This page addresses follow-up questions and additional information pertinent to our webinar
Navigating Complex Uses and Disclosures in Today’s ROI Landscape Part 1: Federal Compliance.
** The coding information and guidance are valid at the time of publishing. Learners are encouraged to research
subsequent official guidance in the areas associated with the topic as they can change rapidly.

Q:  Are attestations still required to disclose reproductive health information (RHI)?

A:  On June 18^th, 2025, the U.S. District Court for the Northern District of Texas issued an order vacating most of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy. As a result, Covered Entities (CEs) are no longer required to obtain a written attestation from requestors for these types of disclosures. While the federal requirement for attestations has been removed by this court ruling, CEs must still comply with applicable state laws that offer additional protections for RHI and the HIPAA Privacy Rule.

HHS HIPAA For Professionals – HIPAA Final Rule to Support Reproductive Health Care Privacy: Fact Sheet

Q:  Does HIPAA preempt state privacy laws?

A:  Think of HIPAA as setting the baseline for health information privacy. If a state law is less strict than HIPAA, then HIPAA takes the lead. But if a state law provides stronger privacy protections, the state law applies. For example, some states have stronger protections for sensitive information such as mental health records than HIPAA or other Federal laws (such as 42 CFR Part 2). In those cases, the stricter state law takes precedence over the federal law. Some examples of laws that are stricter than HIPAA include state laws that:

• Provide greater privacy protections or patient rights
• Require more detailed consent or authorization before disclosure
• Grant individuals greater access to their own records
• Impose stricter breach notifications

HHS HIPAA For Professionals FAQs: Preemption of State Law

Q:  When does the minimum necessary standard apply and when doesn’t it apply?

A:  If the minimum necessary standard has ever confused you, you’re not alone. The concept of this key protection within the HIPAA Privacy Rule is to use or share the least amount of protected health information (PHI) needed to get the job done – no more, no less.

HIPAA outlines exceptions where the minimum necessary standard does not apply, and this often leads to confusion. Exclusions include:

• Disclosures to or requests by the individual (i.e., the patient)
• Disclosures for treatment purposes (between providers or care teams)
• Disclosures made with a valid, signed patient authorization
• Required disclosures (i.e., to HHS for compliance investigations, or as required by law such, such as public health reporting)

HHS HIPAA For Professionals Minimum Necessary Requirement (https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html)

Looking for additional information on this topic?