Texas Court Blocks Key HIPAA Privacy Rule on Reproductive Health Information

What Medical and Dental Professionals Need to Know

A federal court recently issued a nationwide injunction on certain portions of the April 2024 HIPAA Privacy Final Rule designed to enhance the privacy of reproductive health information (RHI). This current block affects healthcare providers across the United States, including medical and dental professionals.

In this post, we explain what the rule was intended to do, what the court’s decision means for your practice, and what you should do now to stay compliant.

What Was the HIPAA Reproductive Health Rule?

In April 2024, the U.S. Department of Health and Human Services (HHS) finalized changes to the HIPAA Privacy Rule intended to bolster protections around reproductive healthcare privacy.

The key changes included:

Limiting covered entities and business associates from using or disclosing RHI-related PHI for investigatory, administrative, or legal proceedings
Incorporating a rebuttable presumption of lawfulness for providing or facilitating lawful reproductive healthcare
Imposing new attestation requirements before certain PHI disclosures can be made
Requiring updates to Notices of Privacy Practices (NPP) to describe the new limitations and attestation requirements

Effective and Compliance Dates

Published: April 26, 2024
Effective Date: June 25, 2024
Compliance Deadline: December 23, 2024
NPP Update Deadline: February 16, 2026 (for changes to the Notice of Privacy Practices)

What Did the Federal Court Decide?

On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the majority of the 2024 HIPAA Privacy Final Rule nationwide as it pertained to reproductive health information. The court ruled that HHS exceeded its authority in implementing the new requirements.

However, the court preserved amendments governing certain Notice of Privacy Practices provisions related to substance use disorder regulations.

Result: Key provisions of the RHI-related HIPAA Privacy Rule are currently unenforceable nationwide. This includes:

Limitations on using and disclosing PHI related to reproductive health services
Attestation requirements
Updates to Notices of Privacy Practices to reflect the above changes
Unrelated HIPAA amendments—particularly those governing PHI related to substance use disorders—remain in effect.

Note: HHS has the right to appeal the court’s decision. The deadline to file an appeal is August 18, 2025.

What This Means for Medical and Dental Practices

If you are a HIPAA-covered entity, here’s what to keep in mind:

The RHI provisions of the 2024 rule are currently unenforceable. You do not need to implement those specific restrictions or workflows at this time.
Your existing HIPAA compliance obligations remain unchanged. Continue following the Privacy Rule as it applied prior to June 2025.
HHS may appeal the decision, which means the final status of the vacatur is still uncertain.
Review your policies. If you've already updated policies or procedures to reflect the now-vacated RHI rules, consider including a disclaimer (see below).
State laws still apply. Check whether your state has its own reproductive health privacy requirements that remain in effect.

Suggested Disclaimer for HIPAA Policies

Disclaimer: Certain provisions in this policy reflect reproductive health privacy protections required by the April 2024 HIPAA Privacy Final Rule. Due to a federal court ruling made on June 18, 2025, those requirements are currently unenforceable. This policy remains valid in all other respects pending any future legal developments and will be updated if legal requirements change.

Bottom Line

While the 2024 HIPAA Privacy Rule update aimed to strengthen privacy protections for reproductive healthcare, those specific federal provisions are now on hold. Medical and dental professionals should continue following standard HIPAA practices and monitor the legal landscape for updates.

We will continue to track this issue and keep you informed of any changes.

Disclaimer: The information contained in this blog is for general informational purposes only and is not intended as legal, regulatory, compliance or other professional advice. Federal and state laws, rules, and regulations can change, and state laws may vary. As such, we make no warranties or representations about this blog’s information as complete, reliable, or suitable for your specific situation. Your reliance on any information contained in this blog does not establish a professional relationship with us and any such reliance by you is at your own risk. Always consult a qualified compliance professional before making decisions that could affect your compliance obligations. If you need assistance with your compliance responsibilities, please contact us.