On June 19, 2025, the U.S. District Court for the Northern District of Texas vacated the majority of the Biden Administration rule (the “2024 Rule”) modifying the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) under the Health Insurance Portability and Accountability Act (“HIPAA”) regarding protected health information (“PHI”) concerning reproductive health.  As discussed in further detail in our previous blog post, the 2024 Rule “limit[ed] the circumstances in which provisions of the Privacy Rule permit the use or disclosure of an individual’s PHI about reproductive health care for certain non-health care purposes.” 

The court held that the portions of the 2024 Rule related to PHI regarding reproductive health must be vacated because they (1) were “contrary to law,” because the rule unlawfully limited state public health laws; (2) impermissibly redefined the terms “person” and “public health”; and (3) relied upon authority not delegated to the Department of Health and Human Services by Congress, in contravention of the major-questions doctrine.

While the court vacated the majority of the 2024 Rule, it left in place certain provisions related to disclosures required to be included in a covered entity’s Notice of Privacy Practices (“NPP”).  Specifically, the court left in place the portion of the 2024 Rule that requires covered entities that create or maintain records that are also regulated by 42 CFR part 2 (which regulates substance use disorder patient records) to provide certain information about these records to individuals via covered entities’ NPPs, including the ways such records may be used and disclosed, and of individuals’ rights with respect to such records.  Covered entities have until February 16, 2026, to comply with the 2024 Rule’s provisions related to NPPs.