Updates to the Reproductive Privacy Rule: What You Need to Know
On June 18, 2025, a federal judge in Texas issued a nationwide injunction vacating the HIPAA Privacy Rule to Support Reproductive Health Care Privacy[1] (“Reproductive Privacy Rule”).[2] Originally published on April 26, 2024, the Reproductive Privacy Rule amended the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule as a response to the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization.[3]
The Reproductive Privacy Rule sought to address concerns that state-level abortion restrictions or bans might have prevented patients from seeking reproductive healthcare or the possibility that patients’ protected health information might be used in state-level enforcement actions against legal abortions obtained out of state. Notably, the recent Supreme Court ruling restricting nationwide injunctions does not impact the injunction vacating the Reproductive Privacy Rule.[4]
The Nationwide Injunction
In issuing the nationwide injunction, the federal judge referenced the Supreme Court’s decision in Loper Bright Enterprises v. Raimondo,[5] stating that the U.S. Department of Health and Human Services (“HHS”) had acted outside the bounds of its authority in enacting the Reproductive Privacy Rule. Additionally, the judge determined that the Reproductive Privacy Rule:
- Unnecessarily limited state public health laws;
- Impermissibly defined “persons” and “public health” in contravention of federal law and in excess of the agency’s statutory authority; and
- Was adopted without the expressly delegated authority of Congress.
However, the federal judge did not vacate the changes made to 45 C.F.R. § 164.520 requiring entities to update their Notice of Privacy Practices with the mandated protections related to substance use disorder records under Part 2 by February 16, 2026. HHS has sixty (60) days to appeal the ruling.
What Do Privacy Officers Need to Know?
As a result of the nationwide injunction, health centers are not required to comply with the Reproductive Privacy Rule. This includes any policy, training, contract and attestation requirements that were established by the Reproductive Privacy Rule. HHS has also confirmed that it will not pursue federal enforcement actions related to violations of the now-vacated Rule
Health centers should consider revising policies, training, contracts and attestations to revert their privacy programs to follow the Privacy Rule prior to implementation of the Reproductive Privacy Rule.
Importantly, other requirements under the HIPAA Privacy Rule remain in effect related to the use and disclosure of protected health information (PHI). As previously confirmed by HHS, HIPAA permits, but does not require, PHI disclosures related to reproductive health information, including for law enforcement purposes and in response to subpoenas.
Privacy officers should remain vigilant at the state level. Some state legislatures may enact or expand privacy protections for reproductive health information that mirror or extend the federal Rule. Depending on where a health center operates, state law may still impose additional requirements or limitations on the disclosure of reproductive health information
If you have specific questions relating to your center’s HIPAA obligations, please contact Natalie Lesnick at nlesnick@feldesman.com or any member of Feldesman’s Health Care team.
[1] 89 Fed. Reg. 32976.
[2] Purl v. United States Department of Health and Human Services, No. 2:24-CV-228-Z, (N.D. Tex. June 18, 2025).
[3] 597 U.S. 215 (2022).
[4] Trump v. Casa, 606 U.S. ___.
[5] 603 U.S. 369 (2024).
