Grace Buczak

Associate Editor 

Loyola University Chicago School of Law, JD 2027

In the constantly evolving field of reproductive healthcare, compliance with regulatory standards is both challenging and vital. As legal frameworks shift and new technologies emerge, healthcare providers, law students, practitioners, and compliance professionals must stay informed to ensure adherence to the law. Several key compliance issues in reproductive healthcare, including privacy concerns raised by biometric technology as it is tied to employers, offer insights into the challenges and strategies for maintaining regulatory compliance.

Key compliance challenges in reproductive healthcare include the conflict between federal frameworks like HIPAA and the ACA and sharply divergent state laws after Dobbs, the unsettled landscape of privacy protections shaped by litigation and expanding biometric technologies, and the broader effects of these developments on marginalized communities, provider practices, and future policy. Together, these issues highlight both the complexity of compliance and the likelihood that reproductive healthcare will remain a central legal and ethical battleground.

Understanding state and regulatory frameworks

Reproductive healthcare is governed by a complex web of federal and state regulations. At the federal level, the Health Insurance Portability and Accountability Act (HIPAA) sets standards for protecting patient privacy and ensuring the confidentiality of health information. Compliance with HIPAA is crucial for healthcare providers, as violations can result in significant penalties he Affordable Care Act (ACA) further mandates coverage for certain reproductive health services, including contraception and preventive care. Providers must navigate these requirements to ensure that their services are both covered and accessible to patients.

State laws complicate the compliance landscape as each state has its own set of rules governing reproductive healthcare. These laws vary significantly from state to state, especially in today’s divisive political climate. Some states have enacted laws that restrict access to certain reproductive services, while others have expanded and enshrined abortion access in their constitutions. For example, Texas law imposes a near-total abortion ban with limited medical exceptions, no allowances for rape or incest, a six-week “heartbeat” restriction, and severe penalties for providers. On the other hand, in November 2022, Michigan voters approved Proposal 3, a constitutional amendment that establishes a right to “reproductive freedom” in the state constitution.

In June 2022, the U.S. Supreme Court overturned Roe v. Wade, opening the door for states to ban abortion outright. Abortion is currently illegal in 13 states. Various resources, such as the Center for Reproductive Rights’ “After Roe Fell” tracker, have emerged to simplify the patchwork of rights, assigning states into categories ranging from “Expanded Access” to “Illegal.” Compliance professionals must be vigilant in understanding and applying state-specific regulations to avoid legal consequences.

In Carmen Purl v. U.S. Department of Health and Human Services (N.D. Tex. June 18, 2025), a federal court vacated major portions of the HIPAA Privacy Rule amendments designed to strengthen reproductive health privacy, though other notice requirements remain in effect and must be implemented by 2026. The Privacy Rule permits certain disclosures of protected health information (“PHI”) without an individual’s authorization. These disclosures may occur for purposes not related to health care, such as providing information to law enforcement officials. The rule is designed to protect individual privacy and maintain access to health services. Importantly, HIPAA does not permit disclosures to law enforcement based solely on a provider’s suspicions of abortion or miscarriage-related care unless state law explicitly compels reporting. Professional organizations such as the American College of Obstetricians and Gynecologists and the American Medical Association caution that such disclosures would not only undermine patient trust, but also conflict with medical ethics and risk deterring patients from seeking needed care.

The data privacy dimension: HIPAA to biometric compliance

In August of 2025, the popular wearable fitness tracker Oura, announced its partnership with the United States Department of Defense. Oura claims they will support defense operations by enhancing stress management, fitness optimization, fatigue risk management, and early illness detection. Some users mistakenly believed Oura was sharing personal health data with the military, while others, less concerned with privacy, questioned supporting a company that partners with the Department of Defense. The larger compliance issue raised is how Oura will separately manage data of public consumers and government users.

While this contract concerns military health and performance monitoring, it highlights broader concerns about who controls sensitive biometric and reproductive health data and how it is regulated. Under Illinois’ Biometric Information Privacy Act (BIPA), companies collecting biometric data must obtain informed consent or face strict liability for misuse, with private rights of action leading to major litigation. In Rosenbach v. Six Flags the Illinois Supreme Court held that an individual is “aggrieved” under the statute and may bring suit without demonstrating any actual injury. The decision established that companies can face liability for purely technical violations, such as failing to obtain written consent or neglecting to publish a retention policy, even in the absence of identity theft or other tangible harm. This ruling sparked a wave of litigation, with more than 1,500 BIPA lawsuits filed in Illinois state and federal courts since the decision, solidifying BIPA as a powerful instrument for litigation.

California’s CCPA/CPRA (California Consumer Privacy Act and California Privacy Rights Act) similarly empowers consumers to know and control how their personal data is used. Reproductive healthcare sits at the intersection of these privacy frameworks. Consider menstrual-tracking apps or biometric devices that could reveal pregnancy status, ovulation cycles, or post-procedure recovery. In states hostile to abortion access, such data could theoretically be misused, putting patients and providers at risk.

The lack of a unified federal privacy law leaves providers and compliance officers struggling to balance HIPAA with a patchwork of state and international rules. Electronic health records (EHRs) improve information management and HIPAA compliance. However, emerging tools like wearable fitness trackers, reproductive health apps, and biometric monitoring devices raise new questions, regarding the owners of the data, the applicability of certain laws, and the protection of providers. The Oura example shows how quickly biometric data collection is expanding into sensitive contexts.

A comprehensive understanding of reproductive health regulations is critical because these regulations fundamentally determine the accessibility, quality, and equity of care. Legal frameworks govern where and when individuals can obtain reproductive services, the conditions under which providers can practice, and the protections afforded to patients’ privacy and autonomy. Consequently, regulatory bodies can directly influence not only individual health outcomes but also broader public health metrics, like maternal morbidity and mortality, rates of unintended pregnancy, and disparities in care.

It is equally important to recognize that reproductive regulations do not operate uniformly across populations. Restrictions on access disproportionately burden marginalized communities, including individuals of lower socioeconomic status, racial and ethnic minorities, and those living in rural areas.