HIPAA Reproductive Healthcare Rule Vacated Nationally
7/18/2025
A Texas federal court has issued an order vacating on a nationwide basis most of the HIPAA Reproductive Healthcare Final Rule (Final Rule).[i] The U.S. Department of Health & Human Services (DHHS) has stated it “will determine next steps after a thorough review of the court’s decision.” Although unlikely based on current Trump Administration policies, this could include appeal of the decision.
For now, HIPAA covered entities and business associates should take action to revise policies and procedures in light of the court’s decision. Ultimately, if the decision remains unchallenged and no further action is taken to revive the vacated requirements of the Final Rule, the administrative burdens associated with compliance will be eased.
Background
The Final Rule was published in April 2024 to amend the HIPAA Privacy Rule in the wake of the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, which decision has led to state abortion bans and other restrictions on reproductive freedom in numerous states. The Final Rule also supported President Biden’s Executive Orders on protecting access to reproductive health care, including EO 14076 (issued on July 8, 2022), which, among other things, ordered DHHS to consider providing guidance under HIPAA to strengthen the protection of reproductive healthcare information. In January of this year, President Trump rescinded EO 14076.
The Final Rule included protections on reproductive healthcare information, including a prohibition on the disclosure of such information by HIPAA covered entities and their business associates for purposes of investigating or prosecuting the provision of legally-performed reproductive healthcare. The Final Rule also required covered entities and their business associates to obtain attestations from requestors of health information stating that the request was not for any of the Final Rule’s prohibited purposes. In addition, each covered entity was required to amend its Notice of Privacy Practices by February 16, 2026 to include, among other things, information about the protection of reproductive health care information. See our April 22, 2024 Healthcare Law Alert on the Final Rule.
What the Court’s Decision Means for Healthcare Providers and Their Business Associates
Most of the Final Rule was vacated, thus reverting most of the Privacy Rule back to its pre-April 2024 form. Actions to take include:
- Covered entities and their business associates should watch for news about any DHHS appeal or further actions or guidance about the vacated rule.
- Covered entities and their business associates no longer need to obtain an attestation to confirm that the disclosure of health information is not for purposes of investigating or prosecuting an offense relating to the provision of reproductive health care. Policies and procedures should be updated to comport with the current status of the Final Rule.
- If any covered entity already took action to modify its Notice of Privacy Practices or any business associate agreements to include provisions about reproductive healthcare information, it should revise its notice and such agreements again.
The Notice of Privacy Practices portion of the Final Rule regarding compliance with 42 CFR Part 2, federal regulations governing the privacy of substance use disorder treatment information, remains in effect. Covered entities must revise their Notices of Privacy Practices before the compliance deadline of February 16, 2026.
The Texas court’s decision is applicable only as to the reproductive healthcare provisions of HIPAA. The remainder of HIPAA and other federal laws, including 42 CFR Part 2, are still in effect. In addition, many states have enacted privacy and security legislation, including regarding the protection of reproductive healthcare information in some states. Healthcare providers must ensure their data privacy and security policies and procedures remain up to date and compliant.
How We Can Help
Please contact us with any questions or if you need assistance with your data privacy and security program.
Lani M. Dornfeld, Esq., CHPC, Member, Healthcare Law at 973.403.3136 or ldornfeld@bracheichler.com
[i]See the court’s June 18, 2025 Judgment, July 3, 2025 amended Judgment, and Memorandum Opinion and Order (Opinion) entered with the original order.
Lani M. Dornfeld
CHPC, Member
Healthcare Law, Cannabis Industry
973.403.3136 · 973.618.5536 Fax
ldornfeld@bracheichler.com
