HIPAA Privacy Rule to Support Reproductive Health Care Privacy Final Rule Explained

Final Rule Issuance and Background

The U.S. Department of Health and Human Services (HHS), through the Office for Civil Rights (OCR), finalized modifications to the HIPAA Privacy Rule intended to strengthen privacy protections for reproductive health information, a category of Protected Health Information (PHI). The Final Rule targeted how Covered Entities and their Business Associates handle PHI in the wake of changing state laws post-Dobbs. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

The rule was published in the Federal Register on April 26, 2024, and became effective June 25, 2024. It was designated a major rule at 89 FR 32976. ([gao.gov](https://www.gao.gov/products/b-336288?utm_source=openai))

Key Prohibited Uses and Disclosures

As issued, the Final Rule prohibited regulated entities from using or disclosing PHI to: (1) investigate or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care lawful under the circumstances; or (2) identify any person for such purposes. A presumption of lawfulness applied when the care was provided by someone other than the recipient of the request, unless the presumption was overcome by specified evidence. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

The prohibition applied if the reproductive health care was lawful in the place provided, or protected, required, or authorized by federal law (including the U.S. Constitution). The rule also articulated how and when the presumption of lawfulness could be rebutted. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

Note: On June 18, 2025, a federal district court vacated most of these provisions nationwide; see “Legal Challenges and Court Decisions” below for current status. ([docs.justia.com](https://docs.justia.com/cases/federal/district-courts/texas/txndce/2%3A2024cv00228/395990/110?utm_source=openai))

Attestation Requirements for PHI Disclosure

The Final Rule introduced a PHI Disclosure Attestation: when receiving requests for PHI potentially related to reproductive health care, regulated entities had to obtain a signed attestation that the requested use or disclosure was not for a prohibited purpose. This requirement applied to requests for PHI in four categories: health oversight activities; judicial and administrative proceedings; law enforcement purposes; and disclosures to coroners and medical examiners. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

OCR indicated it would publish model attestation language; industry guidance noted that entities could rely on compliant attestations while considering the totality of circumstances around the request (for example, who is requesting the PHI and which HIPAA permission is cited). The Final Rule also clarified responsibilities for Business Associates. ([nixonpeabody.com](https://www.nixonpeabody.com/insights/alerts/2024/04/24/hipaa-privacy-rule-to-support-reproductive-health-care-privacy?utm_source=openai))

Current status: the attestation requirement was vacated by the Northern District of Texas on June 18, 2025; unless and until reversed on appeal, regulated entities are not required to obtain this attestation. ([docs.justia.com](https://docs.justia.com/cases/federal/district-courts/texas/txndce/2%3A2024cv00228/395990/110?utm_source=openai))

Compliance and Effective Dates

• Publication and effective date: April 26, 2024 (89 FR 32976); effective June 25, 2024. ([gao.gov](https://www.gao.gov/products/b-336288?utm_source=openai))
• General compliance date: 240 days after publication (December 23, 2024). ([dlapiper.com](https://www.dlapiper.com/en-us/insights/publications/2024/05/ocr-finalizes-hipaa-privacy-rule-to-support-reproductive-healthcare-privacy?utm_source=openai))
• Notice of Privacy Practices (NPP) updates: compliance by February 16, 2026, aligned with Part 2 changes. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

Subsequently, on June 18, 2025, the court vacated most of the Final Rule, altering compliance obligations. See “Legal Challenges and Court Decisions.” ([docs.justia.com](https://docs.justia.com/cases/federal/district-courts/texas/txndce/2%3A2024cv00228/395990/110?utm_source=openai))

Legal Challenges and Court Decisions

Multiple challenges were filed soon after issuance, including a suit by a Texas physician (Carmen Purl) and separate litigation by the State of Texas. On December 23, 2024, the court found the rule likely unlawful and later, on June 18, 2025, issued a final order vacating most of the rule nationwide. ([reuters.com](https://www.reuters.com/legal/litigation/texas-doctor-sues-over-biden-administrations-abortion-privacy-rule-2024-10-21/?utm_source=openai))

