Project 2025 Seeks to Strip HIPAA Privacy Protections for Abortion Patients by Withdrawing 2022 OCR Guidance
Project 2025 calls on HHS's Office for Civil Rights (OCR) to withdraw its June 2022 guidance clarifying that HIPAA limits disclosures of protected health information for investigations or prosecutions related to lawful reproductive health care, including abortion. The proposal rests on a legally erroneous claim that HIPAA's definition of 'individual' includes a fetus in utero, contradicting decades of HHS interpretation and federal case law. As of mid-2025, the guidance remains in effect; this is a future threat to patient privacy and reproductive rights.
This is a direct assault on the privacy of anyone seeking or providing reproductive health care. The June 2022 OCR guidance was a measured, legally grounded response to the Dobbs decision—it told health plans, providers, and their business associates that HIPAA does not permit them to hand over patients' protected health information to law enforcement or state officials for the purpose of investigating or prosecuting lawful abortion care. Project 2025 wants that guidance gone, replaced by a reading of HIPAA that treats a fetus as a separate 'individual' with privacy rights, a position that has no support in the text of the Privacy Rule, HHS's own regulations, or any federal court. If withdrawn, patients could face the chilling reality that their abortion-related medical records are no longer shielded from criminal investigation, and providers could become targets for prosecution based on data they are required by law to keep.
The racial justice stakes are severe. As the Harvard Law Review Foreword on 'Race in the Roberts Court' makes clear, the reversal of Roe v. Wade is 'devastating to black people with the capacity for pregnancy,' and the Court's willingness to accept a 'protectionist' rationale—saving black people from a purported genocide—obscures the real injury. Withdrawing the privacy guidance would compound that injury by making it easier for states to surveil and prosecute Black and brown patients who seek abortions, especially in the South and Midwest where abortion bans are already in effect. This is not a neutral 'pro-life' policy; it is a mechanism for racialized law enforcement of pregnancy outcomes. The Civil Rights Division should be working to ensure equal protection, not standing by while HHS dismantles the privacy safeguards that make reproductive care accessible to those most marginalized by state power.
The alternative is clear: OCR should not only retain the 2022 guidance but strengthen it. That means codifying the limits on disclosure of reproductive health information through formal rulemaking—creating a bright line that no state investigator can cross. It means investing in enforcement of existing HIPAA privacy protections, including investigations into complaints of unlawful disclosures. And it means the DOJ Civil Rights Division should join amicus briefs in any case where the fetal personhood reading of HIPAA is invoked, to defend the settled legal interpretation and the privacy rights of patients. Until the administration takes those steps, pregnant people, particularly those of color, are left to wonder whether their medical records are safe from state prosecutors—and that is no freedom at all.
The humanitarian alternative
Instead of withdrawing the guidance, OCR should strengthen it by issuing a rulemaking that codifies the prohibition on disclosures for reproductive health care investigations, expands protections to patients traveling across state lines, and requires covered entities to implement robust data minimization and consent protocols for any reproductive health information.
Grounded in
- HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care
- Privacy of Health Information Post-Dobbs and OCR Guidance on the Protections Afforded Under HIPAA
- HHS Issues New Guidance on Patient Privacy Following Dobbs Decision
- Privacy of Health Information After Dobbs: OCR Guidance on Disclosures of PHI and the Privacy of Personal Information on Devices
- New HIPAA Regulations in 2026
- Summary of the HIPAA Privacy Rule
Original source — excerpted
project2025 Project 2025 ch. 16: Department of the Interior (pp 530-531)"— 497 — Department of Health and Human Services l OCR should withdraw its Health Insurance Portability and Accountability Act (HIPAA)86 guidance on abortion. OCR should withdraw its June 2022 guidance87 that purports to address patient privacy concerns following the Dobbs decision but is actually a politicized statement in favor of abortion and against Dobbs. HIPAA covers patients in the womb, but this guidance treats them as nonpersons contrary to law. The guidance is unnecessary and contributes to ideologically motivated fearmongering about abortion after Dobbs. AUTHOR’S NOTE: The preparation of this chapter was a collective enterprise of selfless individuals involved in the 2025 Presidential Transition Project. All contributors to this chapter are listed at the front of this volume and include former officials in the U.S. Department of Health and Human Services and other agencies, as well as academics, attorneys, and experts in the health care and insurance fields. — 498 — Mandate for Leadership: The Conservative Promise ENDNOTES 1. U.S. Department of Health and Human Services, Strategic Plan, FY 2018–2022, p. 50, https:/ /aspe.hhs.gov/ sites/default/files/docume…"