On June 18, 2025, a Texas court issued a ruling that vacated, on a nationwide basis, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “Reproductive Health Rule”), just one year after the rule went into effect.
In Purl v. United States Department of Health and Human Services, No. 2:24-CV-228-Z (N.D. Tex. June 18, 2025), plaintiffs, Dr. Carmen Purl and her medical clinic, challenged the validity of the Department of Health and Human Services (“HHS”) Reproductive Health Rule on the grounds that the rulemaking exceeded HHS’ statutory authority and unlawfully restricted state-mandated reporting obligations, particularly in the context of child abuse investigations. The plaintiffs argued that federal law 42 U.S.C. § 1320d-7(b) provides that “[n]othing in [HIPAA] shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention.” Dr. Purl and her medical clinic argued that the Reproductive Health Rule did just that: it unlawfully impeded Texas’ state-mandated reporting of child abuse and public health investigations—in contravention of 42 U.S.C. § 1320d-7(b)—by interfering with health care providers’ ability to make such reporting if the reporting involved the broadly defined term “reproductive health care”. As the court noted, the Administrative Procedure Act states: courts must “hold unlawful and set aside” agency actions that are “not in accordance with law” or are “in excess of statutory jurisdiction, authority, or limitations, or short of statutory right” (5 U.S.C. § 706(2)(A), (C)). Accordingly, the court held that HHS acted outside of the bounds of its statutorily delegated authority and in contravention of federal law because the Reproductive Health Rule 1) “unlawfully ‘limits’ state public health laws,” 2) “impermissibly redefines ‘person’ and ‘public health,’ in contravention of Federal law and ‘in excess of statutory authority,'” and 3) was adopted without authority expressly delegated by Congress.
The Reproductive Health Rule went into effect on June 25, 2024, with a compliance deadline of December 23, 2024. The Reproductive Health Rule amended the Health Insurance Portability and Accountability Act (“HIPAA”) regulations by adding a class of protected health information (“PHI”) that carried heightened protection, called “reproductive health information”. The Reproductive Health Rule was issued by HHS in reaction to the U.S. Supreme Court case, Dobbs v. Jackson Women’s Health Organization, 597 U.S. 215 (2022), which overturned the federal right to an abortion, returning authority to regulate abortion to the states. Given widespread concerns that state abortion restrictions could interfere with individuals’ willingness to seek reproductive health care, HHS responded to Dobbs by amending HIPAA’s Privacy Rule to limit the circumstances under which “reproductive health information” could be disclosed for certain non-healthcare purposes. Specifically, under the Reproductive Health Rule, HIPAA-regulated entities were not allowed to disclose “reproductive health information” for the following purposes: (i) To conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided; or (ii) The identification of any person for the purpose of conducting such investigation or imposing such liability. HIPAA-regulated entities were required to obtain a written attestation from persons requesting PHI related to reproductive healthcare in situations involving health oversight, judicial or administrative proceedings, law enforcement and disclosures regarding decedents such as disclosures to coroners and medical examiners. Compliance with the Reproductive Health Rule entailed HIPAA-regulated entities adopting new policies and procedures, conducting internal training, and often required education of any third parties who were presented with an attestation in response to their requests for PHI.
With the ruling in Purl, just one year after the Reproductive Health Rule went into effect, HIPAA-regulated entities that implemented new policies and procedures in accordance with the Reproductive Health Rule can now terminate those policies and procedures immediately, with the exception of a future compliance obligation related to a separate topic that was included as part of the Reproductive Health Rule: patient notification about substance use disorder treatment records. Notably, the Reproductive Health Rule also requires that HIPAA-regulated entities amend their Notice of Privacy Practices (“NPP”) by February 16, 2026 to reflect changes in the uses and disclosures of substance use disorder treatment records in light of changes in federal substance use disorder regulations at 42 C.F.R. Part 2 (the “Part 2 NPP Requirement”). The Purl decision severed the Part 2 NPP Requirements from its order vacating the Reproductive Health Rule, and therefore, HIPAA-regulated entities are still required to amend their NPPs pertaining to substance use disorder regulations by February 16, 2026.
