Compliance References
Primary sources, gathered in one place.
HIPAA attestation for reproductive health care PHI
In 2024 HHS added 45 C.F.R. § 164.509, requiring a signed attestation before certain disclosures of protected health information potentially related to reproductive health care. A federal court vacated that rule in June 2025. Custodians differ in practice on whether an attestation is still requested.
Why you may still be asked for one
The regulation text has not been removed from the Code of Federal Regulations. As of the eCFR edition dated August 20, 2026, § 164.509 still appears under the heading “Uses and disclosures for which an attestation is required,” carrying no editorial note about the vacatur. A compliance officer checking the CFR sees a live regulation. HHS has stated it will determine next steps after reviewing the decision. Both links are below so a custodian can see the regulation and the order side by side.
Court record
- Memorandum Opinion and Order, Purl v. U.S. Dep’t of Health & Human Services No. 2:24-cv-00228-Z (N.D. Tex. June 18, 2025) — the decision itself, via Justia. Justia
- Same order as a PDF A copy of the memorandum opinion and order, useful for attaching to correspondence. NFP
- Full docket Every filing in the case, including the appeal and its disposition. CourtListener
- Report that the Fifth Circuit dismissed the appeal on September 10, 2025 American Bar Association, Health Law Section. ABA
Government
- HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care Carries OCR’s own notice of the June 18, 2025 order and states which Notice of Privacy Practices provisions were vacated and which remain, with a February 16, 2026 compliance date. HHS Office for Civil Rights
- 45 C.F.R. § 164.509, current eCFR text The attestation regulation as it still appears in the Code of Federal Regulations. eCFR
- HIPAA Privacy Rule To Support Reproductive Health Care Privacy, 89 Fed. Reg. 32976 The 2024 final rule that introduced the attestation. Federal Register
Published analysis
- HIPAA’s Reproductive Health Rule Is Vacated Nationally Sets out the scope of the vacatur and what survived. Holland & Knight
- HIPAA Attestation Requirement Is No More Focused on the attestation specifically. Davis Wright Tremaine
- What Regulated Entities Need to Know Written for covered entities and business associates. Akerman
- Reproductive Healthcare Privacy Final Rule Vacated by Texas Court Morgan Lewis
- Federal Court Vacates 2024 HIPAA Reproductive Health Privacy Rule Reed Smith
- Update: What’s the Status of the 2024 HIPAA Final Rule Regarding Reproductive Health? A status summary from a university public-law program rather than a firm. UNC School of Government
- Understanding the now-reversed reproductive health privacy amendments Written for practitioners handling records requests. American Psychological Association Services
What the vacatur settled
No attestation under § 164.509 is required — not for a patient authorization, a WCAB subpoena duces tecum, a California deposition subpoena, or a federal subpoena. The regulation that created that requirement was set aside. A custodian may still ask for one as its own policy, but no federal rule obliges anyone to provide it.
What the vacatur did not touch
The attestation was one narrow document. Everything else that applied before April 2024 still applies, and it differs by how the records are being sought.
| How records are requested | What still governs |
|---|---|
| Patient authorizationsigned release | A valid HIPAA authorization under 45 C.F.R. § 164.508; CMIA authorization requirements at Civil Code § 56.11; a separate authorization for psychotherapy notes; and 42 C.F.R. § 2.31 consent for substance use disorder records held by a Part 2 program. |
| WCAB subpoena duces tecumworkers’ compensation | WCAB Rules of Practice and Procedure; custodian affidavit and production rules at Evidence Code §§ 1560–1563; and the DWC copy service fee schedule, 8 C.C.R. §§ 9980–9985. |
| California deposition subpoenabusiness records, civil | Code of Civil Procedure §§ 2020.410–2020.440; consumer notice under § 1985.3 and employment records notice under § 1985.6; custodian affidavit under Evidence Code §§ 1560–1567; and the assurances in 45 C.F.R. § 164.512(e). |
| Federal subpoenaU.S. District Court | Federal Rule of Civil Procedure 45, plus the same § 164.512(e) assurances. A California custodian’s own state obligations do not disappear because the subpoena issued from federal court. |
On a subpoena with no accompanying court order, § 164.512(e) lets a custodian produce only on satisfactory assurances of either a good faith attempt at written notice to the individual, with the time to object elapsed and no objection filed or objections resolved, or that the parties agreed to a qualified protective order and presented it to the court. Where there is a court order, only what the order expressly authorizes may be disclosed.
