Judge Overturns Biden-Era HIPAA Rule

A federal judge in the Northern District of Texas invalidated an April 2024 regulation from the Department of Health and Human Services (HHS) that aimed to expand HIPAA’s privacy protections for reproductive health care. The rule, which took effect on December 23, 2024, prohibited health plans, providers, and their business associates from using or disclosing protected health information (PHI) related to lawful reproductive health services under certain investigative circumstances. The court’s decision voids these protections nationwide.

What the Final Rule Did

• Scope and Purpose: The final rule, issued in April 2024, restricted regulated entities from sharing PHI in connection with criminal, civil, or administrative investigations into lawful reproductive health care services, such as abortion, fertility treatments, miscarriage care, and contraception.
• Attestation Requirement: When requests for PHI could relate to reproductive health, covered entities were required to obtain a signed attestation that the information would not be used for a prohibited purpose.
• Updated Privacy Notices: The rule required covered entities and business associates to revise their HIPAA Notices of Privacy Practices by February 16, 2026. These updates had to include information about the new reproductive health privacy protections. Entities that manage specific substance use disorder (SUD) records were also required to update their notices accordingly.

The Court’s Decision

The U.S. District Court for the Northern District of Texas held that HHS exceeded its legal authority with the rule and interfered with states’ rights to enforce their public health laws. As a result, the court vacated the reproductive health protections nationwide. However, it did not strike down the changes to privacy notice requirements for SUD records.

What This Means Going Forward

• HIPAA Compliance: Regulated entities must continue to comply with HIPAA’s core privacy rules and relevant state laws.
• Policy Review: Employers and other covered entities should reassess their HIPAA privacy policies and remove provisions that were based solely on the now-invalid reproductive health protections.
• Legal Outlook: Although the ruling could be appealed, the administration is unlikely to challenge it.