On April 22, 2024, the government issued a Final Rule modifying the HIPAA Privacy Rule to support reproductive health care privacy. The government created additional protections for reproductive health information because it is particularly sensitive and involves highly personal health care decisions. Changes in the legal landscape have nationwide implications, not only because of their effects on the relationship between health care providers and patients, but also because of the potential effects on the exchange of health information across state lines. For example, an individual who travels out-of-state to obtain reproductive health care that is lawful under the circumstances in which it is provided may now be reluctant to have that information disclosed to a health care provider in their home state if they fear that it may then be used against them, their family or the out-of-state provider in their home state. This Final Rule prohibits covered entities and business associates from using or disclosing an individual's health information to someone conducting a criminal, civil or administrative investigation that would impose liability on any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care that is or was lawful under the circumstances it was provided. This prohibition applies to, but is not limited to, law enforcement investigations, third party investigations in furtherance of civil proceedings, state licensure proceedings, criminal prosecutions, and family law proceedings. Additionally, the Final Rule includes a new requirement for covered entities to obtain an attestation from the person or entity seeking the reproductive health information prior to disclosing that information. Specifically, the Rule requires covered entities that receive a request for reproductive health information that would be used for health oversight activities, judicial and administrative proceedings, law enforcement purposes, or disclosures to coroners and medical examiners must obtain an attestation from the requestor that such use or disclosure is not for a prohibited purpose. A prohibited purpose exists where a person or entity is either investigating or employing criminal, civil or administrative processes to adversely affect someone for having lawfully obtained reproductive health care. The government has indicated they will release a model attestation prior to the compliance date of the Final Rule. Finally, the Rule requires providers update their Notice of Privacy Practices to include the amendments for reproductive health care privacy. The Final Rule will take effect on June 25, 2024, with full compliance being required by December 23, 2024. The Notice of Privacy Practice compliance requirements were extended to February 16, 2026.