Late on Wednesday, June 18, 2025, a United States District Court judge in Amarillo, Texas, struck down the majority of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (final rule) enacted by the United States Department of Health and Human Services (HHS) Office for Civil Rights (OCR) in 2024. The final rule, which aimed to strengthen privacy protections for reproductive health care information, prohibited covered entities and their business associates from using or disclosing protected health information (PHI) in certain circumstances.
What did OCR’s final rule protect?
After the United States Supreme Court’s June 24, 2022, decision in Dobbs v. Jackson Women’s Health Organization (Dobbs), OCR issued a notice of proposed rulemaking on April 17, 2023, to modify the HIPAA Privacy Rule to enhance the privacy of reproductive health care information. After receiving nearly 30,000 public comments, OCR issued the final rule on April 22, 2024. The final rule provided enhanced privacy protections by prohibiting HIPAA-regulated entities from using or disclosing PHI in the following circumstances:
- To conduct a criminal, civil, or administrative investigation into, or to impose criminal, civil, or administrative liability on, an individual solely for seeking, obtaining, providing, or facilitating reproductive health care where such care is lawfully provided.
- To identify any individual for the purpose of conducting such investigation or imposing such liability.
Wednesday’s decision
In late 2024, a Texas physician filed suit, challenging the legality of the final rule, arguing that it exceeded OCR’s statutory authority in creating special rules for reproductive health care information and that it would unlawfully limit mandatory reporting of child abuse. In his decision, Judge Matthew Kacsmaryk concluded that HHS exceeded its authority in adopting the final rule and unlawfully restricted states’ ability to enforce their own public health and child abuse reporting laws. Kacsmaryk did not vacate certain provisions of the final rule related to the HIPAA Notice of Privacy Practices requirements, including the clarification applicable to organized health care arrangements.
The decision, effective immediately, applies nationwide.
What is the impact for providers, plans, and HIPAA business associates?
While there is a chance that this District Court decision may be overturned or modified on appeal, the policy positions articulated by the current administration thus far make it unlikely that HHS will pursue an appeal. While the final rule’s reproductive health information protections were vacated, the remaining HIPAA Privacy Rule protections continue to apply to reproductive health care information. HIPAA-regulated entities must continue to ensure that uses and disclosures of reproductive health care PHI comply with the HIPAA regulations. For example, covered entities and business associates must carefully review administrative requests for PHI from law enforcement or other bodies, as well as subpoena requests, and ensure that any resulting provision of PHI is in compliance with HIPAA.
Healthcare providers, health plans, and applicable business associates who modified their policies and procedures to comply with the requirements of the final rule should review these updates to determine whether they remain compliant in the wake of Kacsmaryk’s decision. In particular, HIPAA-regulated entities that have been requiring attestations before disclosing reproductive health PHI should consider whether to make that a voluntary request or if attestations should, instead, be discontinued altogether. Covered entities that have modified their HIPAA Notice of Privacy Practices to address the protections afforded by the final rule should review those changes and determine whether modification is necessary in light of the District Court decision. In addition to consulting with counsel about these nuanced changes, HIPAA-regulated entities should ensure that their workforces receive training about compliant uses and disclosures of PHI, particularly when related to reproductive health care.
For more information on this content , please contact your Nixon Peabody attorney or the authors of this alert.