When Was HIPAA Last Updated? Key Dates and the Most Recent Changes

You want the clearest, most current picture of HIPAA changes. The latest published HIPAA Privacy Rule amendments appeared in the Federal Register on April 26, 2024, took effect June 25, 2024, and carried most compliance deadlines to December 23, 2024—though key portions were later vacated by a federal court on June 18, 2025. Separately, the 42 CFR Part 2 Final Rule (substance use disorder confidentiality) was published February 16, 2024, with a firm compliance date of February 16, 2026, and HHS has proposed major Security Rule updates that are not yet final. ([govinfo.gov](https://www.govinfo.gov/content/pkg/FR-2024-04-26/pdf/2024-08503.pdf))

HIPAA Enactment and Historical Context

HIPAA was enacted on August 21, 1996, establishing national privacy and security standards for health information and directing HHS to issue implementing regulations. Subsequent milestones included the original Privacy Rule (finalized in 2000 and modified in 2002), the Security Rule (2003), the HITECH Act (2009), and the Omnibus Final Rule (2013), which integrated HITECH across HIPAA’s Privacy, Security, Enforcement, and Breach Notification Rules. ([govinfo.gov](https://www.govinfo.gov/content/pkg/FR-2024-04-26/pdf/2024-08503.pdf))

April 2024 Privacy Rule Update

On April 26, 2024, HHS/OCR published the “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” (a Federal Register Final Rule). It added a prohibition on using or disclosing PHI to investigate or impose liability on persons for seeking, obtaining, providing, or facilitating lawful reproductive health care, and required new written attestations for certain disclosures potentially involving reproductive health information. The rule became effective June 25, 2024, with a general compliance date of December 23, 2024, and a later date—February 16, 2026—for specific Notice of Privacy Practices (NPP) updates at 45 CFR 164.520. ([govinfo.gov](https://www.govinfo.gov/content/pkg/FR-2024-04-26/pdf/2024-08503.pdf))

June 2025 Court Decision Impact

On June 18, 2025, in Purl v. U.S. Department of Health and Human Services, the U.S. District Court for the Northern District of Texas issued a nationwide judicial vacatur of most provisions in the 2024 reproductive health care Privacy Rule amendments. HHS guidance notes that, while the court vacated specific NPP subsections related to reproductive health (164.520(b)(1)(ii)(F), (G), and (H)), other NPP modifications remained undisturbed. In practice, covered entities no longer need the vacated attestations or reproductive‑health NPP language, but should retain any unaffected updates. ([litigationtracker.law.georgetown.edu](https://litigationtracker.law.georgetown.edu/wp-content/uploads/2024/10/Purl_2025.06.18_MEMORANDUM-OPINION-AND-ORDER.pdf?utm_source=openai))

Proposed 2024 Security Rule Amendments

HHS/OCR issued a Notice of Proposed Rulemaking to modernize the HIPAA Security Rule on December 27, 2024 (published January 6, 2025 at 90 FR 898). The NPRM proposes more prescriptive safeguards, including annual review and testing of security measures, technology asset inventories and network mapping, stronger access controls such as multi‑factor authentication, encryption consistent with prevailing cryptographic standards, vulnerability management and periodic penetration testing, and updates to business associate and group health plan documentation. As of May 23, 2026, these Security Rule amendments remain proposed—not final. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html))

Part 2 Final Rule and Compliance Dates

The 42 CFR Part 2 Final Rule (implementing the CARES Act) was published on February 16, 2024, became effective April 16, 2024, and set a compliance deadline of February 16, 2026. Among other changes, the rule aligns Part 2 confidentiality with HIPAA by permitting a single patient consent for treatment, payment, and health care operations and strengthening enforcement and breach notification alignment. These changes intersect with HIPAA by requiring covered entities that handle SUD records to reflect the updated protections in their notices and practices. ([govinfo.gov](https://www.govinfo.gov/content/pkg/FR-2024-02-16/pdf/2024-02544.pdf?utm_source=openai))

Notice of Privacy Practices Update Requirements

Covered entities that create or maintain SUD records must update their NPPs to explain how Part 2 information is used and disclosed, including the limits on using SUD records in legal proceedings without consent or a qualifying court order. The compliance deadline for these updates was February 16, 2026. HHS has published updated model NPPs to help you incorporate the new SUD confidentiality language. Note that NPP text specifically tied to the 2024 reproductive‑health amendments was among the provisions vacated in June 2025 and is not required. ([hhs.gov](https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/npp_fullpage_hc_provider.pdf?utm_source=openai))

FAQs

When was the last HIPAA Privacy Rule update published?

The last published HIPAA Privacy Rule amendments appeared in the Federal Register on April 26, 2024. Most of those reproductive‑health provisions were later vacated by a federal court on June 18, 2025. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/index.html))

What changes did the 2024 HIPAA final rules introduce?

Two key 2024 finals mattered most: (1) the April 26, 2024 Privacy Rule (reproductive‑health PHI) added a new prohibition on certain uses/disclosures and required attestations—later mostly vacated; and (2) the February 16, 2024 Part 2 Final Rule aligned substance use disorder confidentiality with HIPAA, enabling a single consent for TPO and requiring related NPP updates by February 16, 2026. ([govinfo.gov](https://www.govinfo.gov/content/pkg/FR-2024-04-26/pdf/2024-08503.pdf))

How did the 2025 court decision affect HIPAA Privacy Rule amendments?

In Purl v. HHS (June 18, 2025), the court issued a nationwide judicial vacatur of most 2024 reproductive‑health amendments. HHS indicates the court specifically vacated NPP subsections 164.520(b)(1)(ii)(F), (G), and (H), while leaving other NPP modifications in place. ([litigationtracker.law.georgetown.edu](https://litigationtracker.law.georgetown.edu/wp-content/uploads/2024/10/Purl_2025.06.18_MEMORANDUM-OPINION-AND-ORDER.pdf?utm_source=openai))

When is the compliance deadline for the updated Notice of Privacy Practices?

The NPP compliance deadline tied to the Part 2 Final Rule was February 16, 2026. HHS’s model notices reflect the required SUD confidentiality content you must include. ([govinfo.gov](https://www.govinfo.gov/content/pkg/FR-2024-02-16/pdf/2024-02544.pdf?utm_source=openai))