The professional photocopier under California law
Business and Professions Code § 22450 defines the occupation by naming the bodies of law it works under. Those cross-references are the scope of the work.
Business and Professions Code § 22450
“any person who for compensation obtains or reproduces documents authorized to be produced under Part 2.6 (commencing with Section 56) of Division 1 of, or Chapter 1 (commencing with Section 1798) of Title 1.8 of Part 4 of Division 3 of, the Civil Code, or Section 1158 of, or Article 4 (commencing with Section 1560) of Chapter 2 of Division 11 of, the Evidence Code, and who, while engaged in performing that activity, has access to the information contained therein.”
| Cross-reference in § 22450 | What it governs |
|---|---|
| Civil Code Part 2.6§ 56 et seq. | Confidentiality of Medical Information Act — when medical information may be disclosed, and what a valid authorization must contain. |
| Civil Code Title 1.8, ch. 1§ 1798 et seq. | Information Practices Act — personal information maintained by state agencies. |
| Evidence Code § 1158authorization | Records obtained on a written authorization signed by the patient or the patient’s representative. |
| Evidence Code Art. 4§§ 1560–1567 | Records obtained on a business records subpoena. |
Registration is not optional for a deposition officer. Code of Civil Procedure § 2020.420 provides that “the officer for a deposition seeking discovery only of business records for copying under this article shall be a professional photocopier registered under Chapter 20 (commencing with Section 22450) of Division 8 of the Business and Professions Code, or a person exempted from the registration requirements of that chapter under Section 22451,” and adds that the deposition officer “shall not be financially interested in the action, or a relative or employee of any attorney of the parties.”
| Requirement | Provision |
|---|---|
| RegistrationB&P § 22450 | With the county clerk of the county of residence, of the principal place of business, and of any county with a branch office. |
| Notary commissionB&P § 22454 | At least one person managing the business must hold a current California notary public commission and maintain it through the registration period. |
| BondB&P § 22455 | A $5,000 corporate surety bond, or an equivalent cash deposit with the county clerk. Aggregate liability is capped at $5,000. |
| TermB&P § 22456 | A certificate is effective two years or until the bond expires, whichever is first. Renewal may be filed up to 60 days early. |
| Non-complianceB&P § 22463 | “A failure to comply with the requirements of this chapter shall be punishable as a misdemeanor.” |
Primary sources
- Business and Professions Code §§ 22450–22463 The Professional Photocopier chapter in full: definition, registration, notary, bond, term, and the misdemeanor provision. California Legislative Information
- Code of Civil Procedure § 2020.420 The deposition officer for a records-only subpoena must be a registered professional photocopier. California Legislative Information
Production on a subpoena — Evidence Code 1560 to 1563
Article 4 governs what a custodian must deliver on a business records subpoena, what the accompanying affidavit must say, what that affidavit does evidentially, and what may be charged for the production.
