Health Care Reproductive

Model Attestation for a Requested Use or Disclosure of Protected

Health Information Potentially Related to Reproductive Health Care When a HIPAA covered entity1 or business associate2 receives a request for protected health information (PHI)3 potentially related to reproductive health care,4 it must obtain a signed attestation that clearly states the requested use or disclosure is not for the prohibited purposes described below, where the request is for PHI for any of the following purposes:

• Health oversight activities5

• Judicial or administrative6

proceedings

• Law enforcement7

• Regarding decedents, disclosures to

coroners and medical examiners8

Prohibited Purposes. Covered entities and their business associates may not use or disclose PHI for the following purposes:

(1) To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care.

(2) To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care.

(3) To identify any person for any purpose described in (1) or (2).9 The prohibition applies when the reproductive health care at issue (1) is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided, (2) is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided, or (3) is provided by another person and presumed lawful.10

Model Instructions

Information for the Person Requesting the PHI

By signing this attestation, you are verifying that you are not requesting PHI for a prohibited purpose and acknowledging that criminal penalties may apply if untrue.11

You may not add content that is not required or combine this form with another document except where another document is needed to support your statement that the requested disclosure is not for a prohibited purpose.12 For example, if the requested PHI is potentially related to reproductive health care that was provided by someone other than the covered entity or business associate from whom you are requesting the PHI, you may submit a document that supplies information that demonstrates a 1 See 45 CFR 160.103 (definition of “Covered entity”). 2 See 45 CFR 160.103 (definition of “Business associate”). 3 See 45 CFR 160.103 (definition of “Protected health information”). 4 See 45 CFR 160.103 (definition of “Reproductive health care”). 5 See 45 CFR 164.512(d).

6 See 45 CFR 164.512(e).

7 See 45 CFR 164.512(f).

8 See 45 CFR 164.512(g)(1).

9 See 45 CFR 164.502(a)(5)(iii)(A).

10 See 45 CFR 164.502(a)(5)(iii)(B), (C). For more information on the presumption and when it applies, see 45 CFR 164.502(a)(5)(iii)(C).

11 See 42 U.S.C. 1320d–6.

12 See 45 CFR 164.509(b)(3) and (c)(iv).

This attestation document may be provided in electronic format, and electronically signed by the person requesting protected health information when the electronic signature is valid under applicable Federal and state law. substantial factual basis that the reproductive health care in question was not lawful under the specific circumstances in which it was provided.13

Information for the Covered Entity or Business Associate

You may not rely on the attestation to disclose the requested PHI if any of the following is true:

It is missing any required element or statement or contains other content that is not required.14

It is combined with other documents, except for documents provided to support the attestation.15

You know that material information in the attestation is false.16

A reasonable covered entity or business associate in the same position would not believe the requestor’s statement that the use or disclosure is not for a prohibited purpose as described above.17

If you later discover information that reasonably shows that any representation made in the attestation is materially false, leading to a use or disclosure for a prohibited purpose as described above, you must stop making the requested use or disclosure.18

You may not make a disclosure if the reproductive health care was provided by a person other than yourself and the requestor indicates that the PHI requested is for a prohibited purpose as described above, unless the requestor supplies information that demonstrates a substantial factual basis that the reproductive health care was not lawful under the specific circumstances in which it was provided.19

You must obtain a new attestation for each specific use or disclosure request.20

You must maintain a written copy of the completed attestation and any relevant supporting documents.21

13 See 45 CFR 164.502(a)(5)(iii)(B)(3), (C)(2).

14 See 45 CFR 164.509(b)(2)(ii).

15 See 45 CFR 164.509(b)(3).

16 See 45 CFR 164.509(b)(2)(iv).

17 See 45 CFR 164.509(b)(2)(v).

18 See 45 CFR 164.509(d).

19 See 45 CFR 164.502(a)(5)(iii)(B)(3), (C)(2).

20 See 89 FR 32976, 33031.

21 See 45 CFR 164.530(j).

This attestation document may be provided in electronic format, and electronically signed by the person requesting protected health information when the electronic signature is valid under applicable Federal and state law. Model Attestation Regarding a Requested Use or Disclosure of Protected Health Information Potentially Related to Reproductive Health Care

The entire form must be completed for the attestation to be valid. Name of person(s) or specific identification of the class of persons to receive the requested PHI. e.g., name of investigator and/or agency making the request Name or other specific identification of the person or class of persons from whom you are requesting the use or disclosure.

e.g., name of covered entity or business associate that maintains the PHI and/or name of their workforce member who handles requests for PHI

Description of specific PHI requested, including name(s) of individual(s), if practicable, or a description of the class of individuals, whose protected health information you are requesting. e.g., visit summary for [name of individual] on [date]; list of individuals who obtained [name of prescription medication] between [date range]

I attest that the use or disclosure of PHI that I am requesting is not for a purpose prohibited by the HIPAA Privacy Rule at 45 CFR 164.502(a)(5)(iii) because of one of the following (check one box):

The purpose of the use or disclosure of protected health information is not to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care or to identify any person for such purposes.

The purpose of the use or disclosure of protected health information is to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, or to identify any person for such purposes, but the reproductive health care at issue was not lawful under the circumstances in which it was provided.

I understand that I may be subject to criminal penalties pursuant to 42 U.S.C. 1320d-6 if I knowingly and in violation of HIPAA obtain individually identifiable health information relating to an individual or disclose individually identifiable health information to another person.

Signature of the person requesting the PHI

Date

If you have signed as a representative of the person requesting PHI, provide a description of your authority to act for that person.

Contact this candidate