HIPAA is changing. Here is what it means for your practice.

What it means

• Notice of Privacy Practices must be updated to include new reproductive health privacy protections.
• New attestation requirement — before disclosing reproductive health information, requestors must attest the information will not be used for prohibited purposes.
• Staff training must cover the new restrictions on reproductive health information disclosure.
• Applies to all covered entities regardless of state — even in states without additional reproductive privacy laws.

What to do

• 1Update your Notice of Privacy Practices to include reproductive health privacy language
• 2Train staff on the new attestation requirement for reproductive health information requests
• 3Review and update your policies on responding to law enforcement requests for reproductive health records
• 4Document the updated NPP distribution to patients

What it means

• Patients must receive their records within 30 days of request (one 30-day extension allowed with written explanation).
• You cannot charge more than a reasonable, cost-based fee for copies — and electronic copies must be provided at no more than the cost of labor.
• OCR is actively pursuing small practices — several enforcement actions have been against solo providers and small groups.
• Failure to respond to a records request at all results in the highest penalties.

What to do

• 1Establish a documented process for receiving and fulfilling patient records requests
• 2Train front desk staff on the 30-day response timeline and fee limitations
• 3Verify your EHR can export records in the format patients request (especially electronic formats)
• 4Log all records requests with dates — the timeline is your defense in an OCR investigation

What it means

• If your practice treats substance use disorders, you can now share SUD records for TPO purposes under HIPAA rules — previously required separate patient consent for each disclosure.
• Criminal use prohibition remains — SUD records still cannot be used to investigate or prosecute patients.
• BAAs now apply to SUD records the same way they apply to other PHI.
• Behavioral health and primary care practices with SUD patients benefit most from the streamlined disclosure rules.

What to do

• 1Review your consent forms for SUD patients — update to reflect the new TPO disclosure permissions
• 2Update BAAs with vendors who handle SUD records to ensure HIPAA-standard protections apply
• 3Train staff on the distinction: TPO disclosures are now permitted, but criminal use prohibition remains
• 4Update your Notice of Privacy Practices if it contains SUD-specific language that predates this rule

What it means

• You cannot refuse to share electronic health information with patients or other providers unless an exception applies.
• Switching EHR vendors? Your current vendor cannot block data portability or charge unreasonable fees for data export.
• Applies to all EHI, not just the USCDI data set — broader than many practices realize.
• Enforcement is escalating — ONC published its first enforcement actions in 2024.

What to do

• 1Review your EHR vendor's data export capabilities — ensure you can provide complete EHI on request
• 2Don't restrict patient portal access or limit the data patients can view without a valid exception
• 3If switching EHR vendors, ensure your current vendor provides full data export at reasonable cost
• 4Document any instances where you limit information sharing, with the specific exception that applies

What it means

• Washington My Health My Data Act — applies to consumer health data NOT covered by HIPAA. Includes private right of action.
• California CMIA + CCPA/CPRA — additional patient privacy protections and consumer data rights for California practices.
• Texas TDPSA — comprehensive consumer data privacy with broad applicability to healthcare marketing data.
• New York SHIELD Act — expanded security requirements and breach definitions for any entity holding NY residents' data.
• Illinois BIPA — strict biometric data requirements affecting practices using fingerprint scanners or facial recognition.

What to do

• 1Identify which state laws apply to your practice based on where your patients reside — not just where you're located
• 2Review state-specific breach notification deadlines — some are as short as 30 days (CO, FL, ME, SC, WA)
• 3Check whether your state requires AG notification and at what threshold
• 4Consult the Patient Protect state compliance pages for your specific state requirements