§ 164.509 Uses and disclosures for which an attestation is required. ( a ) *Standard: Attestations for certain uses and disclosures of protected health information to persons other than covered entities or business associates.* ( 1 ) A covered entity or business associate may not use or disclose protected health information potentially related to reproductive health care for purposes specified in § 164.512(d), (e), (f), or (g)(1), without obtaining an attestation that is valid under paragraph (b)(1) of this section from the person requesting the use or disclosure and complying with all applicable conditions of this part.
( 2 ) A covered entity or business associate that uses or discloses protected health information potentially related to reproductive health care for purposes specified in § 164.512(d), (e), (f), or (g)(1), in reliance on an attestation that is defective under paragraph (b)(2) of this section, is not in compliance with this section.
( b ) *Implementation specifications: General requirements* — ( 1 ) *Valid attestations.* ( i ) A valid attestation is a document that meets the requirements of paragraph (c)(1) of this section.
( ii ) A valid attestation verifies that the use or disclosure is not otherwise prohibited by § 164.502(a)(5)(iii).
( iii ) A valid attestation may be electronic, provided that it meets the requirements in paragraph (c)(1) of this section, as applicable.
( 2 ) *Defective attestations.* An attestation is not valid if the document submitted has any of the following defects: ( i ) The attestation lacks an element or statement required by paragraph (c) of this section.
( ii ) The attestation contains an element or statement not required by paragraph (c) of this section
( iii ) The attestation violates paragraph (b)(3) of this section.
( iv ) The covered entity or business associate has actual knowledge that material information in the attestation is false.
( v ) A reasonable covered entity or business associate in the same position would not believe that the attestation is true with respect to the requirement at paragraph (c)(1)(iv) of this section.
( 3 ) *Compound attestation.* An attestation may not be combined with any other document except where such other document is needed to satisfy the requirements at paragraph (c)(iv) of this section or at § 164.502(a)(5)(iii)(C), as applicable.
( c ) *Implementation specifications: Content requirements and other obligations* — ( 1 ) *Required elements.* A valid attestation under this section must contain the following elements: ( i ) A description of the information requested that identifies the information in a specific fashion, including one of the following: ( A ) The name of any individual(s) whose protected health information is sought, if practicable.
( B ) If including the name(s) of any individual(s) whose protected health information is sought is not practicable, a description of the class of individuals whose protected health information is sought.
( ii ) The name or other specific identification of the person(s), or class of persons, who are requested to make the use or disclosure.
( iii ) The name or other specific identification of the person(s), or class of persons, to whom the covered entity is to make the requested use or disclosure.
( iv ) A clear statement that the use or disclosure is not for a purpose prohibited under § 164.502(a)(5)(iii).
( v ) A statement that a person may be subject to criminal penalties pursuant to 42 U.S.C. 1320d-6 if that person knowingly and in violation of HIPAA obtains individually identifiable health information relating to an individual or discloses individually identifiable health information to another person.
( vi ) Signature of the person requesting the protected health information, which may be an electronic signature, and date. If the attestation is signed by a representative of the person requesting the information, a description of such representative's authority to act for the person must also be provided.
( 2 ) *Plain language requirement.* The attestation must be written in plain language.
( d ) *Material misrepresentations.* If, during the course of using or disclosing protected health information in reasonable reliance on a facially valid attestation, a covered entity or business associate discovers information reasonably showing that any representation made in the attestation was materially false, leading to a use or disclosure for a purpose prohibited under § 164.502(a)(5)(iii), the covered entity or business associate must cease such use or disclosure.
[89 FR 33063, Apr. 26, 2024]