A recent update to HIPAA’s privacy rule that created protections for information related to reproductive healthcare will no longer apply to group health plans and other HIPAA covered entities, effective June 18, 2025. On this date, the US District Court for the Northern District of Texas vacated the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (“Rule”), parts of which took effect on June 23, 2024. The Trump administration is not expected to appeal the ruling, and it is unclear whether another group would have standing to step in and defend the Rule. Consequently, it appears plans are no longer required, and may not be permitted, to comply with the additional procedural steps under the Rule.
As background, the Rule, which was issued under the Biden administration in 2024 after the Supreme Court overturned Roe v. Wade, imposed additional procedural steps that covered entities, including group health plans, were required to take before disclosing protected health information (“PHI”) related to reproductive healthcare in response to criminal, civil or administrative investigations. Specifically, the Rule applied a presumption that reproductive health care was lawful, and therefore subject to heightened protection from disclosure, unless the plan had actual knowledge or a substantial factual basis to believe otherwise. The Rule further required anyone requesting reproductive healthcare PHI to complete a written attestation that the PHI was not being requested for a prohibited purpose.
The Rule was challenged by a doctor who argued that the Rule’s requirement interfered with her state-mandated reporting duties. The district court agreed and gave three reasons for vacating the Rule. First, it held that the Department of Health and Human Services exceeded its authority in re-defining terms such as “person” and “public health” in the Rule. Second, it held that the Rule triggered the Major Questions Doctrine—a principle established by the US Supreme Court limiting the power of executive agencies to make rules regarding politically significant issues (in this case, abortion) without an explicit delegation from Congress. Finally, the court ruled that the Rule could impermissibly interfere with state child abuse reporting laws.
As a result of the court’s ruling, it appears that plans are no longer required, and may not be permitted, to apply the presumption of lawfulness or to obtain an attestation before disclosing PHI related to reproductive healthcare in response to criminal, civil or administrative investigations. Further, no updates would be required to plans’ HIPAA privacy policies, notices of privacy practices (“NPPs”) and business associate agreements to reflect the disclosure restrictions with respect to reproductive healthcare PHI.
In addition to restrictions on the disclosure of PHI, the Rule also required revisions to a plan’s NPP with respect to substance use disorder, which take effect February 16, 2026. Specifically, the substance use provisions of the Rule require a plan’s NPP to describe and provide examples of the restrictions on sharing PHI related to substance use treatment without the participant’s written consent or a court order. The substance use portions of the Rule were not at issue in this case and will go into effect in 2026 as originally planned. Consequently, NPPs still will need to be updated to include the required substance use examples by the effective date.
Please contact Slevin & Hart for more information about this case.
This publication is intended to provide general information only, and is not intended to provide legal advice. The distribution of our publications is not intended to create, and receipt of them does not constitute, an attorney-client relationship. Permission is granted to make and redistribute, without charge, copies of this entire document provided that such copies are complete and unaltered and identify Slevin & Hart, P.C. as the author. All other rights reserved.