Jun 27, 2025
HIPAA Privacy Rule to Support Reproductive Health Care – Vacated Nationwide
On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the majority of the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy.
The only part of the 2024 Privacy Rule that was not vacated by this court order are the changes to the Notice of Privacy Practices that are related to substance use disorder patient records, the compliance date for which is still February 16, 2026. It is still expected that a new model Notice of Privacy Practices would be made available for use prior to that date.
For HIPAA-regulated entities, including group health plans, this means that they should reassess and revise their HIPAA policies, procedures, and training materials to ensure that they comply with the current (pre-2024 Privacy Rule) requirements as well as any applicable state privacy laws.
If the Notice of Privacy Practices was updated in anticipation of the 2026 deadline, it should be reviewed and amended to reflect the court’s decision by only including changes related to substance use disorder patient records.
Refresher - What Was the 2024 Privacy Rule Overview
Deemed necessary by the Department of Health and Human Services (HHS) following the U.S. Supreme Court's decision in Dobbs v. Jackson Women's Health Organization and its aftermath of state-level abortion laws, HHS issued a HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “2024 Privacy Rule”).
The 2024 Privacy Rule amended the HIPAA privacy rule to afford greater protection to protected health information (PHI) related to reproductive health care, with the goal of maintaining the necessary trust between patient and healthcare provider.
The 2024 Privacy Rule also supported President Biden’s Executive Order on protecting access to reproductive health care, which directed HHS to consider additional actions, including under HIPAA, to enhance protection for information related to reproductive health care.
The primary purpose of the 2024 Privacy Rule was to further restrict the use or disclosure of PHI related to reproductive health care. Previously, HIPAA-regulated entities (i.e., covered entities and business associates) were permitted to disclose PHI for certain public policy-related reasons, including law enforcement.
The 2024 Privacy Rule further restricted this permission by prohibiting such entities from disclosing PHI related to lawful reproductive health care in certain situations. To support this effort, the 2024 Privacy Rule added and clarified a couple definitions, imposed a new attestation requirement to be used upon receipt of a request for PHI potentially related to reproductive health care, and required covered entities to make changes to their Notice of Privacy Practices.
Reminder of the 2024 Privacy Rule to Support Reproductive Health Care
While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.
