Deemed necessary following the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, HHS has issued a new final rule that amends the HIPAA Privacy Rule to afford greater protection to protected health information (PHI) that is related to reproductive health care.  

Before the new rule, covered entities and business associates were permitted to disclose PHI for certain public policy-related reasons, including law enforcement.  

Under the new rule, such entities will be prohibited from disclosing PHI related to lawful reproductive health care in certain situations. Covered entities (including health plans) and business associates have until December 22, 2024 to comply with the new rule, but will have until February 16, 2026 to update their HIPAA Notice of Privacy Practices accordingly. The final rule fact sheet can be found here.