Compliance considerations following Texas Court decision vacating key provisions of 2024 HIPAA Privacy Rule protecting reproductive health information

The District Court's decision on June 18, 2025, vacated specific provisions of the final rule issued by the U.S. Department of Health and Human Services (HHS) that had increased privacy protections for reproductive health care information in response to the Supreme Court's 2022 decision in Dobbs v. Jackson Women's Health Organization. For background, see our prior post outlining the key 2024 changes to HIPAA privacy requirements.

The District Court's decision is effective immediately and applies nationwide. Although HHS has 60 days to appeal, it is not expected to do so. In an update to its webpage on HIPAA and Reproductive Health, HHS acknowledged the ruling and stated that it “will determine next steps after a thorough review of the court's decision.”

Key compliance implications

HIPAA-regulated entities are:

• No longer required to obtain attestations from law enforcement. Covered entities and business associates are no longer obligated to obtain attestations from law enforcement or other requestors before disclosing protected health information (PHI) potentially related to reproductive health care.
• No longer prohibited from disclosing PHI to requestors seeking to impose liability related to reproductive health. Disclosures of PHI for purposes of investigating or imposing liability related to lawful reproductive health care are no longer explicitly barred under HIPAA, but such disclosures must still comply with existing HIPAA standards and relevant state laws.
• No longer required to modify Notice of Privacy Practices (NPP) to cover additional requirements for reproductive health care information. The updated provisions for NPPs are no longer required, but the District Court allowed the requirements for modifications to NPPs for substance use disorder (SUD) records to remain, which are required by February 16, 2026.

Although this ruling will eliminate several federal requirements introduced under the 2024 reproductive health rule, the following compliance considerations for HIPAA-regulated entities remain:

• Standard HIPAA privacy requirements remain fully in effect. HIPAA-regulated entities must continue to comply with the baseline HIPAA Privacy Rule requirements that existed prior to the reproductive health changes, including minimum necessary disclosures, permissible uses, and required safeguards for PHI.
• State laws will continue to evolve and may impose additional protections. HIPAA-regulated entities should remain alert for potential changes in state law and confirm compliance with applicable state-level requirements regarding information about reproductive health and gender-affirming care.

Next steps

HHS has 60 days to appeal the ruling but that is unlikely. Once these changes are final, HIPAA-regulated entities should:

• Review their current HIPAA policies, procedures, and business associate agreements in light of the court's decision.
• Cease updates to NPPs specific to reproductive health care (or remove those already made) but continue with changes required for SUD records.
• Monitor for any announcements or further guidance from HHS and state regulators regarding reproductive health and gender-affirming care information.

For now, organizations may need to re-evaluate what state requirements apply, particularly in light of the removal of these heightened federal protections. This decision also highlights the importance of continuing to carefully evaluate requests for PHI, particularly related to reproductive health and gender care, to confirm uses and disclosures of such information are consistent with applicable HIPAA and state law requirements.

Authored by Marcy Wilder, Melissa Bianchi, Melissa Levine, Alyssa Golay, and Surya Swaroop.