Since the Dobbs v. Jackson Women’s Health Organization decision (which overturned the landmark Roe v. Wade decision), the healthcare industry has continued to grapple with renewed concerns over patient privacy and reproductive healthcare. Legislators and regulators have not been idle, establishing a patchwork of authorities which require careful navigation and consideration. It is worth noting that reproductive healthcare privacy is not a concern exclusive to women. Rather, such privacy concerns also apply to services traditionally received by men, such as testosterone replacement and male fertility treatments.
Federal Treatment of Reproductive Healthcare Privacy
In April of 2024, the Office of Civil Rights (“OCR”) issued a Final Rule (the “Reproductive Final Rule”) to expand HIPAA’s protections around reproductive health privacy.[1] The Reproductive Final Rule was issued in response to Executive Order 14076, which directed the U.S. Department of Health and Human Services (“HHS”) to consider ways to strengthen privacy protections for reproductive healthcare services, following the Supreme Court’s ruling in Dobbs. Under the Reproductive Final Rule, the use or disclosure of protected health information (“PHI”) was prohibited where such use or disclosure was for the purpose of a criminal, civil, or administrative investigation into, or proceeding against, any person seeking, obtaining, providing, or facilitating lawful reproductive healthcare.[2] Similarly, the Reproductive Final Rule also prohibited use or disclosure of PHI to impose criminal, civil, or administrative liability on any person for seeking, obtaining, providing, or facilitating reproductive healthcare.[3]
The Reproductive Final Rule is currently the target of several lawsuits, including one filed by the Texas Attorney General as well as another filed by fifteen (15) State Attorneys General.[4] The foregoing lawsuits center on arguments that OCR exceeded the scope of its rulemaking authority in enacting the Reproductive Final Rule. Significantly, on June 18, 2025, the U.S. District Court for the North District of Texas issued an order vacating the Reproductive Final Rule, holding that “HHS lacked clear delegated authority to fashion special protections for medical information produced by politically favored medical procedures.”[5] It is unclear whether the ruling will be appealed, but it is anticipated that HHS will likely not pursue further action.
Separately, an Executive Order issued on January 24, 2025, repealed several previously-issued Executive Orders which were intended to protect patient access to reproductive healthcare services following the Dobbs decision (including Executive Order 14076 which served as one of the bases for the Reproductive Final Rule). Notably, this Executive Order instructs the Director of the Office of Management and Budget to promulgate guidance related to the implementation of the Executive Order, which has not yet been published.
State Treatment of Reproductive Healthcare Privacy
Several states have taken steps to protect healthcare providers, patients, and others involved in reproductive healthcare. Although state laws vary across jurisdictions, generally they limit (or outright prohibit) the disclosure of information related to reproductive healthcare that was lawfully received by a patient and furnished by a healthcare provider. For example:
- California amended its Confidentiality of Medical Information Act to prohibit disclosure of medical information related to an individual seeking or obtaining an abortion in response to a subpoena or even to law enforcement for purposes of enforcing a state’s laws that interfere with the patient’s rights under the Reproductive Privacy Act, among other prohibitions.[6]
- In November 2024, New York voters approved Proposition One, which amended the New York State Constitution to explicitly protect against discrimination based on reproductive healthcare decisions and to recognize reproductive autonomy as a fundamental right in New York.
With individual states adopting their own unique approaches to reproductive health privacy, regulated parties must now navigate a web of authorities in an already sensitive environment.
Conclusion
The world of reproductive healthcare privacy remains increasingly complex due to competing federal and state interests, a shifting political landscape, as well as evolving technologies and delivery methods. While the Reproductive Final Rule faces an uncertain future, state laws and consumer privacy regulations are filling the gap by creating an overlapping and sometimes conflicting patchwork of legal authorities. It is important for healthcare providers, insurers, and digital health platforms to ensure compliance with both federal requirements and state level regulations as well as taking proactive steps to have clear policies on data sharing and privacy audits, as well as engage in strategic communication with legal counsel.
FOOTNOTES
[1] HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. 32976 (Apr. 26, 2024) (to be codified at 42 C.F.R. Parts 160 and 164).
[2] 45 C.F.R. § 164.502(a)(5)(iii)(A)(1).
[3] 45 C.F.R. § 164.502(a)(5)(iii)(A)(2).
[4] State of Texas v. U.S. Department of Health and Human Services, et al., Case No. 5:24-cv-00204-H (N.D. Tex.); State of Tennessee, et al. v. U.S. Department of Health and Human services, et. al., Case No. 3:25-cv-00025 (E.D. Tenn.)
[5] Purl v. U.S. Dep’t of Health and Human Servs., et al., No. 2:24-cv-00228-Z (N.D. Tex. 2025).
[6] Cal. Civ. Code § 56.108.