In June of 2024, the Department of Health and Human Services (HHS) issued rules amending the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in the wake of the 2022 Supreme Court decision in Dobbs v. Jackson Women’s Health Organization (the “2024 Privacy Rule”). These rules were designed to support President Biden’s Executive Orders on protecting access to reproductive health care—in particular, by protecting information related to reproductive health care and bolstering patient-provider confidentiality. On June 18, 2025, the U.S. District Court for the Northern District of Texas issued an order vacating a majority of the 2024 Privacy Rule. HIPAA “Covered Entities” (e.g., health care providers and group health plans) and their business associates will need to evaluate the impact of this ruling on their HIPAA compliance obligations. What Did the 2024 Privacy Rule Require of Covered Entities? HHS explained that the 2024 Privacy Rule was necessary to “protect

On May 15, 2025, the Departments of Labor, Health and Human Services, and the Treasury (collectively, the “Departments”) announced a pause in enforcement of the final rule (the “2024 Final Rule”) to the Mental Health Parity and Addiction Equity Act (“MHPAEA”). The 2024 Final Rule was issued in September 2024, and imposed significant new compliance requirements on plan sponsors. The Departments also announced that they would be undertaking a broad reexamination of each Departments’ enforcement approach under MHPAEA. This pause was not unexpected,  as it had been telegraphed a week earlier in a filing by the federal government in a lawsuit challenging the 2024 Final Rule. Below is an overview of this enforcement pause and what it means for plan sponsors. 2024 Final Rule  The 2024 Final Rule amended prior MHPAEA regulations issued in 2013 (the “2013 Final Rule”) and added new rules implementing the nonquantitative treatment limitation (“NQTL”) comparative

In a decision with far-reaching implications, the U.S. District Court for the Northern District of Texas, issued a decision in Faulk Company, Inc. v. Xavier Becerra et al., invalidating an assessment against Faulk Company for failure to provide its employees with health coverage.​ This assessment, called an Employer Shared Responsibility Payment (“ESRP”), is an excise tax that is assessed against employers of a certain size who fail to offer their full-time employees health coverage that meets applicable requirements of the Affordable Care Act (“ACA”). More importantly, the Court also invalidated the regulations by which the Internal Revenue Service (“IRS”) assesses the ESRP. If not overturned by an appellate court, this decision could arguably result in the invalidation of all ESRPs previously assessed by the IRS. The Court’s decision relies on an interpretation of the interaction between two provisions of the ACA, each under the jurisdiction of a different agency: (i) Section