Select Page

Blog

2024 HIPAA Privacy Rule Changes: What to Know & Recommended Actions

The Office for Civil Rights (OCR) at the U.S. Department of Health & Human Services (HHS) issued a new Final Rule on April 22, 2024, with the aim of strengthening privacy protections under HIPAA related to reproductive healthcare information. The 2024 HIPAA Privacy Rule changes clarify how covered organizations can use and disclose protected health information (PHI) relating to abortion, pregnancy, contraception, and other reproductive health services without an individual’s signed authorization, with limited exceptions. Key points of the Final Rule include:

  • Defines “reproductive healthcare”
  • Limits disclosures of reproductive health PHI to law enforcement
  • Requires covered organizations to obtain a signed attestation that the use or disclosure of reproductive health PHI is not for a prohibited purpose
  • Requires covered organizations to revise their Notice of Privacy Practices to support reproductive health care privacy practices

The Final Rule is effective on June 25, 2024, with compliance dates of December 23, 2024, and February 16, 2025 (for applicable Notice of Privacy Practices requirements)

In anticipation of the Final Rule going into effect, Clearwater’s Privacy & Compliance experts recommend that organizations take the following actions:

  • Revise policies and procedures addressing disclosures of PHI for law enforcement purposes
  • Design a template attestation addressing uses or disclosures of reproductive health PHI
  • Revise your Notice of Privacy Practices to support reproductive healthcare privacy practices
  • Provide updated training and education to all members of the workforce within a reasonable period of time

The HITRUST r2 framework is designed to be comprehensive, and this scoping factor is a perfect example of that design philosophy. It forces you to think beyond firewalls and IAM policies and consider the full environment in which your systems operate. For organizations in leased commercial office space, that environment includes a landlord, a property management company, a cleaning crew, a fire marshal, a building security team, and a building full of mechanical systems you don’t control.

The question isn’t whether you can justify answering “No.” The question is whether your control environment genuinely supports that answer and whether you can prove it to an assessor who’s going to walk your halls, try your door handles, peek into your wiring closets, and ask you who else has a key.

Get this scoping factor right, and you build a foundation of credibility that carries through the rest of your assessment. Get it wrong, and you spend the rest of the engagement explaining why your scoping doesn’t match reality.

Start with the building. The rest follows from there.

SME Highlight

Steve Meyer, CCSFP, CHQP

Steve Meyer is the Senior Director of Consulting Services at Clearwater, bringing over 37 years of experience across various aspects of Information Technology to Clearwater customers. Steve leads the HITRUST Assessment Services team.

Read More

View All Resources

Cyber Briefings for Healthcare Organizations

Stay informed on the latest healthcare cybersecurity, privacy, and compliance threats. Join Clearwater Cyber Briefings each month for expert insights and actionable risk intelligence.

Register Today to Stay Informed

Related Blogs

No results found.