Overview
The recent federal court decision that invalidated the Biden administration’s HIPAA Privacy Rule aimed at protecting reproductive health care privacy has eliminated a significant safeguard for such sensitive information. As a result, the responsibility now shifts primarily to individual states and local governments to establish and enforce appropriate data protection measures. At present, protections at the state level for reproductive health data form an inconsistent mosaic, with robust legal frameworks in certain regions and notable gaps in others.
The past three years have brought considerable upheaval to the landscape of reproductive health data privacy. Following the Supreme Court’s 2022 ruling in Dobbs v. Jackson Women’s Health Organization, which determined that the U.S. Constitution does not guarantee a right to abortion, both individual states and the prior federal administration moved quickly to strengthen privacy measures for reproductive health information. Concurrently, a series of legal challenges targeted the Biden-era HIPAA Privacy Rule designed to support reproductive health care privacy, known simply as the Rule. This regulation specifically barred the use or sharing of protected health information for criminal prosecutions or investigations arising solely from someone seeking, receiving, providing, or assisting with reproductive healthcare services. This analysis delves deeply into the transformed legal environment surrounding reproductive health data privacy and explores the critical question: what steps should be taken next?
Federal-level protections for reproductive health data have effectively ceased to exist. On June 18, 2025, a judge in the U.S. District Court for the Northern District of Texas delivered a decision in Purl v. Department of Health and Human Services that fully vacated the Rule. The Department of Health and Human Services failed to submit a notice of appeal by the required deadline of August 18, 2025, effectively indicating its decision to cease defending the regulation.
The Rule’s last potential avenue for survival rested with an appeal initiated by the cities of Madison, Wisconsin, and Columbus, Ohio, along with Doctors for America. These groups contended in the District Court that the federal agency was not mounting a sufficient defense and requested permission to intervene and advocate on behalf of the Rule. The court rejected their motion to join the litigation. In the end, on September 4, 2025, Madison, Columbus, and Doctors for America abandoned their appeals against both the denial of intervention and the overarching final judgment.
Even though the specific Rule no longer offers protection for protected health information connected to reproductive health, the foundational HIPAA regulations that restrict the use and disclosure of such information continue to govern reproductive-health-related data. The core principle of the HIPAA privacy rule remains intact: disclosure of protected health information typically demands patient authorization, except in cases where a defined exception permits otherwise.
These exceptions—covering scenarios like law enforcement needs, health oversight activities, or mandates from other statutes—come with strict conditions and requirements that covered entities and their business associates must satisfy before any use or disclosure occurs. While certain laws might compel disclosure in specific situations, the HIPAA framework authorizes rather than mandates such actions.
State-by-state protections for reproductive health data continue to exhibit significant variation across the nation. Jurisdictions including California, Connecticut, Delaware, Illinois, Massachusetts, New Jersey, New Mexico, New York, and the District of Columbia have enacted dedicated reproductive health data privacy statutes, both prior to and following the Dobbs decision. These measures introduce enhanced safeguards, such as bans on sharing reproductive health data with investigators, prosecutors, or during civil, legislative, or administrative processes. Nevertheless, this fragmented, state-specific strategy creates clear vulnerabilities, particularly since data originating in a protective state could potentially cross borders and become accessible to entities hostile to reproductive health rights in less protective areas.
Concerns persist regarding the privacy of consumer-generated reproductive health data held by app developers and other entities not subject to HIPAA regulations. A handful of states have introduced broad health data privacy legislation. Washington’s My Health My Data Act stands as a pioneering comprehensive consumer health data privacy law that explicitly bolsters protections for reproductive health information. Nevada has since adopted a similar expansive consumer health privacy statute. Despite these advancements, widespread adoption of such comprehensive state laws has not materialized.
Additionally, 20 states maintain general consumer privacy laws that could potentially extend some safeguards to reproductive health data. California, for instance, offers protections for “sensitive personal information,” encompassing health details and aspects of a consumer’s “sex life.” Virginia has updated its Consumer Protection Act to expressly forbid the collection, sharing, or sale of reproductive health data absent consumer consent, with the changes taking effect on July 1, 2025.
Conclusion
The revocation of the HIPAA reproductive health privacy Rule strips away an important layer of defense for reproductive health data, placing the burden squarely on states and localities to step up with new protective measures. Consequently, we can anticipate ongoing legislative and policy efforts at the state level in the coming period.
