M
odel Attestation for a Requested Use or Disclosure of Protected
Health Information Potentially Related to Reproductive Health Care
When a HIPAA covered entity
1
or business associate
2
receives a request for protected health information (PHI)
3
potentially related to reproductive health care,
4
it must obtain a signed attestation that clearly states the requested use
or disclosure is not for the prohibited purposes described below, where the request is for PHI for any of the following
purposes:
•
Health oversight activities
5
•
Judicial or administrative
6
proceedings
•
Law enforcement
7
•
Regarding decedents, disclosures to
coroners and medical examiners
8
P
rohibited Purposes. Covered entities and their business associates may not use or disclose PHI for the following
purposes:
(1)
To conduct a criminal, civil, or administrative investigation into any person for the mere act of
seeking, obtaining, providing, or facilitating lawful reproductive health care.
(2)
To impose criminal, civil, or administrative liability on any person for the mere act of seeking,
obtaining, providing, or facilitating lawful reproductive health care.
(3)
To identify any person for any purpose described in (1) or (2).
9
T
he prohibition applies when the reproductive health care at issue (1) is lawful under the law of the state in
which such health care is provided under the circumstances in which it is provided, (2) is protected, required, or
authorized by Federal law, including the United States Constitution, under the circumstances in which such
health care is provided, regardless of the state in which it is provided, or (3) is provided by another person and
presumed lawful.
10
Model Instructions
Information for the Person Requesting the PHI
By signing this attestation, you are verifying that you are not requesting PHI for a prohibited purpose
and acknowledging that criminal penalties may apply if untrue.
11
You may not add content that is not required or combine this form with another document except
where another document is needed to support your statement that the requested disclosure is not for a
p
rohibited purpose.
12
For example, if the requested PHI is potentially related to reproductive health care
that was provided by someone other than the covered entity or business associate from whom you are
requesting the PHI, you may submit a document that supplies information that demonstrates a
1
See 45 CFR 160.103 (definition of “Covered entity”).
2
See 45 CFR 160.103 (definition of “Business associate”).
3
See 45 CFR 160.103 (definition of “Protected health information”).
4
See 45 CFR 160.103 (definition of “Reproductive health care”).
5
See 45 CFR 164.512(d).
6
See 45 CFR 164.512(e).
7
See 45 CFR 164.512(f).
8
See 45 CFR 164.512(g)(1).
9
See 45 CFR 164.502(a)(5)(iii)(A).
10
See 45 CFR 164.502(a)(5)(iii)(B), (C). For more information on the presumption and when it applies, see 45 CFR
164.502(a)(5)(iii)(C).
11
See 42 U.S.C. 1320d–6.
12
See 45 CFR 164.509(b)(3) and (c)(iv).
This attestation document may be provided in electronic format, and electronically signed by the person requesting protected health
information when the electronic signature is valid under applicable Federal and state law.
substantial factual basis that the reproductive health care in question was not lawful under the specific
circumstances in which it was provided.
13
Information for the Covered Entity or Business Associate
You may not rely on the attestation to disclose the requested PHI if any of the following is true:
It is missing any required element or statement or contains other content that is not required.
14
It is combined with other documents, except for documents provided to support the attestation.
15
You know that material information in the attestation is false.
16
A reasonable covered entity or business associate in the same position would not believe the
requestor’s statement that the use or disclosure is not for a prohibited purpose as described
above.
17
If you later discover information that reasonably shows that any representation made in the attestation
is materially false, leading to a use or disclosure for a prohibited purpose as described above, you must
stop making the requested use or disclosure.
18
You may not make a disclosure if the reproductive health care was provided by a person other than
yourself and the requestor indicates that the PHI requested is for a prohibited purpose as described
above, unless the requestor supplies information that demonstrates a substantial factual basis that the
reproductive health care was not lawful under the specific circumstances in which it was provided.
19
You must obtain a new attestation for each specific use or disclosure request.
20
You must maintain a written copy of the completed attestation and any relevant supporting
documents.
21
13
See 45 CFR 164.502(a)(5)(iii)(B)(3), (C)(2).
14
See 45 CFR 164.509(b)(2)(ii).
15
See 45 CFR 164.509(b)(3).
16
See 45 CFR 164.509(b)(2)(iv).
17
See 45 CFR 164.509(b)(2)(v).
18
See 45 CFR 164.509(d).
19
See 45 CFR 164.502(a)(5)(iii)(B)(3), (C)(2).
20
See 89 FR 32976, 33031.
21
See 45 CFR 164.530(j).
This attestation document may be provided in electronic format, and electronically signed by the person requesting protected health
information when the electronic signature is valid under applicable Federal and state law.
Model Attestation Regarding a Requested Use or Disclosure of Protected Health Information
Potentially Related to Reproductive Health Care
The entire form must be completed for the attestation to be valid.
Name of person(s) or specific identification of the class of persons to receive the requested PHI.
e.g., name of investigator and/or agency making the request
Name or other specific identification of the person or class of persons from whom you are requesting the use or
disclosure.
e.g., name of covered entity or business associate that maintains the PHI and/or name of their workforce
member who handles requests for PHI
Description of specific PHI requested, including name(s) of individual(s), if practicable, or a description of the class of
individuals, whose protected health information you are requesting.
e.g., visit summary for [name of individual] on [date]; list of individuals who obtained [name of prescription
medication] between [date range]
I attest that the use or disclosure of PHI that I am requesting is not for a purpose prohibited by the HIPAA Privacy Rule at
45 CFR 164.502(a)(5)(iii) because of one of the following (check one box):
☐
The purpose of the use or disclosure of protected health information is not to investigate or impose liability
on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care or to
identify any person for such purposes.
☐
The purpose of the use or disclosure of protected health information is to investigate or impose liability on
any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, or to
identify any person for such purposes, but the reproductive health care at issue was not lawful under the
circumstances in which it was provided.
I understand that I may be subject to criminal penalties pursuant to 42 U.S.C. 1320d-6 if I knowingly and in violation of
HIPAA obtain individually identifiable health information relating to an individual or disclose individually identifiable
health information to another person.
Signature of the person requesting the PHI
Date
If you have signed as a representative of the person requesting PHI, provide a description of your authority to act for that
person.
