In the July Advisor® issue, we included a note that the U.S. District Court for the Northern District of Texas issued a nationwide order vacating most of the HIPAA Rule to Support Reproductive Health Care Privacy. The Department of Health and Human Services (HHS) has not yet published next steps concerning the court decision. Although HHS is not expected to appeal the decision, it is hoped that specific guidance will be provided regarding the Notice of Privacy Practices (NPP) modifications that were unaffected by the court decision. Since the Rule required covered entities to comply with NPP modifications by February 16, 2026, we do not anticipate that earlier revision will be necessary. Therefore, if you have not yet updated your NPP with our revised version, please do not do so at this time.
It is important to note that several states have enacted privacy laws concerning reproductive health care. These “shield” laws limit the disclosures that covered entities may make to out of state law enforcement about abortion services lawfully provided in their own state. As in most other instances where state law provides for greater patient privacy, covered entities must heed the more stringent state law. It is expected that these laws will be more actively enforced in the absence of the federal reproductive health care privacy protections.
For more information, please visit the following website to determine whether your state has any shield laws in place: https://law.ucla.edu/academics/centers/center-reproductive-health-law-and-policy/shield-laws-reproductive-and-gender-affirming-health-care-state-law-guide
HIPAA Compliance System Subscribers
An update will be made available in the Member Services area of our website on September 3, 2025, that includes revised Notice of Privacy Practices templates. As noted in the article, a Notice of Privacy Practices must include a description of prohibited disclosures, now only in regard to Part 2 records. Any statements regarding Federal reproductive healthcare privacy protections should be removed according to the court ruling.
We are providing this update well ahead of the February 16, 2026, deadline to allow you time to get the new copy posted in your workplace and on your website, if applicable. You will not be required to distribute copies of the revised Notice to patients but should provide a copy to new patients at the time of their first service, and to existing patients upon request.
The November 2025 Compliance Training module on HIPAA’s Privacy Rule will ensure that workforce members are made aware of the regulatory changes. Policy revisions that reflect the regulatory changes will follow as part of the regular 2026 updates.
