On June 18, 2025, the U.S. District Court for the Northern District of Texas invalidated a final rule that had been issued in April 2024 aimed at enhancing HIPAA’s privacy protections for reproductive health care. This rule, which took effect on December 23, 2024, prohibited health plans and other regulated entities from using or disclosing protected health information (PHI) related to lawful reproductive health care in specific circumstances. The Texas ruling nullifies these new protections entirely across the nation.
Privacy Protections
The HIPAA Privacy Rule sets strict limits on the use, disclosure and protection of PHI by health care providers, health plans, health care clearinghouses and their business associates (regulated entities). The Privacy Rule also allows regulated entities to use or disclose PHI for certain non health-care purposes, including certain criminal, civil and administrative investigations and proceedings.
The U.S. Department of Health and Human Services (HHS) issued the final rule to protect the privacy of reproductive healthcare following the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, which eliminated the constitutional right to abortion. The final rule prohibits regulated entities from using or disclosing PHI for the criminal, civil or administrative investigation of (or proceeding against) any person in connection with seeking, obtaining, providing or facilitating reproductive health care where such health care is lawful under the circumstances in which it is provided. In certain circumstances, the final rule requires regulated entities that receive requests for PHI potentially related to reproductive health care to obtain a signed attestation that the use or disclosure is not for a prohibited purpose. The final rule also requires covered entities to update their privacy notices by February 16, 2026 , to describe the new privacy rights for reproductive health care. In addition, covered entities that handle certain substance use disorder (SUD) records must update their privacy notices to describe new privacy protections for these records by this deadline.
District Court Ruling
The Texas court ruled that the final rule’s heightened protections for reproductive health care exceed HHS’ statutory authority and unlawfully limit states’ ability to enforce their own public health laws. Accordingly, the Texas court vacated the final rule nationwide. However, it did not vacate the new HIPAA privacy notice requirements for SUD records. Although this decision could be overturned or modified by a higher court, it seems unlikely that the Trump administration will appeal the court’s ruling.
Going forward, regulated entities must still comply with HIPAA’s general privacy requirements for PHI and any applicable state privacy laws. Employers should review the terms of their HIPAA policies to determine if updates should be made to remove the special rules for reproductive health care.
Material posted on this website is for informational purposes only and does not constitute a legal opinion or medical advice. Contact your legal representative or medical professional for information specific to your legal or medical needs.
