---
kind: "section"
citation: "45 C.F.R. § 164.509"
title: "45"
number: "164.509"
heading: "Uses and disclosures for which an attestation is required."
url: "https://uscodex.org/cfr/45/164.509"
---

# §164.509. Uses and disclosures for which an attestation is required.

- (a) **Standard: Attestations for certain uses and disclosures of protected health information to persons other than covered entities or business associates.**
  - (1) A covered entity or business associate may not use or disclose protected health information potentially related to reproductive health care for purposes specified in § [164.512(d)](/cfr/45/164.512.md?p=d), [(e)](/cfr/45/164.512.md?p=e), [(f)](/cfr/45/164.512.md?p=f), or [(g)(1)](/cfr/45/164.512.md?p=g-1), without obtaining an attestation that is valid under [paragraph (b)(1)](#b-1) of this section from the person requesting the use or disclosure and complying with all applicable conditions of this part.
  - (2) A covered entity or business associate that uses or discloses protected health information potentially related to reproductive health care for purposes specified in § [164.512(d)](/cfr/45/164.512.md?p=d), [(e)](/cfr/45/164.512.md?p=e), [(f)](/cfr/45/164.512.md?p=f), or [(g)(1)](/cfr/45/164.512.md?p=g-1), in reliance on an attestation that is defective under [paragraph (b)(2)](#b-2) of this section, is not in compliance with this section.
- (b) **Implementation specifications: General requirements—**
  - (1) **Valid attestations.**
    - (i) **A valid attestation is a document that meets the requirements of paragraph (c)(1) of this section.**
    - (ii) A valid attestation verifies that the use or disclosure is not otherwise prohibited by [§ 164.502(a)(5)(iii)](/cfr/45/164.502.md?p=a-5-iii).
    - (iii) A valid attestation may be electronic, provided that it meets the requirements in [paragraph (c)(1)](#c-1) of this section, as applicable.
  - (2) **Defective attestations.** An attestation is not valid if the document submitted has any of the following defects:
    - (i) **The attestation lacks an element or statement required by paragraph (c) of this section.**
    - (ii) The attestation contains an element or statement not required by [paragraph (c)](#c) of this section
    - (iii) **The attestation violates paragraph (b)(3) of this section.**
    - (iv) The covered entity or business associate has actual knowledge that material information in the attestation is false.
    - (v) A reasonable covered entity or business associate in the same position would not believe that the attestation is true with respect to the requirement at [paragraph (c)(1)(iv)](#c-1-iv) of this section.
  - (3) **Compound attestation.** An attestation may not be combined with any other document except where such other document is needed to satisfy the requirements at paragraph (c)(iv) of this section or at [§ 164.502(a)(5)(iii)(C)](/cfr/45/164.502.md?p=a-5-iii-C), as applicable.
- (c) **Implementation specifications: Content requirements and other obligations—**
  - (1) **Required elements.** A valid attestation under this section must contain the following elements:
    - (i) A description of the information requested that identifies the information in a specific fashion, including one of the following:
      - (A) **The name of any individual(s) whose protected health information is sought, if practicable.**
      - (B) If including the name(s) of any individual(s) whose protected health information is sought is not practicable, a description of the class of individuals whose protected health information is sought.
    - (ii) The name or other specific identification of the person(s), or class of persons, who are requested to make the use or disclosure.
    - (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity is to make the requested use or disclosure.
    - (iv) A clear statement that the use or disclosure is not for a purpose prohibited under [§ 164.502(a)(5)(iii)](/cfr/45/164.502.md?p=a-5-iii).
    - (v) A statement that a person may be subject to criminal penalties pursuant to [42 U.S.C. 1320d-6](/usc/42/1320d-6.md) if that person knowingly and in violation of HIPAA obtains individually identifiable health information relating to an individual or discloses individually identifiable health information to another person.
    - (vi) Signature of the person requesting the protected health information, which may be an electronic signature, and date. If the attestation is signed by a representative of the person requesting the information, a description of such representative's authority to act for the person must also be provided.
  - (2) **Plain language requirement.** The attestation must be written in plain language.
- (d) **Material misrepresentations.** If, during the course of using or disclosing protected health information in reasonable reliance on a facially valid attestation, a covered entity or business associate discovers information reasonably showing that any representation made in the attestation was materially false, leading to a use or disclosure for a purpose prohibited under [§ 164.502(a)(5)(iii)](/cfr/45/164.502.md?p=a-5-iii), the covered entity or business associate must cease such use or disclosure.

## Notes

### Amendments

[89 FR 33063, Apr. 26, 2024]

### Authority

Authority: 42 U.S.C. 1320d-2, 1320d-4, and 1320d-9; sec. 264 of Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2 (note)); and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

### Authority

Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264, Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)); and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

### Source

Source: 65 FR 82802, Dec. 28, 2000, unless otherwise noted.

### Amendments

[89 FR 33063, Apr. 26, 2024]