Selerix Compliance Corner Update!

On June 18, 2025, a federal district court in Texas vacated key provisions of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (“Final Rule”), effectively halting its enforcement across the country. The Final Rule—originally implemented on April 24, 2024—was designed in response to Dobbs v. Jackson Women’s Health Organization, aiming to safeguard individuals’ access to lawful reproductive health care without fear of having their protected health information (PHI) disclosed for investigations or legal proceedings under state laws. 

What the Final Rule Required 

Under the Final Rule, Covered Entities—including group health plans, providers, and clearinghouses—were required to: 

• Update HIPAA Privacy policies and procedures by December 23, 2024. This included training staff to identify and handle impacted PHI requests and securing signed attestations for certain disclosures related to reproductive health care (e.g., law enforcement, oversight, or judicial requests). 

• Revise business associate agreements (BAAs), as needed, by December 23, 2024, to ensure alignment with the new privacy requirements. 

• Update their Notice of Privacy Practices by February 16, 2026, informing individuals of their rights under the Final Rule. 

What Changed—and Why 

The rule was challenged by a Texas health care provider who argued the Final Rule conflicted with state-level obligations, such as mandatory reporting of child abuse. The court agreed and ruled that the Department of Health and Human Services (HHS) overstepped its authority, particularly in expanding the definition of “person” to include unborn children. As a result, enforcement of the reproductive health care provisions of the Final Rule has been vacated nationwide. 

The Final Rule was one of several under review following the April 2025 Executive Order from President Trump, aimed at repealing certain federal regulations. At this time, it’s unclear whether the administration will appeal the ruling. 

What This Means for Employers 

This decision only affects the reproductive health care provisions of the Final Rule. All other HIPAA privacy and security requirements remain in effect, including obligations under applicable state privacy laws, which may still restrict the disclosure of reproductive health-related PHI. 

For employers—especially those sponsoring self-funded or fully insured group health plans—this means: 

• Maintain existing HIPAA privacy and security policies. 

• Continue issuing Notices of Privacy Practices to plan participants. 

• Ensure BAAs are in place with all applicable vendors and business associates. 

• Stay current on state-specific privacy laws, which may still apply. 

If your organization has already updated documentation to comply with the Final Rule’s reproductive health care provisions, you may now amend those materials to remove the vacated language. 

Looking Ahead 

This update only pertains to the reproductive health privacy provisions vacated by the court. HHS still plans to revise its model Notice of Privacy Practices to reflect other unrelated Final Rule updates before the February 16, 2026, deadline. Selerix will continue to monitor for changes and provide guidance when the new model notice is released. 

Disclaimer: Selerix does not provide legal, regulatory or tax guidance, or advice. If legal advice counsel or representation is needed, the services of a legal professional should be sought. The information in this post is intended to provide a general overview of the topics and services contained herein. Selerix makes no representation or warranty as to the accuracy or completeness of the post and undertakes no obligation to update or revise the post based upon new information or future changes.