As noted in our prior blog post, on April 26, 2024, the U.S. Department of Health and Human Services (HHS) issued a Final Rule updating certain Health Insurance Portability and Accountability Act (HIPAA) privacy rules with respect to the disclosure of protected health information (PHI) related to reproductive health care (the 2024 Rule). The 2024 Rule was aimed at prohibiting covered entities from using or disclosing PHI to conduct criminal, civil or administrative investigations, or to impose corresponding liability on a person seeking or providing lawful reproductive health care. HHS issued the 2024 Rule in response to the chilling effect the Dobbs v. Jackson Women’s Health Organization1 decision striking down Roe v. Wade was expected to have on women seeking reproductive health care advice and procedures in certain states.
However, on June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the 2024 Rule in Purl v. United Department of Health and Human Services2. The crux of the decision revolved around whether HHS exercised “powers reserved to another branch of government”3 when it established and sought to enforce the 2024 Rule regarding HIPAA protections for PHI related to reproductive health care. Specifically, this case examined the conflict between a federal agency’s protection of reproductive health care information and a “state-mandated obligation to report ‘child abuse’ or participate in public health investigations.”4 The district court in Texas sided with the plaintiff doctor/clinic and decided that HHS had in fact acted outside the bounds of its statutory authority and unlawfully limited the state’s own public health laws with the 2024 Rule.
It remains to be seen whether HHS will appeal this decision. However, because the 2024 Rule has been vacated for now, you can remove any language relating to the Reproductive Health Care Privacy Rule that may have been added to your HIPAA privacy policies. You also do not need to require or solicit attestations regarding reproductive health care PHI, which the 2024 Rule had previously required.
It is worth noting that the district court did not vacate the section of the 2024 Rule requiring updates to the Notices of Privacy Practices for substance use disorder (SUD) records by February 16, 2026, so you should still update your HIPAA Privacy Notice to include those provisions as applicable. A member of the Faegre Drinker benefits team can assist you with these updates and with monitoring relevant changes to HIPAA’s privacy rules.
Footnotes
- 597 U.S. 215, 142 S.Ct. 2228, 213 L.Ed.2d 545 (2022).
- Purl v. United States Department of Health and Human Services, No. 2:24-CV-228-Z, 2025 WL 17081137 (N.D. Tex. June 18, 2025).
- Loper Bright Enters. v. Raimondo, 603 U.S. 369, 416, 144 S.Ct. 2244, 219 L.Ed.2d 832 (2024).
- Purl, p.4.
The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.