| Provision | What it requires |
|---|---|
| DeliveryEvid. § 1560 | A nonparty custodian served with a subpoena duces tecum for business records delivers a sealed copy of the records to the clerk or other designated person, within the time the section provides. In a civil action the parties may instead agree to inspection and copying at the business on not less than five business days’ notice. |
| To the deposition officerCCP § 2020.430 | Where a deposition officer is designated, the custodian delivers a true, legible and durable copy with the § 1561 affidavit, sealed and directed as provided in Evidence Code § 1560(b), or makes the originals available for the officer to copy at the business address. The officer may not release the records before the date and time stated, and the subpoena must carry the boldface warning “Do not release the requested records to the deposition officer prior to the date and time stated above.” |
| The affidavitEvid. § 1561 | The records must be accompanied by the affidavit of the custodian or other qualified witness stating that the affiant is the duly authorized custodian of the records, identifying the records, stating that the copy is a true copy of all the records described in the subpoena, and describing the mode of preparation in the ordinary course of business. Records that are unavailable must be disclosed as such. |
| Evidentiary effectEvid. § 1562 | A compliant affidavit is admissible as evidence of the matters stated in it, those matters are presumed true as a presumption affecting the burden of producing evidence, and the copies are admissible to the same extent as if the custodian had testified — provided §§ 1271 and 1561 are satisfied. |
| ChargesEvid. § 1563(b) | All reasonable costs of a nonparty witness producing business records are charged to the subpoenaing party: $0.10 per page for standard reproduction, $0.20 per page from microfilm, clerical time at $24 per hour computed at $6 per quarter hour, actual postage, actual third-party offsite retrieval, oversize and special processing at actual cost, and $15 maximum where the records are made available for inspection or pickup. Payment may be demanded on delivery. An itemized statement is required and charges beyond the schedule must be justified; the court may order a refund with attorney fees, and reimbursement is due within 30 days if the subpoena is withdrawn or quashed. |
The affidavit is a subpoena requirement
Evidence Code § 1561 attaches to production under Article 4 — that is, to a subpoena duces tecum for business records. It is not a requirement of production on a written patient authorization under Evidence Code § 1158, which has no affidavit provision. The two routes carry different documents, different deadlines and different charge schedules; see Authorization and patient access.
Primary sources
- Evidence Code §§ 1560–1567 Article 4 in full: production, the custodian affidavit, its evidentiary effect, and the charge schedule. California Legislative Information
- Evidence Code § 1561 Every element the custodian affidavit must state. California Legislative Information
- Evidence Code § 1563 Costs of production, with the charge schedule at subdivision (b). California Legislative Information
- Code of Civil Procedure § 2020.430 Delivery of the records and the § 1561 affidavit to the deposition officer. California Legislative Information
Authorization and patient access — Evidence Code 1158, Health and Safety Code 123110, HITECH
Three separate schemes govern records obtained without a subpoena. They are not interchangeable, and each sets its own deadline and its own limit on charges.
Evidence Code § 1158 — written authorization
On presentation of a written authorization signed by the patient or the patient’s representative, the provider must make the records available for inspection and copying during business hours within five business days, or be liable for reasonable expenses and attorney fees. Charges are limited to $0.10 per page for records 8½ by 14 inches or less, $0.20 per page from microfilm, clerical time at $16 per hour computed at $4 per quarter hour, actual postage, actual third-party retrieval, and $15 maximum where the records are picked up at the provider’s premises. Section 1158 contains no affidavit requirement.
Health and Safety Code § 123110 — the patient’s own request
Inspection during business hours within five working days of receipt of a written request (subd. (a)); a paper or electronic copy transmitted within 15 days (subd. (b)). Three further subdivisions bear on how a request is handled.
§ 123110(f) — verification, and what this section does not supersede
“This section shall not be construed to preclude a health care provider from requiring reasonable verification of identity prior to permitting inspection or copying of patient records, provided this requirement is not used oppressively or discriminatorily to frustrate or delay compliance with this section. This section does not supersede any rights that a patient or personal representative might otherwise have or exercise under Section 1158 of the Evidence Code or any other provision of law. This chapter does not require a health care provider to retain records longer than required by applicable statutes or administrative regulations.”
§ 123110(g) — no discrimination, and a duty of uniform procedure
“(1) This chapter shall not be construed to render a health care provider liable for the quality of their records or the copies provided in excess of existing law and regulations with respect to the quality of medical records. A health care provider shall not be liable to the patient or any other person for any consequences that result from disclosure of patient records as required by this chapter. A health care provider shall not discriminate against classes or categories of providers in the transmittal of X-rays or other patient records, or copies of these X-rays or records, to other providers as authorized by this section. (2) Every health care provider shall adopt policies and establish procedures for the uniform transmittal of X-rays and other patient records …”
The provider is expressly relieved of liability for consequences of a disclosure the chapter requires, and is directed to transmit records under uniform procedures rather than case by case.
