The U.S. District Court for the Northern District of Texas issued a nationwide order vacating the Health Insurance Portability And Accountability (HIPAA) Privacy Rule to Support Reproductive Healthcare Privacy on June 18, 2025. Only the enhanced Notice of Privacy Practices (NPP) requirement for substance use disorder (SUD) patient records remains in place.
This decision significantly changes the HIPAA landscape by eliminating compliance obligations related to reproductive health, such as policies, procedures, attestation forms, and training. However, healthcare providers and organizations must continue to comply with HIPAA's Privacy Rule regarding the privacy of protected health information (PHI) and heed state laws that may provide enhanced privacy for this specific category of health information.
Explore the ruling’s key highlights, its compliance implications, and what to expect next with the following insights.
Why the court struck it down
Although made at the district level, the ruling has an immediate nationwide effect based on the following reasons:
Exceeding statutory authority
The court found Health and Human Services (HHS) lacked explicit Congressional authorization to create special reproductive health data protections — this fell under the politically sensitive major questions doctrine reserved for Congress.
Conflict with state public health reporting
By requiring entities to assess the legality of reproductive care before disclosure, the rule conflicted with state obligations — especially child-abuse reporting — and thus violated HIPAA's express protection for state public health law.
Unlawful redefinition of terms
The court held that HHS' new definitions of person and public health exceeded its regulatory authority.
Compliance implications for covered entities
Healthcare providers and organizations can expect the following compliance changes to their HIPAA regulations:
