Reproductive Healthcare Privacy Protections Rolled Back

Overview

In a not-unsurprising turn of events, a Texas District Court nullified portions of the HIPAA Privacy Rule known as the Reproductive Health Privacy Rule (the Final Rule). The Final Rule expanded requirements to protect reproductive health privacy under the HIPAA Privacy Rule and required covered entities to include specific disclosures about Reproductive PHI rights in their Privacy Notice. 

The ruling determined that the HHS exceeded its statutory authority when it expanded HIPAA protections for reproductive health. Although the decision hails from a District Court in Texas, the ruling applies nationwide.   

While the requirements to protect PHI remain in place, this change eliminates the enhanced federal privacy protection for reproductive health care information. 

The History

The Biden-Harris Administration, through the HHS, issued the Final Rule in 2024 to modify the HIPAA Privacy Rule to enhance privacy protections for reproductive health care. The rule was broadly defined to include services like abortion, IVF, contraception, and gender-affirming care. The amplification of privacy was one of the several actions taken by HHS to protect access to and privacy of reproductive health care and to bolster patient-provider confidentiality after the Supreme Court’s Dobbs decision that resulted in state abortion bans and other restrictions on reproductive freedom in 21 states.

What Did the Final Rule Do?

• Prohibiting the use or disclosure of reproductive health information for investigations regarding or for imposing liability on any person for seeking, obtaining, providing or facilitating reproductive health care, where such health care is lawful. 
• Requiring pre-disclosure attestations to ensure information would not be used for prohibited purposes. 
• Defining terms like “reproductive health care” and adjusting related HIPAA compliance obligations.

The Challenge to the Final Rule

In late 2024, a lawsuit was brought on behalf of healthcare providers operating walk-in clinics in Texas. The plaintiffs argued the Final Rule unlawfully restricted mandatory child abuse reporting to state welfare agencies, redefined statutory terms (such as “person” and “public health”), and violated the law by regulating politically significant areas without clear congressional authorization. In layman’s terms, they argued that the ruling conflicted with Texas law requiring providers to report certain situations, such as minors seeking abortions, contracting sexually transmitted diseases, or receiving prohibited treatments for gender dysphoria, including hormone therapy. 

Initially, Judge Matthew Kacsmaryk granted a preliminary injunction preventing HHS from enforcing the Rule against the plaintiffs. However, in an updated June 2025 ruling, the judge expanded the relief to include a nationwide injunction, finding that HHS exceeded its statutory authority when issuing the Final Rule. 

Under the current administration, it is unlikely that the ruling will be challenged by the HHS.  

Employer Action Items

Given this regulatory shift, employers should review and revise any documents that were updated to include Reproductive PHI disclosures, reverting to the pre-2024 requirements. 

This includes:

• HIPAA Privacy Policy 
• Privacy Notice
• Business Associates Agreements

HIPAA regulations indicate that revised Privacy Notices should be distributed within 60 days of a material change. Therefore, to the extent that updates in the Privacy Notice were made to comply with the Final Rule, employers should update and redistribute Privacy Notices by August 17, 2025. 

Vita Action

Vita has updated the template Privacy Notice as well as the advisory HIPAA disclosures in the Summary Plan Description to reflect these required changes.  Copies of the Update documents will be available from your Vita Account Management team on August 1st for redistribution. 

Special Note about Substance Use Disorder Provisions

Notably, the injunction did not address the specific requirements relating to confidentiality of substance use disorder health records. These changes have a compliance deadline of Feb. 16, 2026. The HHS is expected to issue a revised model Privacy Notice before this date, therefore most employers are choosing to wait until the model language is released rather than make their own revisions at this time.

Reference

• Text of the Court Decision: Link