§ 123110(i) — unpaid bills
“This section prohibits a health care provider from withholding patient records or summaries of patient records because of an unpaid bill for health care services.”
HITECH and 45 C.F.R. § 164.524 — the federal right of access
The HITECH Act added a statutory right to an electronic copy and a limit on what may be charged for it. 42 U.S.C. § 17935(e)(1) gives an individual the right to obtain a copy in electronic format from a covered entity that uses or maintains an electronic health record, and to direct the entity to transmit it to a designated person, “provided that any such choice is clear, conspicuous, and specific.” § 17935(e)(3) provides that any fee for providing such individual with an electronic copy “shall not be greater than the entity’s labor costs in responding to the request.”
| Provision | What it requires |
|---|---|
| Timing45 C.F.R. § 164.524(b)(2) | The covered entity must act on a request for access no later than 30 days after receipt, with one extension of no more than 30 days, on written notice stating the reason for the delay and the date the entity will complete its action. The separate 60-day track for records not held on site was removed by the 2013 Omnibus Rule. |
| Form and format§ 164.524(c)(2)(ii) | Where the information is maintained electronically in a designated record set and the individual requests an electronic copy, the entity must provide it in the electronic form and format requested if readily producible, or in a readable electronic form and format as agreed. |
| Fees§ 164.524(c)(4) | A reasonable, cost-based fee that “includes only the cost of” labor for copying, supplies for a paper copy or portable media, postage where the copy is mailed, and preparing an agreed explanation or summary. The list is exclusive on its face — search and retrieval are not among the permitted components. |
Which requests the federal fee cap reaches, after Ciox
A federal court vacated part of the 2013 Omnibus Rule and the 2016 guidance in Ciox Health, LLC v. Azar, No. 18-cv-0040 (D.D.C. Jan. 23, 2020). HHS states the effect in its own notice:
“On January 23, 2020, a federal court vacated the ‘third-party directive’ within the individual right of access ‘insofar as it expands the HITECH Act’s third-party directive beyond requests for a copy of an electronic health record with respect to [protected health information] of an individual … in an electronic format.’ Additionally, the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party. The right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect.”
HHS states the authorization distinction separately: “Where the third party is initiating a request for PHI on its own behalf, with the individual’s HIPAA authorization (or pursuant to another permissible disclosure provision in the Privacy Rule), the access fee limitations do not apply.”
Note on reading the CFR alone. The eCFR text of § 164.524 still carries the 2013 language with no editorial note about the vacatur, and two HHS FAQs still carry pre-Ciox text under a banner limiting them “only to the extent that [they are] consistent with the court’s order.” A compliance officer reading only the regulation will not see the change.
Primary sources
- Evidence Code § 1158 Records on written patient authorization: the five-business-day deadline and the charge schedule. California Legislative Information
- Health and Safety Code § 123110 Patient access in full, including subdivisions (f), (g) and (i). California Legislative Information
- 42 U.S.C. § 17935(e) The HITECH access provision: electronic copy, third-party directive, and the labor-cost fee limit at (e)(3). U.S. House, Office of the Law Revision Counsel
- 45 C.F.R. § 164.524 Individual right of access: timing, form and format, and the fee components at (c)(4). eCFR
- HHS notice regarding individuals’ right of access to health records The agency’s own statement of what the Ciox order changed. HHS Office for Civil Rights
- Memorandum opinion, Ciox Health, LLC v. Azar No. 18-cv-00040 (D.D.C. Jan. 23, 2020), the decision itself. govinfo
- HHS FAQ 2033, when the fee limitations apply The authorization distinction, carrying the post-Ciox limiting banner. HHS Office for Civil Rights
Workers’ compensation copy service — 8 C.C.R. 9980 to 9985
The copy service and electronic transaction rates are adopted under Labor Code § 5307.9 and apply to copy and related services in a workers’ compensation matter. Section 9980 adopts the Business and Professions Code § 22450 definition of professional photocopier, so the registration requirement carries over into the regulations.
