HIPAA Reproductive Privacy Rule Vacated (2025)

The only federal rule protecting reproductive health data was struck down in June 2025. Biden-era orders revoked. Tracker data has no federal protection.

The HIPAA Privacy Rule to Support Reproductive Health Care Privacy was vacated nationwide on June 18, 2025 by Judge Matthew Kacsmaryk. HHS declined to appeal. Biden-era executive orders directing HHS and FTC action were revoked on January 24, 2025. The My Body My Data Act has a 2% chance of clearing committee. Period tracker data has zero federal health data protection.

On June 18, 2025, the only federal rule specifically protecting reproductive health data from law enforcement disclosure was struck down. The HIPAA Privacy Rule to Support Reproductive Health Care Privacy lasted fourteen months from finalization to vacatur. No replacement exists. No replacement is expected.

The Rule and Its Vacatur

HHS finalized the HIPAA Privacy Rule to Support Reproductive Health Care Privacy on April 22, 2024. The rule would have prohibited HIPAA-covered entities, hospitals, insurers, healthcare clearinghouses, from disclosing protected health information for the purpose of investigating or prosecuting reproductive healthcare that was lawful in the state where it occurred.

The rule required entities receiving requests for reproductive health records to obtain written attestations from the requester confirming that the request was not for prohibited investigative purposes.

Fifteen Republican attorneys general challenged the rule. Texas led the lawsuit.

On June 18, 2025, Judge Matthew Kacsmaryk of the Northern District of Texas vacated the rule nationwide in Purl v. HHS (No. 2:24-cv-00228-Z). The court held that HHS exceeded its statutory authority under HIPAA and invoked the major questions doctrine, the principle that agencies cannot make decisions of major political significance without explicit congressional authorization.

HHS declined to appeal by the August 2025 deadline. The Fifth Circuit dismissed proposed intervenors' appeal in September 2025. Covered entities reverted to the pre-2024 HIPAA baseline, which contains no specific protections for reproductive health records.

Biden Executive Orders Revoked

Two executive orders that had directed federal agencies to protect reproductive health data were revoked on January 24, 2025.

Executive Order 14076 (signed July 8, 2022) had directed the FTC to protect consumer privacy specifically for reproductive healthcare. Executive Orders 14079 and 14101 had directed HHS to strengthen HIPAA protections for reproductive health information.

These orders did not have the force of law. They directed agency action. With their revocation, the executive branch directive to prioritize reproductive health data protection ended.

Federal Legislation: Introduced, Stalled, Dead

Three federal bills have addressed reproductive health data. None are expected to become law.

My Body My Data Act (H.R. 3916 / S. 2029, 119th Congress): The most comprehensive proposal. It would impose strict data minimization for reproductive health information, including menstrual cycle data, grant users rights to access, correct, and delete their data, preserve stronger state laws, and provide FTC enforcement plus a private right of action with statutory damages of $100-$1,000 per day of violation.

The bill has 99 House co-sponsors and 19 Senate co-sponsors. GovTrack gives it a 2% probability of clearing committee and 0% probability of enactment.

Health and Location Data Protection Act (Senator Warren): Would ban data broker sales of location and health data outright. Stalled with no committee action.

Fourth Amendment Is Not For Sale Act (Senator Wyden, bipartisan): Would require court orders for government purchases of data from brokers. Passed the House 219-199 in April 2024. Died in the Senate without a vote.

The 81% Misconception

A ClearDATA/Harris Poll survey (May 2023, n=2,053) found that 81% of Americans wrongly believe HIPAA covers health apps. It does not and never has.

HIPAA applies to covered entities: health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically. Consumer period tracking apps do not fall into any of these categories. Flo, Clue, Natural Cycles, Stardust, none are bound by HIPAA.

The vacated reproductive privacy rule would not have changed this. Even at full force, the rule applied only to covered entities. Period tracker apps were outside its scope from the start.

58% of period tracker users have never considered where their data goes. The assumption that "health data must be protected by health law" is wrong. The gap between assumption and reality has grown.

What Survives: The FTC Health Breach Notification Rule

The FTC updated its Health Breach Notification Rule in July 2024. The update explicitly covers health apps, including period trackers, fertility apps, and sexual health apps. It defines "breach" to include unauthorized disclosures of health data, not just cyberattacks. It covers inferred health data, not just data users enter directly.

This is the only federal rule that explicitly applies to period tracker apps.

The enforcement question is separate from the rule's existence. FTC Chair Andrew Ferguson leads a commission with only 2 of 5 seats filled. Three commissioner seats are vacant. The commission's enforcement posture has shifted from the aggressive stance taken under former Chair Lina Khan, who brought actions against GoodRx, BetterHelp, Premom, and multiple data brokers.

