HIPAA Reproductive Health Privacy Rule Vacated

On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the 2024 HIPAA Reproductive Health Privacy Rule, ruling that the Department of Health and Human Services (HHS) exceeded its statutory authority in issuing the amendments to the HIPAA Privacy Rule. This decision alters compliance obligations for HIPAA-covered entities and business associates nationwide.

The now-vacated rule was intended to limit the use and disclosure of reproductive health-related protected health information (PHI) in connection with law enforcement, oversight, and judicial activities. With the ruling in effect, previously required attestations under the 2024 rule are no longer necessary.

Covered entities should review their policies, procedures and agreements to ensure compliance with the current regulatory framework.

Implications for HIPAA-Covered Entities

With the Reproductive Health Privacy Rule vacated HIPAA covered entities and business associates should consider the following:

Discontinuation of Attestations: Covered entities are no longer required to obtain written attestations for certain disclosures of reproductive health information.
Policy and Procedure Updates: Policies and procedures amended to comply with the 2024rule should be reviewed and revised accordingly.
Business Associate Agreements (BAAs): Entities that modified BAAs in response to the rule should evaluate whether those changes remain appropriate.
Notice of Privacy Practices (NPP): Planned updates to NPPs related to reproductive healthPHI may no longer be necessary. However, entities should remain alertto other pending amendments, such as those involving substance use disorder records.
Stay Informed: Monitor for a response from HHS and any subsequent guidance or rulemaking.

Compliance Reminder

Although the 2024 amendments are no longer enforceable, HIPAA’s Privacy Rule continues to safeguard all PHI, including reproductive health data. Covered entities must remain vigilant to avoid impermissible disclosures.

For specific questions about how this ruling may affect your records request procedure, please contact your Lexitas Account Manager.

Related Resources

HIPAA-Compliant Safeguards for Your Record Retrieval Partners

HIPAA-compliance is a complex detail that law firms cannot afford to overlook, especially when working with third parties who handle medical records.

HIPAA Rule Change: Executive Order 14182

On January 24, 2025, President Trump signed Executive Order 14182, which revokes the previous Executive Order 14076. Based on this new Executive Order, HHS is now able to revoke Rule 45 CFR Parts 160 and 164, or make a new rule.

Understanding HIPAA Compliance For Law Firms

In this whitepaper we explore HIPAA, how it applies to law firms, best practices law firms can act on to protect themselves from violations and penalties.