Summary

Health and data privacy are increasingly under threat, leaving people vulnerable to the misuse of their personal information amid the broader landscape of reproductive health and pregnancy criminalization. We now have fewer medical privacy protections than we did at the beginning of 2025. It is essential that states expand privacy protections to safeguard reproductive health care access and fight back against the weaponization of sensitive health information.

HIPAA Privacy Rule

HIPAA Privacy Rule

In June 2025, Judge Matthew Kacsmaryk vacated the 2024 HIPAA Privacy Rule in Purl et al. v. Department of Health and Human Services, meaning that it is not in effect nationwide and HIPAA-covered entities are no longer required to comply with the 2024 Privacy Rule. Before it was overturned, the 2024 Privacy Rule lessened the risk of patients being reported to law enforcement and better protected people who are forced to travel to receive care because of state abortion bans.

The 2000 HIPAA Privacy Rule remains in effect. Under the law enforcement exception to the 2000 Privacy Rule, regulated entities are permitted, but not required, to disclose protected health information to law enforcement. It is crucial that regulated entities receive detailed guidance, education, and training on conditions for disclosures and risks to patients and providers associated with disclosures under HIPAA and other federal and state laws.

State protections

State protections

Post-Dobbs, there has been an uptick in investigations, both state and federal, seeking reproductive health data. At the same time, other states have stepped up to support out-of-state patients in accessing abortion. States can continue to protect access by passing, issuing, and/or implementing:

• Strong shield law statutes, regulations, and/or executive orders that prohibit entities in the state from cooperating with out-of-state investigations or proceedings for providing, securing, receiving, inquiring about, or assisting in reproductive health services.
• Repeals of abortion bans and restrictions still on the books.
• Broad health privacy laws that limit both the collection and disclosure of reproductive health information, building upon the 2024 Privacy Rule.
• Laws that prohibit virtual tracking, known as a “geofence,” around health care facilities.
• Laws governing health information systems, requiring them to develop technological capabilities that restrict the disclosure of reproductive health data.

Health care is increasingly criminalized across the country and patients must, now more than ever, be able to trust that their providers will keep their medical information private.

Reach out for help

Reach out for help

Individuals in every state and territory who are concerned about the potential legal risk of seeking medical care can contact If/When/How’s Repro Legal Helpline for free, confidential legal advice at www.reprolegalhelpline.org.

Questions about the legal right to provide or support abortion care can be directed to the Abortion Defense Network at https://abortiondefensenetwork.org/get-in-touch.

For other technical assistance, including legislative drafting, contact [email protected] or [email protected].

Acknowledgements

Acknowledgements

This publication is a joint product of the Center for Reproductive Rights, If/When/How: Lawyering for Reproductive Justice, and the National Partnership for Women & Families.

It was authored through extraordinary collaboration by Ashley Kurzweil, Lauren Paulk, Liz McCaman Taylor, Nimra Chowdhry, Nina Dutta, and Vidhi Bamzai.

Additional thanks to Andrea Wang, Becca Symes, Farah Diaz-Tello, Jen Girdish, Liz Wagner, and Tallin Moyer.

Download resources