Trump Administration Rescinds HHS Guidance on Privacy of Gender Affirming Care Data
On February 20, 2025, the U.S. Department of Health and Human Services (“HHS”) took action pursuant to President Trump’s Executive Order 14187 (“EO 14187”), which is aimed at ending gender affirming care for minors. EO 14187 directed HHS to withdraw Biden-era guidance related to gender affirming care and patient privacy. We discuss the impact EO 14187 and corresponding HHS action may have on Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and patient privacy below.
2022 Notice and Guidance - Background
As a refresher, in March 2022, during the Biden Administration, HHS released guidance titled “HHS Notice and Guidance on Gender Affirming Care, Civil Rights, and Patient Privacy”, which stated that medically appropriate and necessary gender affirming care improved mental and physical health outcomes for minors (the “March 2022 guidance”). The guidance indicated that the HHS Office for Civil Rights (“HHS OCR”) would ensure minors could access such care without discrimination, by investigating and enforcing Section 1557 of the Affordable Care Act, which prohibits discrimination on the basis of sexual orientation and gender identity in health programs or activities that receive funding from HHS.
In furtherance of these efforts, the March 2022 guidance reminded entities and individuals that HIPAA limits the ability for regulated entities to disclose PHI relating to gender affirming physical or mental health care. The March 2022 guidance made clear that HIPAA prohibits the disclosure of protected health information (“PHI”) related to gender affirming care without a patient-signed authorization except in limited circumstances, and that HIPAA permits – but does not require – a HIPAA-regulated entity to disclose PHI, including PHI related to gender affirming care, without an authorization when required by another law.
2025 Executive Order and HHS Action
As a result of EO 14187, HHS formally withdrew the March 2022 guidance, stating that HHS would not promote, assist, or support gender affirming care. The February 20, 2025 notice of recission specifically cites the March 2022 guidance’s interpretation of HIPAA’s application to gender affirming care-related data, seemingly signaling that the Biden HHS’s interpretation that HIPAA’s protections applied to data related to gender affirming care no longer dictate the agency’s actions.
What this Means for Industry
While the March 2022 guidance has been rescinded and pulled down from government websites, it remains to be seen how HHS and OCR will handle any complaints related to uses and disclosures of PHI that relates to gender affirming care. Entities that may handle this type of data may consider reviewing their internal policies and procedures related to requests for sensitive information.
However, any changes to policies and procedures related to PHI related to gender affirming care should be assessed carefully. Given the broad definition of “reproductive health care” in HIPAA (added by the HIPAA Privacy Rule to Support Reproductive Health Care Privacy Final Rule, published in April 2024), gender affirming care often falls within the definition of “reproductive health care”. The HHS response to EO 14187 seems to indicate that HHS will be unlikely to defend the 2024 HIPAA reproductive privacy rule. But, any gender affirming care data that fits within this definition is currently subject to the prohibitions on disclosure pursuant to the 2024 HIPAA reproductive privacy rule (despite ongoing litigation). This may lessen, for now, required procedural changes specific to general affirming care data that constitutes reproductive health care data.
Quarles will continue to monitor any enforcement, investigation, and ligation related to this new guidance. You can stay abreast of new developments with our Health Privacy and Security email list.
If you have questions about EO 14187or rescinded HHS guidance, handling gender affirming care or reproductive health data, or other questions regarding data privacy and security, please contact your Quarles privacy attorney or:
- Meghan O'Connor: (414) 277-5423 / meghan.oconnor@quarles.com
- Simone Colgan Dunlap: (602) 229-5510 / simone.colgandunlap@quarles.com
- Kaitlyn Fydenkevez: (202) 780-2642 / kaitlyn.fydenkevez@quarles.com