If you need to obtain medical records in conjunction with any of your cases, you’ve likely been thrown for a loop recently, as healthcare providers started rejecting subpoenas for failure to include a Reproductive Attestation.

Why Are Providers Requiring a Reproductive Attestation Suddenly?

Back in June of 2024, the HHS Office for Civil Rights published the HIPAA Privacy Rule to Support Reproductive Healthcare Privacy. The compliance deadline for most of the Rule’s provisions was December 23, 2024, which is why there’s been such a flurry of activity recently requesting Attestations.

What Is a Reproductive Attestation?

Since December 23, 2024, anyone seeking to obtain protected health information (PHI) from a HIPAA-covered entity must attest that the information is not being requested for “prohibited purposes.” Insofar as it relates to reproductive health care, 45 CFR 164.502(a)(5)(iii)(A) prohibits disclosure of PHI for any of the following activities:

1. To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.
2. To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.
3. To identify any person for any purpose described in paragraphs (a)(5)(iii)(A)(1) or (2) of this section.

What Needs to be Present on a Reproductive Attestation?

The HHS provided a Model Attestation that can be used, which includes all required elements. Note that there is no requirement to use that Model Attestation, and a HIPAA-covered entity can’t require a requestor to use their own proprietary form, either. You can comply with the Rule by ensuring the following elements are present on your Attestation (see 45 CFR 164.509(c)(1))

1. A description of the information requested that identifies the information in a specific fashion, including one of the following:
   1. The name of any individual(s) whose protected health information is sought, if practicable.
   2. If including the name(s) of any individual(s) whose protected health information is sought is not practicable, a description of the class of individuals whose protected health information is sought.
2. The name or other specific identification of the person(s), or class of persons, who are requested to make the use or disclosure.
3. The name or other specific identification of the person(s), or class of persons, to whom the covered entity is to make the requested use or disclosure.
4. A clear statement that the use or disclosure is not for a purpose prohibited under § 164.502(a)(5)(iii).
5. A statement that a person may be subject to criminal penalties pursuant to 42 U.S.C. 1320d-6 if that person knowingly and in violation of HIPAA obtains individually identifiable health information relating to an individual or discloses individually identifiable health information to another person.
6. Signature of the person requesting the protected health information, which may be an electronic signature, and date. If the attestation is signed by a representative of the person requesting the information, a description of such representative's authority to act for the person must also be provided.

When Is a Reproductive Attestation Required?

Reproductive Attestations are required anytime you are seeking PHI that may relate to reproductive health care, including gender-affirming care. The protections are broad, and include medical, billing, radiology, pharmacy, and insurance records. Attestations are also required for mental health records, when specifically tied to the reproductive health context (not generally for all mental health records).

How Array Can Help

Managing subpoenas for medical records has become more complex with the introduction of reproductive attestation requirements. At Array, we simplify the process and ensure your requests are compliant with the latest regulations:

• Expert Guidance: Our experienced team stays up-to-date on HIPAA compliance and attestation requirements, providing clarity and support at every step.
• Custom Solutions: We help you draft, review, and submit reproductive attestations tailored to your needs, ensuring they meet all regulatory elements
• Streamlined Subpoena Services: From location verification to serving subpoenas and obtaining the necessary records, we handle the logistics so you can focus on your case.
• Real-Time Updates: Stay informed with real-time updates on your subpoena’s progress.

Let Array take the stress out of managing medical record subpoenas. Contact us at orders@trustarray.com to learn more.

Sheri Webb, Assistant Director, Subpoena Operations

Sheri Webb brings 27 years of legal experience to her role leading California Subpoena Operations at Array. She began her career in Intellectual Property and Corporate Law before spending over a decade as a Legal Secretary and Paralegal specializing in complex civil litigation. With a deep understanding of legal procedures and a passion for supporting legal professionals, Sheri ensures seamless subpoena operations while providing expert guidance to clients navigating complex record requests. A dedicated industry leader, she has also served on the Board of Directors for the California Alliance of Paralegal Associations and the Orange County Paralegal Association.