This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.
Reproductive health privacy rule vacated.
On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the HIPAA Privacy Rule to Support Reproductive Health Care Privacy Final Rule (Privacy Rule). As a result, the additional privacy protections that had been granted to reproductive healthcare information through President Biden’s Executive Order 14076, “Protecting Access to Reproductive Health Care Services”), are no longer enforceable or required.
Why this rule is interesting and relevant:
- It is a reminder that the state of reproductive healthcare privacy is constantly evolving and changing provider requirements.
- Providers and other covered entities should watch for and respond to changes stemming from the vacated rule.
- The Notice of Privacy Practices provision that requires updates for compliance with 42 C.F.R. Part 2 is still in effect and was not vacated.
- A patchwork of privacy laws, directives, and guidance still exists at the state level regarding specific reproductive health care (e.g., abortion access, gender-affirming care, conversion therapy), some of which run counter to the administration’s executive orders (e.g., New York, California).
- We should expect more states to enact their own privacy legislation to address changes at the federal level.
[View source.]
