Section 164.509 - Uses and disclosures for which an attestation is required(a)Standard: Attestations for certain uses and disclosures of protected health information to persons other than covered entities or business associates.(1) A covered entity or business associate may not use or disclose protected health information potentially related to reproductive health care for purposes specified in § 164.512(d), (e), (f), or (g)(1) , without obtaining an attestation that is valid under paragraph (b)(1) of this section from the person requesting the use or disclosure and complying with all applicable conditions of this part.(2) A covered entity or business associate that uses or discloses protected health information potentially related to reproductive health care for purposes specified in § 164.512(d), (e), (f), or (g)(1) , in reliance on an attestation that is defective under paragraph (b)(2) of this section, is not in compliance with this section.(b)Implementation specifications: General requirements-(1)Valid attestations.(i) A valid attestation is a document that meets the requirements of paragraph (c)(1) of this section.(ii) A valid attestation verifies that the use or disclosure is not otherwise prohibited by § 164.502(a)(5)(iii) .(iii) A valid attestation may be electronic, provided that it meets the requirements in paragraph (c)(1) of this section, as applicable.(2)Defective attestations. An attestation is not valid if the document submitted has any of the following defects: (i) The attestation lacks an element or statement required by paragraph (c) of this section.(ii) The attestation contains an element or statement not required by paragraph (c) of this section(iii) The attestation violates paragraph (b)(3) of this section.(iv) The covered entity or business associate has actual knowledge that material information in the attestation is false.(v) A reasonable covered entity or business associate in the same position would not believe that the attestation is true with respect to the requirement at paragraph (c)(1)(iv) of this section.(3)Compound attestation. An attestation may not be combined with any other document except where such other document is needed to satisfy the requirements at paragraph (c)(iv) of this section or at § 164.502(a)(5)(iii)(C) , as applicable.(c)Implementation specifications: Content requirements and other obligations-(1)Required elements. A valid attestation under this section must contain the following elements: (i) A description of the information requested that identifies the information in a specific fashion, including one of the following:(A) The name of any individual(s) whose protected health information is sought, if practicable.(B) If including the name(s) of any individual(s) whose protected health information is sought is not practicable, a description of the class of individuals whose protected health information is sought.(ii) The name or other specific identification of the person(s), or class of persons, who are requested to make the use or disclosure.(iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity is to make the requested use or disclosure.(iv) A clear statement that the use or disclosure is not for a purpose prohibited under § 164.502(a)(5)(iii) .(v) A statement that a person may be subject to criminal penalties pursuant to 42 U.S.C. 1320d-6 if that person knowingly and in violation of HIPAA obtains individually identifiable health information relating to an individual or discloses individually identifiable health information to another person.(vi) Signature of the person requesting the protected health information, which may be an electronic signature, and date. If the attestation is signed by a representative of the person requesting the information, a description of such representative's authority to act for the person must also be provided.(2)Plain language requirement. The attestation must be written in plain language.(d)Material misrepresentations. If, during the course of using or disclosing protected health information in reasonable reliance on a facially valid attestation, a covered entity or business associate discovers information reasonably showing that any representation made in the attestation was materially false, leading to a use or disclosure for a purpose prohibited under § 164.502(a)(5)(iii) , the covered entity or business associate must cease such use or disclosure.