On June 18, 2025, the U.S. District Court for the Northern District of Texas issued a ruling vacating the 2024 HIPAA Privacy Rule provisions that provided enhanced protections for reproductive health information (RHI).

Background

The 2024 amendments to the HIPAA Privacy Rule, known as the Reproductive Health Privacy Rule, were introduced to strengthen privacy protections for individuals seeking reproductive health care. Key provisions included:

• Prohibited the use and disclosure of protected health information (PHI) related to the reproductive health care for the purpose of conducting criminal, civil, or administrative investigations or imposing liability on individuals seeking, obtaining, providing or facilitating such care.
• Requiring Covered Entities (CE) to obtain a written attestation from requestors affirming that the PHI would not be used for prohibitive purposes before disclosing RHI when it’s requested for “non-healthcare purposes including health oversight, law enforcement, judicial and administrative proceedings, and disclosures to coroners and medical examiners.

The Court’s Decision

In its decision, the court held that the Department of Health and Human Services (HHS) exceeded its statutory authority by implementing the Reproductive Health Privacy Rule. The court found that:

• The rule unlawfully limited state public health laws and reporting obligations, particularly concerning child abuse investigations.
• HHS impermissibly redefined terms like “person” and “public health” beyond the scope of its authority.
• The rule was adopted without clear congressional authorization, violating the major-questions doctrine.

As a result, the court vacated the Reproductive Health Privacy Rule nationwide, effectively removing the additional protections and requirements it had established.

What does this mean?

1. From a federal perspective, CEs are no longer required to obtain attestations before disclosing RHI for the types of requests previously covered by the rule.
2. State laws that provide—or are in the process of establishing—additional privacy protections for RHI should be closely monitored.
3. Policies, procedures, training programs, and Business Associate (BA) agreements that were updated to comply with this now-vacated Federal rule should be reviewed and revised accordingly.
4. The HIPAA Privacy Rule remains in effect, and CEs must continue to protect PHI, including RHI, in accordance with existing HIPAA regulations.

Next Steps

While the federal attestation requirement is no longer in effect, CEs should:

• Stay informed about potential legal developments, including possible appeals or new regulations.
• Ensure compliance with applicable state laws that may impose different or additional requirements regarding RHI.
• Continue to safeguard all PHI in accordance with the HIPAA Privacy Rule.

What if I need more help?

This ruling underscores the dynamic nature of healthcare privacy regulations and the importance of staying current with regulatory changes.

Haugen Consulting Group has experts in healthcare privacy that can assist you with assessing your current use and disclosure policies and procedures to identify gaps, efficiencies, etc. Contact us here to learn how Haugen can help!

Note: This blog post is for informational purposes only and does not constitute legal advice.