored the request and the released pages but not the decision. Adding a decision record, with the attestation attached and the reviewer named, was the cheapest durable control the rule prompted.

The records desk as a board-level risk

For a hospital chief executive or board, a records desk can seem a long way from strategy. This rule showed why it is not.

The risks run in both directions. Releasing records improperly can harm patients, invite regulatory action and damage trust in a way that is hard to repair. Refusing or delaying legitimate requests can obstruct investigations, frustrate courts and create legal exposure of a different kind. Getting it right takes trained people, clear criteria and good records; a policy alone will not do it.

There are also cost and staffing implications. A second tier of review needs analysts and access to counsel at short notice. Outsourced vendors need updated contracts and procedures. Systems need new statuses, templates and decision records. By hospital standards the cost is modest, but all of it takes planning, and the people who do the work are often junior staff whose importance is noticed only when something goes wrong.

Taken together, the final rule asked less of health IT than the proposal implied, and more of people and process. The data segmentation gap did not close. The attestation moved the first line of defense from the record to the request. How federal and state requirements combine for a particular hospital system depends on where it operates, and is a question for its lawyers.

Habits of the hospitals that coped

Organizations that handled the rule well shared a few habits:

• A clear intake rule. For the four request categories, an attestation was required unless the scope clearly excluded reproductive care, so front-line staff were not left guessing.
• Written escalation criteria. Staff knew which features of a request, such as an out-of-state requester or care delivered elsewhere, sent it to the privacy office.
• A staffed second tier. Reviewers had time set aside and a fast route to counsel.
• Vendors brought along. Outsourced release-of-information firms had updated procedures and contract terms rather than an email about the change.
• Decision records. Every escalated request ended with a written record of the decision, the reviewer and the documents relied on.
• Reversible design. The attestation step could be changed or removed by configuration.

The failures were the opposite. Some hospitals updated their policy but not their vendor’s procedures. Some told staff to “use judgment” without saying what to look for. Some built the attestation so deeply into their workflow that removing it later meant another project. And some kept a perfect record of what was released but no record of why, leaving them unable to explain a decision months later.

What the records desk needs settled

1. Do front-line staff have a short written checklist for these requests, and what exactly triggers escalation?
2. Who reviews escalated requests, how quickly, and how do they reach legal counsel when a court deadline is close?
3. For each request we fulfill or refuse, do we record who decided, what test they applied and what documents they relied on?
4. In which states do we treat patients, and has counsel told us how each state’s disclosure or shield laws affect out-of-state requests?
5. When a regulation changes or is struck down, how quickly can we switch a workflow step on or off without rebuilding the system?

With hindsight

The attestation had a short working life. On December 22, 2024, the day before general compliance, a federal court in the Northern District of Texas barred enforcement against the plaintiffs in Purl v. HHS. On June 18, 2025, the same court vacated most of the rule nationwide, holding that HHS had exceeded its authority. To vacate a rule is to set it aside entirely, as if it had not been issued. The attestation requirement fell with it.

Not everything went. The court severed and left standing most of the rule’s changes to the notice of privacy practices, including those tied to the 42 CFR Part 2 substance use disorder rule, with their February 16, 2026 deadline. Part 2 is the separate federal regulation that gives addiction treatment records extra protection. So providers that dismantled their whole compliance project after the ruling risked missing the piece that survived.

What held up was the process built around the form. Two-tier review, decision records and configurable workflow stages proved useful for every sensitive request type, including behavioral health, substance use and minors’ records. Organizations that had built the attestation as a switchable step could turn it off without disturbing everything else. Those that had hard-wired it faced a second round of rework, for a step they no longer needed.

State laws on reproductive and gender-affirming care records continued to diverge, so the scope and reliance questions did not disappear with the federal rule. They moved to state law. The judgment calls this rule exposed are still made at the records desk every day, now under a patchwork of state requirements rather than a single federal form. The investment in people, criteria and records remains the part worth keeping, whatever the next federal or state rule requires.