HIPAA reproductive healthcare privacy rule vacated
On June 18, a federal district court vacated most of the 2024 HIPAA privacy rule for reproductive healthcare. The court’s order has nationwide effect. Absent further court or agency action, the rule's heightened privacy protections for Protected Health Information related to reproductive healthcare — most of which took effect on Dec. 23, 2024 — are no longer required.
Going forward, HIPAA-covered entities — including sponsors of self-funded group health plans — will need to:
Decide whether to remove heightened privacy protections for reproductive healthcare PHI that are no longer required by law. Plan sponsors may want to re-evaluate how requests for reproductive healthcare PHI will be handled going forward. Some plan sponsors may want to unwind any changes made to comply with the reproductive healthcare privacy rule, and others may want to work with legal counsel to determine what changes to make, if any. In any case, plan sponsors may wish to consider how to handle requests for PHI related to certain sensitive healthcare.
Determine whether HIPAA materials need to be revised. Plan sponsors may need to revise their HIPAA policies and procedures manual and training materials — possibly retraining relevant workforce members — as well as the operational workflow used to respond to requests for PHI if changes made to comply with the reproductive healthcare privacy rule are reversed.
Be prepared to update and distribute revised HIPAA privacy notice. Portions of the reproductive healthcare privacy rule requiring amendments to the HIPAA privacy notice related to substance use disorder records are still in effect. Although the amended notice is not required before February 16, 2026, employers may consider including the updated notice in open enrollment materials this fall. Some employers may want to wait until closer to the February 2026 deadline in the hope that HHS make available a new model notice, although the agency has not explicitly committed to providing one.
