Understanding the new HIPAA amendments: What psychologists need to know

As practicing psychologists, staying informed about regulatory changes that affect the way patient information is handled is important. Recently, the compliance deadline for most requirements of the Department of Health and Human Services (HHS) amendment to the HIPAA Privacy Rule (PDF, 1.54MB)opens in new window, specifically designed to enhance privacy protections for reproductive health care, has arrived.

While the changes are significant, as explained below, they primarily focus on an issue that many psychologists may not typically encounter—nonroutine requests for patient information related to the patient’s reproductive health care.

This final rule amending HIPAA reflects HHS’s broader effort to protect access to and privacy of reproductive health care following the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, which led to many states enacting strict abortion bans, some with limited exceptions and harsh penalties.

Due to the patchwork of state laws related to abortion, many were concerned that individuals could face investigations or penalties for accessing lawful reproductive health care in one state but then penalized in another state with more restrictive laws. For more information about state abortions laws and the impact these laws have on psychologists, see Frequently asked questions about abortion laws and psychology practice.

The new HIPAA rule aims to safeguard patient privacy by restricting the disclosure of sensitive health information related to reproductive health care, which is defined broadly under the rule to include not just abortion care but also contraception, fertility treatments, and other related services.

As discussed below, the legal and political landscape surrounding these amendments is still evolving, which could impact the near and long-term enforcement of this new rule. Until any changes are officially implemented, compliance with this new rule is mandatory. Here’s a brief overview of the new rule and its implications for psychologists.

This new rule applies to all HIPAA-covered entities, including psychologists, and affects how certain protected health information related to reproductive health care is managed and disclosed. Compliance with the Final Rule is required starting on December 23, 2024, for every aspect of the Rule except for the Notice of Privacy Practice (NPPs), which is not required until February 16, 2026. The core changes to HIPAA include:

Prohibited use and disclosures

The new rule prohibits using or disclosing protected health information (PHI) to investigate or impose liability on anyone for seeking, obtaining, providing, or facilitating lawful reproductive health care. Such protection of PHI does not apply to situations where there is evidence that the reproductive health care provided was illegal under the circumstances.

This requirement adds another layer of navigating disclosure requests whereby a provider would need to assess whether certain nontypical requests for PHI, especially those that might involve law enforcement, government agencies, or other entities that might investigate reproductive health care, is not for a prohibited purpose. To address concerns about providers making legal judgments, the rule makes clear that reproductive health care is presumed lawful unless the provider is aware of strong evidence to the contrary.

It is important to note that most psychologists will not typically receive requests for PHI related to patients’ reproductive health information. Plus, most requests for PHI that psychologists receive fall outside the scope of these prohibitions. Psychologists primarily encounter requests for PHI related to payment and insurance purposes.

HHS clarifies that requests for PHI made by patients,their authorized representatives, HHS, or other third parties for purposes of treatment, payment, or health care operations are not considered prohibited. Therefore, providers, including psychologists, can continue to disclose PHI in those situations as they did before this new rule.

Attestation requirement

When receiving requests for PHI that may relate to reproductive health care, the new rule requires providers to obtain an attestation confirming that the PHI is not used for a prohibited activity and signed by the requesting party before any reproductive health information is disclosed pursuant to certain HIPAA exceptions, including: (1) health oversight activities; (2) judicial and administrative proceedings; (3) law enforcement purposes; and (4) disclosures to a medical examiner about a decedent.

A valid attestation must contain certain required elements and statements; however, HHS has provided a Model Attestation Form (PDF, 250KB)opens in new window that can be used to assist with compliance. This attestation form is meant to serve as a reminder to the requester that improperly obtaining PHI is a serious offense with significant legal consequences. This additional step helps ensure patient privacy and compliance with the revised HIPAA regulations.

Notice of privacy practices (NPP)

Over a year from now, providers, including psychologists, are required to update their NPPs to reflect the new privacy protections for reproductive health care information. This update must inform patients that their PHI cannot be used or disclosed for prohibited purposes. As specified above, the compliance date for these updates is not until February 16, 2026.

*It is important to note that the new rule applies equally to adults and minors, ensuring that the PHI of minors is protected under the same conditions. Psychologists must be aware of these protections and apply them consistently.

Based on the new rule described above, the key steps now involved in the HIPAA analysis process include:

1. Prohibited purposes. Carefully assessing each request for PHI related to reproductive health care (from the four types of entities described above) to ensure the request is not for a prohibited purpose.
2. Lawfulness of reproductive health care. If the request appears to have a prohibited purpose, the covered entity must determine if the reproductive health care in question was lawful, including considering the state law where the reproductive health service was provided. Remember, unless a provider has concrete evidence that the reproductive health service was unlawful, a presumption exists that the care received was legal.
3. Disclosure decision.

• If the reproductive health care was lawful, the covered entity cannot disclose the PHI.
• If the reproductive health care was not lawful, the covered entity may disclose the PHI.

4. Attestation requirement. If the disclosure is permitted, the covered entity must obtain a signed attestation from the requester confirming that the request does not have a prohibited purpose.

Review and update policies: Ensure that your privacy policies and procedures regarding requests for access and copies of PHI related to reproductive health care are updated to align with the new rule. This includes revising NPPs (when those changes are due) and business associate agreements to ensure that such agreements do not permit activities that are now prohibited under this new rule.

Implement training programs: Train any staff you have on the new rule to ensure everyone understands and complies with it. This training should cover the new attestation requirements and the updated NPPs.

Monitor any developments: Stay informed about any legal changes or updates that may affect the enforcement of the amendments. This will help you stay compliant and avoid potential legal issues. APA will strive to keep its members informed about these developments to ensure they have the latest information and guidance.

The compliance landscape for this new rule is currently uncertain due to ongoing legal challenges. Two lawsuits have been filed in the Northern District of Texas arguing that the rule exceeds HHS’s statutory authority and interferes with state law enforcement related to reproductive health care. HHS maintains that the amendments do not interfere with these obligations.

In addition, a change in administration could impact the enforcement of this new rule. The Trump administration is likely to have different views on reproductive health information privacy compared with the Biden administration, which implemented this strong rule. Still, compliance with the current rules is mandatory until any changes are officially implemented. For now, psychologists and other providers must continue to adhere to the existing HIPAA Privacy Rule, which includes the changes discussed above.

The new HIPAA rule introduced important changes to how reproductive health care information is handled. By understanding these changes and taking proactive steps to comply, psychologists can continue to protect patient privacy and maintain trust in the patient-provider relationship. Stay informed, update your practices, and ensure your staff is trained to navigate these new requirements effectively.