| Section | What it provides |
|---|---|
| Definitions§ 9980 | Defines authorization, claims administrator, copy and related services, custodian of records, and initial set of records, and adopts the B&P § 22450 definition of “professional photocopier.” |
| Allowable services§ 9982 | Defines the services that are payable, and those that are not. No payment is owed for services provided by a person or entity that is not a registered professional photocopier; for records provided within 30 days of a written request by the injured worker to the employer, claims administrator or insurer; or for records provided by a medical provider or its agent when the requesting party already employed a professional photocopier. Subdivision (e) adds records previously obtained by the same party from the same source, summaries, tabulations and indexing, quashed subpoenas, and more than four CNRs per claim. |
| Billing and payment§ 9981 | Required bill content, the billing code sets, a 30-day deadline to pay or contest, and an increase of the unpaid portion by 25 percent where payment is late. |
| Rates before 7/15/2022§ 9983 | The prior schedule, still applicable to dates of service before July 15, 2022: $180.00 flat rate for an initial set from a single custodian, $75.00 cancellation or CNR, $20.00 EDD records, $30.00 WCIRB records, $0.10 per page beyond 500 pages, X-rays and scans at $10.26 per sheet and $3.00 per CD. |
| Rates on or after 7/15/2022§ 9984 | $230.00 flat rate for an initial set of records from a single custodian; $75.00 for a cancellation or a Certificate of No Record; $0.10 per page beyond 500 pages, paper only; $10.00 per additional set; $10.26 per X-ray or scan sheet; $3.00 per electronic storage medium; plus applicable sales tax. Third-party release-of-information services: $35.00 records produced, $15.00 CNR produced. |
| Disputes§ 9985 | “Disputes over the production of records may be resolved by filing a petition with the Workers’ Compensation Appeals Board, or by filing a petition with a superior court pursuant to Labor Code section 132.” |
§ 9984(b)(2) — what the third-party ROI rate includes
“Third-party ROI services that represent deponents or witnesses who are compelled to produce documents for a deposition, records-only deposition, or trial conducted as part of any workers’ compensation claim shall be paid a flat rate of $35.00, inclusive of the witness costs and all services provided by the third-party ROI service, when records are produced, or a flat rate of $15.00 … when a CNR is produced. Third-party ROI services representing deponents or witnesses shall accept electronic service of all deposition notices and requests, including subpoenas and witness costs. Third-party ROI services shall electronically provide the records or certificates, including all affidavits required by Evidence Code section 1561, to the requesting party or their representative. These rates are included in the flat rate in subdivision (a)(1).”
Three obligations sit in that one subdivision, all inside the flat rate: the $35.00 and $15.00 caps, acceptance of electronic service, and electronic delivery of the records together with the Evidence Code § 1561 affidavit.
Notice to Consumer does not apply in workers’ compensation
Code of Civil Procedure § 1985.3(j): “This section shall not apply to proceedings conducted under Division 1 (commencing with Section 50), Division 4 (commencing with Section 3200), Division 4.5 (commencing with Section 6100), or Division 4.7 (commencing with Section 6200), of the Labor Code.” Code of Civil Procedure § 1985.6(i) carries the same sentence for employment records.
Division 4 of the Labor Code is workers’ compensation. Neither the Notice to Consumer under § 1985.3 nor the employment records notice under § 1985.6 applies in a comp proceeding. Production is governed instead by the WCAB rules of practice and procedure and by these regulations.
Primary sources
- 8 C.C.R. §§ 9980–9985 The copy service and electronic transaction rates article in full. California Department of Industrial Relations
- 8 C.C.R. § 9982 Allowable services, and the services for which no payment is owed. California Department of Industrial Relations
- 8 C.C.R. § 9984 Rates for dates of service on or after July 15, 2022, with the third-party ROI provision at subdivision (b)(2). California Department of Industrial Relations
- 8 C.C.R. § 9985 The dispute provision. California Department of Industrial Relations
- Code of Civil Procedure § 1985.3 Notice to Consumer, with the Labor Code exclusion at subdivision (j). California Legislative Information
- Code of Civil Procedure § 1985.6 Employment records notice, with the same exclusion at subdivision (i). California Legislative Information