The U.S. Department of Health & Human Services (HHS) issued a Final Rule in April 2024 amending the HIPAA Privacy Rule to strengthen protections for reproductive health care information. The goal was to prevent medical records from being used to investigate or penalize patients or providers for seeking or offering lawful reproductive care.
However, in June 2025, a federal court in Texas struck down most of these protections, leaving health care organizations to sort out what remains in effect and what doesn’t.
What the Final Rule Originally Required
When it was first published, the rule introduced several major changes:
- Ban on certain disclosures: Covered entities could not disclose Protected Health Information (PHI) if the purpose was to investigate or penalize someone for lawful reproductive health care.
- Presumption of lawfulness: Care provided outside of the entity receiving the PHI request was presumed lawful unless there was actual knowledge or substantial evidence otherwise.
- Attestation requirement: Requests for reproductive health PHI, such as from law enforcement, courts, oversight agencies, or medical examiners, had to include a signed attestation affirming the request wasn’t for a prohibited purpose.
- Updated privacy notices: Covered entities were required to update their Notice of Privacy Practices (NPPs) to explain these new protections and clarify how reproductive health information may be handled.
The Court’s Ruling: What Got Struck Down
On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated most of the rule.
- What was vacated?
- The prohibition on using PHI for reproductive health investigations.
- The presumption of lawfulness.
- The attestation requirement.
- What is still in effect?
- The requirement to update NPPs. Compliance is due by February 16, 2026.
HHS has said it will review the decision and determine next steps, but for now, most of the new protections are no longer enforceable.
What Practices Must Do Now
Even with the court’s decision, health care organizations are still expected to be in compliance with certain aspects of the Final Rule.
Update Your Notice of Privacy Practices
- A description (with examples) of prohibited uses/disclosures of reproductive health PHI.
- An explanation of when an attestation would be required.
- A notice that once PHI is disclosed, it may be redisclosed and lose HIPAA protections.
If your organization maintains substance use disorder records under 42 CFR Part 2, additional updates are also required.
Review Your Documents and Forms
Now would also be a great time to revisit other practice documents, such as:
- Consent forms (general, informed, and telehealth)
- Authorizations for PHI release
- Policy documents
- Billing estimates and financial responsibility forms
- EMR access request forms
Train and Stay Informed
Staff need to understand what the ruling changed and what it didn’t. HIPAA’s baseline protections remain intact, and state laws may impose additional requirements. Stay tuned for further HHS guidance and potential appeals or revisions.
Conclusion
The court’s decision has pared back many of the new privacy protections for reproductive health under HIPAA; however, required updates to Notices of Privacy Practices remain. The legal landscape on this matter continues to evolve, so continue to monitor updates from HHS and further court rulings.