The rule says apps must notify users of unauthorized disclosures. Whether the current FTC will enforce that requirement against a major period tracker app is an open question.

What This Means for Period Tracker Users

There is no federal floor for reproductive health data protection. The HIPAA reproductive privacy rule is gone. The executive orders are revoked. The legislative proposals are stalled. The FTC is operating at reduced capacity.

State laws vary. Some states (California, Washington, Connecticut, and others) have enacted reproductive health data protections. Most have not. The patchwork means your protection depends on your zip code.

Architecture fills the gap that regulation left open. An app that stores data only on your device eliminates the data that regulations would have protected. There is no server to subpoena, no database to breach, no company that can be compelled to hand over records it does not hold.

Floriva keeps core cycle data local-first. Floriva has no readable central reproductive-health database. Device access and operational records are separate risks.

Definitions

HIPAA Reproductive Privacy Rule: The HIPAA Privacy Rule to Support Reproductive Health Care Privacy, finalized April 22, 2024 by HHS. It would have prohibited covered entities from disclosing protected health information for the purpose of investigating or prosecuting lawful reproductive healthcare. Vacated nationwide on June 18, 2025.
Major questions doctrine: A judicial doctrine holding that federal agencies cannot make decisions of major economic or political significance without clear congressional authorization. Judge Kacsmaryk used this doctrine to vacate the HIPAA reproductive privacy rule, ruling that HHS lacked explicit statutory authority to restrict disclosure of reproductive health records to law enforcement.
Covered entity: Under HIPAA, a covered entity is a health plan, healthcare clearinghouse, or healthcare provider that transmits health information electronically. Consumer period tracking apps are not covered entities. They are not bound by HIPAA and never were, even before the reproductive privacy rule was vacated.

Quick answers to the obvious questions.

Does HIPAA protect my period tracker data?

No. Period tracker apps are not HIPAA covered entities. They are not health plans, healthcare clearinghouses, or healthcare providers that transmit data electronically. HIPAA has never applied to consumer health apps. The HIPAA reproductive privacy rule that was vacated in June 2025 would not have changed this, it applied only to covered entities like hospitals and insurers. 81% of Americans wrongly believe HIPAA covers health apps (ClearDATA/Harris Poll, May 2023, n=2,053).

What federal law protects reproductive health data now?

The FTC Health Breach Notification Rule, updated July 2024, is the only federal rule that explicitly covers health apps. It requires apps to notify users of unauthorized data disclosures. But it does not prevent data collection, does not restrict law enforcement access, and the FTC currently operates with only 2 of 5 commissioners. No federal law provides a floor of protection for reproductive health data stored by consumer apps.

What happened to the HIPAA reproductive privacy rule?

The rule was finalized April 22, 2024 and would have prohibited covered entities from disclosing protected health information for investigating lawful reproductive healthcare. Fifteen Republican attorneys general challenged it. Judge Matthew Kacsmaryk vacated the rule nationwide on June 18, 2025 in Purl v. HHS (N.D. Tex., No. 2:24-cv-00228-Z), ruling that HHS exceeded its statutory authority. HHS declined to appeal by the August 2025 deadline. The Fifth Circuit dismissed proposed intervenors' appeal in September 2025.

Questions people ask before they switch.

Could Congress pass a law protecting reproductive health data?

Three bills have been introduced. The My Body My Data Act (H.R. 3916 / S. 2029, 119th Congress) has 99 House and 19 Senate co-sponsors but GovTrack rates it at 2% committee clearance and 0% enactment probability. The Health and Location Data Protection Act (Senator Warren) would ban data broker sales of location and health data, stalled. The Fourth Amendment Is Not For Sale Act (Senator Wyden, bipartisan) passed the House 219-199 in April 2024 but died in the Senate. None are expected to become law in the current Congress.

What would the My Body My Data Act do if passed?

The bill would impose strict data minimization for reproductive health information, including menstrual cycle data, grant users rights to access, correct, and delete their data, preserve stronger state laws, and provide both FTC enforcement and a private right of action with statutory damages of $100-$1,000 per day of violation. It would be the first federal law to explicitly protect period tracker data. It has a 2% chance of clearing committee.

Is the FTC still enforcing health data privacy?

The FTC updated its Health Breach Notification Rule in July 2024 to explicitly cover health apps, defining unauthorized data disclosures (not just cyberattacks) as reportable breaches. The rule covers fertility and sexual health data, including inferred health data. However, FTC Chair Andrew Ferguson leads a commission with only 2 of 5 seats filled and 3 vacancies. The commission's enforcement posture has shifted. The rule exists but the enforcement apparatus is diminished.