Texas Federal District Court Invalidates the HIPAA Reproductive Health Rule

At a Glance

• A federal district court recently vacated a newly established Health and Human Services (HHS) final rule centered on increasing the regulation of privacy protections for reproductive health care.
• Based on the decision, individuals and entities no longer need to give a valid attestation to health care providers when requesting individuals’ protected health information (PHI) relevant to reproductive health care.
• The final rule supplemented the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to limit situations in which PHI could be used or disclosed to individuals and entities.
• Though the protections outlined in the final rule have been rejected, covered entities shall still comply with HIPAA’s Privacy Rule as well as be prepared for possible new state laws that may attempt to fill the gap.

On June 19, 2025, a federal judge at the U.S. District Court for the Northern District of Texas vacated the newly created Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule Final Rule to Support Reproductive Health Care Privacy, amending the HIPAA Privacy Rule. The final rule addressed the prior administration’s objective of securing privacy protections for protected health information (PHI) related to reproductive health care.

Background

The U.S. Supreme Court’s 2022 decision in Dobbs v. Jackson Women’s Health Organization, 597 U.S. 215 (2022), changed the landscape in reproductive health care in the United States. The case restored the power of abortion regulation to the states. At the same time, the case raised new health privacy concerns, not considered in more than 50 years. The Biden administration elected to address the latest concerns that individuals’ reproductive health care PHI could be used in state enforcement actions.

The U.S. Department of Health and Human Services (HHS) drafted the 2024 Reproductive Health Rule to toughen privacy protections for a subsection of PHI related to reproductive health care. The foundational component of the Reproductive Health Rule was to limit the circumstances in which health care providers could disclose reproductive health care PHI for purposes other than health care, specifically banning the use or disclosure of PHI to accomplish criminal, civil or administrative investigations or inflicting liability on any person for merely seeking, obtaining, providing or facilitating reproductive health care, or for identifying any person for such purposes.

To implement these prohibitions, the Reproductive Health Rule required covered entities — which include health care providers, health plans and health care clearinghouses, or their business associates — to obtain a written attestation from individuals or agencies requesting PHI related to reproductive health care for purposes related to health oversight activities, judicial or administrative proceedings, law enforcement agency purposes, or disclosures to coroners and medical examiners attesting that the use or disclosure is not for a prohibited purpose. Additionally, under the Reproductive Health Rule, covered entities were required to update their notice of privacy practices to account for reproductive health care information by February 2026.

The Federal District Court’s Decision

In late 2024, a Texas doctor filed suit against HHS, disputing the legality of the Reproductive Health Rule. The plaintiff argued that HHS’s Reproductive Health Rule went beyond HHS’s statutory authority in fashioning distinct directions for reproductive health care information. Additionally, the plaintiff alleged that the Reproductive Health Rule would unlawfully limit mandatory reporting of child abuse. Judge Kacsmaryk concluded that HHS exceeded its authority in enacting the rule, which illegally constrained states’ capacity to implement their own public health and child abuse reporting statutes. Initially, in November 2024, Judge Kacsmaryk granted injunctive relief; however, the relief initially only applied to the doctor who brought the suit. However, last week, the Texas federal district court extended the injunctive relief nationwide. While vacating the Reproductive Health Rule, the court permitted to stay in place the section of the Reproductive Health Rule that modifies 45 C.F.R. 164.520, specifically requiring covered entities to update their notice of privacy practices associated with substance use disorder records by February 16, 2026.

What This Means for HIPAA-Regulated Entities

The Trump administration’s viewpoint on the balance of power between state and federal abortion rights makes it unlikely that HHS will move to appeal the district court’s decision. As such, covered entities and business associates who adapted their policies and procedures to conform with the obligations of the Reproductive Health Rule should reexamine these updates to verify whether they remain compliant in the wake of the district court’s decision. At the same time, the remaining HIPAA Privacy Rule protective requirements have not gone away. HIPAA-regulated entities must continue to make certain that their uses and disclosures of reproductive health care PHI comply with HIPAA.