--- title: "45 CFR 164.509 HIPAA: Uses and disclosures for which an attestation is required" canonical: "https://dposchool.com/hipaa/section/164.509" source: "https://www.ecfr.gov/current/title-45/section-164.509" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 164.509 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart E: Privacy of Individually Identifiable Health Information # 45 CFR 164.509 HIPAA: Uses and disclosures for which an attestation is required eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 45 CFR 164.509(a) **(a)** Standard: Attestations for certain uses and disclosures of protected health information to persons other than covered entities or business associates. (1) A covered entity or business associate may not use or disclose protected health information potentially related to reproductive health care for purposes specified in § 164.512(d), (e), (f), or (g)(1), without obtaining an attestation that is valid under paragraph (b)(1) of this section from the person requesting the use or disclosure and complying with all applicable conditions of this part. #### 45 CFR 164.509(a)(2) **(2)** A covered entity or business associate that uses or discloses protected health information potentially related to reproductive health care for purposes specified in § 164.512(d), (e), (f), or (g)(1), in reliance on an attestation that is defective under paragraph (b)(2) of this section, is not in compliance with this section. ### 45 CFR 164.509(b) **(b)** Implementation specifications: General requirements—(1) Valid attestations. (i) A valid attestation is a document that meets the requirements of paragraph (c)(1) of this section. ##### 45 CFR 164.509(b)(ii) **(ii)** A valid attestation verifies that the use or disclosure is not otherwise prohibited by § 164.502(a)(5)(iii). ##### 45 CFR 164.509(b)(iii) **(iii)** A valid attestation may be electronic, provided that it meets the requirements in paragraph (c)(1) of this section, as applicable. #### 45 CFR 164.509(b)(2) **(2)** Defective attestations. An attestation is not valid if the document submitted has any of the following defects: ##### 45 CFR 164.509(b)(2)(i) **(i)** The attestation lacks an element or statement required by paragraph (c) of this section. ##### 45 CFR 164.509(b)(2)(ii) **(ii)** The attestation contains an element or statement not required by paragraph (c) of this section ##### 45 CFR 164.509(b)(2)(iii) **(iii)** The attestation violates paragraph (b)(3) of this section. ##### 45 CFR 164.509(b)(2)(iv) **(iv)** The covered entity or business associate has actual knowledge that material information in the attestation is false. ##### 45 CFR 164.509(b)(2)(v) **(v)** A reasonable covered entity or business associate in the same position would not believe that the attestation is true with respect to the requirement at paragraph (c)(1)(iv) of this section. #### 45 CFR 164.509(b)(3) **(3)** Compound attestation. An attestation may not be combined with any other document except where such other document is needed to satisfy the requirements at paragraph (c)(iv) of this section or at § 164.502(a)(5)(iii)(C), as applicable. ### 45 CFR 164.509(c) **(c)** Implementation specifications: Content requirements and other obligations—(1) Required elements. A valid attestation under this section must contain the following elements: ##### 45 CFR 164.509(c)(i) **(i)** A description of the information requested that identifies the information in a specific fashion, including one of the following: ###### 45 CFR 164.509(c)(i)(A) **(A)** The name of any individual(s) whose protected health information is sought, if practicable. ###### 45 CFR 164.509(c)(i)(B) **(B)** If including the name(s) of any individual(s) whose protected health information is sought is not practicable, a description of the class of individuals whose protected health information is sought. ##### 45 CFR 164.509(c)(ii) **(ii)** The name or other specific identification of the person(s), or class of persons, who are requested to make the use or disclosure. ##### 45 CFR 164.509(c)(iii) **(iii)** The name or other specific identification of the person(s), or class of persons, to whom the covered entity is to make the requested use or disclosure. ##### 45 CFR 164.509(c)(iv) **(iv)** A clear statement that the use or disclosure is not for a purpose prohibited under § 164.502(a)(5)(iii). ##### 45 CFR 164.509(c)(v) **(v)** A statement that a person may be subject to criminal penalties pursuant to 42 U.S.C. 1320d-6 if that person knowingly and in violation of HIPAA obtains individually identifiable health information relating to an individual or discloses individually identifiable health information to another person. ##### 45 CFR 164.509(c)(vi) **(vi)** Signature of the person requesting the protected health information, which may be an electronic signature, and date. If the attestation is signed by a representative of the person requesting the information, a description of such representative's authority to act for the person must also be provided. #### 45 CFR 164.509(c)(2) **(2)** Plain language requirement. The attestation must be written in plain language. ### 45 CFR 164.509(d) **(d)** Material misrepresentations. If, during the course of using or disclosing protected health information in reasonable reliance on a facially valid attestation, a covered entity or business associate discovers information reasonably showing that any representation made in the attestation was materially false, leading to a use or disclosure for a purpose prohibited under § 164.502(a)(5)(iii), the covered entity or business associate must cease such use or disclosure. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[89 FR 33063, Apr. 26, 2024\] [45 CFR 164.509 on eCFR](https://www.ecfr.gov/current/title-45/section-164.509) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 164.509 Previous: [45 CFR 164.508 HIPAA: Uses and disclosures for which an authorization is required](https://dposchool.com/hipaa/section/164.508) Next: [45 CFR 164.510 HIPAA: Uses and disclosures requiring an opportunity for the individual to agree or to object](https://dposchool.com/hipaa/section/164.510) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents