dures and train employees concerning the Rule.2. Review and consider modifying authorizations or request for information forms to ask if the person is seeking RPHI. If no RPHI is sought, then the Rule does not apply. If RPHI is sought along with other information, then the provider will need to comply with the Rule.3. Draft and use a compliant attestation or adopt and use the OCR model attestation when the provider or business associate receives requests for RPHI. The provider or business associate should retain a copy of the attestation to verify compliance.Notice of Privacy Practices. The Rule will require providers and other covered entities to update their Notice of Privacy Practices (NPP) by February 16, 2026. The update will also need to address recent changes to 42 C.F.R. part 2 relating to substance use disorder records. (45 C.F.R. § 164.520). HHS has proposed additional HIPAA changes that will also need to be addressed in the NPP, but those proposals have not been finalized. (86 F.R. 6446 (1/21/21)). Presumably, HHS postponed the deadline for the Notice updates to accommodate the anticipated changes.1 The Rule actually became effective June 5, 2024, but HHS postponed the compliance date for most provisions to December 23, 2024. (89 FR 32976).2Texas v. HHS, 5:24-cv-00204-H (N.D. Tex. 2024).3 For purposes of the Rule,seeking, obtaining, providing, or facilitating reproductive health care includes, but is not limited to, any of the following: expressing interest in, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, administering, authorizing, providing coverage for, approving, counseling about, assisting, or otherwise taking action to engage in reproductive health care; or attempting any of the same.(45 C.F.R. § 164.502(a)(5)(iii)(D)).4 The Rule expressly prohibits covered entities or business associates from using or disclosing RPHI “for purposes specified in § 164.512(d) [health oversight activities], (e) [judicial or admin