In Purl v. HHS, the Northern District of Texas vacated the HIPAA Privacy Rule to Support Reproductive Health Care Privacy except for certain NPP provisions, and additionally vacated specific new NPP paragraphs at 45 CFR 164.520(b)(1)(ii)(F), (G), and (H). HHS has stated that remaining NPP modifications (unrelated to those vacated) continue in effect. ([docs.justia.com](https://docs.justia.com/cases/federal/district-courts/texas/txndce/2%3A2024cv00228/395990/110?utm_source=openai))

Notice of Privacy Practices Modifications

Originally, the Final Rule required Covered Entities to revise their NPPs (45 CFR 164.520) to reflect new reproductive health protections and to incorporate changes aligned with the 2024 Part 2 Final Rule. After the June 18, 2025 decision, the court vacated NPP paragraphs (b)(1)(ii)(F), (G), and (H); however, HHS indicates remaining NPP modifications (not deemed unlawful) still stand, with a compliance date of February 16, 2026. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

Practical takeaway: ensure NPP planning distinguishes between reproductive health NPP elements the court vacated and any remaining NPP updates (for example, those tied to Part 2) that still require action by the February 16, 2026 deadline. ([dwt.com](https://www.dwt.com/blogs/privacy--security-law-blog/2025/06/hipaa-reproductive-care-privacy-rule-texas-court?utm_source=openai))

Ongoing Compliance Obligations

Even with the vacatur, you must continue to follow the baseline HIPAA Privacy Rule. Uses and disclosures without authorization remain limited to those expressly permitted or required by HIPAA (for example, disclosures “required by law” that meet all applicable conditions). Maintain minimum necessary practices, document decisions, and train staff on handling sensitive requests for PHI. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/phi-reproductive-health/index.html?utm_source=openai))

Monitor litigation and HHS/OCR updates. If you previously implemented policies, forms, or Business Associate workflows to comply with the vacated provisions (prohibitions and PHI Disclosure Attestation), evaluate and adjust them to align with current federal and state requirements while preserving robust privacy safeguards. ([hklaw.com](https://www.hklaw.com/en/insights/publications/2025/06/hipaas-reproductive-health-rule-is-vacated-nationally?utm_source=openai))

FAQs

What protections does the Final Rule provide for reproductive health information?

As issued, the rule prohibited using or disclosing PHI to investigate, impose liability for, or identify someone in connection with lawful reproductive health care, and it created a presumption that such care was lawful unless specific evidence showed otherwise. Those provisions were later vacated nationwide on June 18, 2025. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

When did the Final Rule become effective?

HHS published the Final Rule on April 26, 2024; it became effective June 25, 2024. The general compliance date was December 23, 2024, and remaining NPP modifications carry a February 16, 2026 deadline. A June 18, 2025 court decision vacated most of the rule. ([gao.gov](https://www.gao.gov/products/b-336288?utm_source=openai))

How must covered entities comply with attestation requirements?

Originally, you had to obtain a signed attestation for requests potentially involving reproductive health PHI in four contexts (oversight, judicial/administrative, law enforcement, coroners/medical examiners), and you could rely on a compliant attestation while considering the totality of circumstances. After the June 18, 2025 ruling, the attestation requirement is vacated and not presently required. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html))

What was the impact of the court decision on the Final Rule?

The Northern District of Texas vacated most of the rule nationwide, including the core prohibitions and the PHI Disclosure Attestation, and also vacated specific new NPP paragraphs at 45 CFR 164.520(b)(1)(ii)(F)–(H). HHS states remaining NPP modifications continue to apply, with compliance due February 16, 2026. ([docs.justia.com](https://docs.justia.com/cases/federal/district-courts/texas/txndce/2%3A2024cv00228/395990/110?utm_source=openai))