Federal Court Vacates 2024 HIPAA Privacy Protections for Reproductive Health Care Information
On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated most of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (“Reproductive Health Care Rule”), which was enacted by the United States Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) in 2024. The District Court’s decision in Purl v. United States Department of Health and Human Services applies immediately nationwide and eliminates certain privacy protections for reproductive health care information that were contained in the Reproductive Health Care Rule.
This post provides an overview of the District Court’s decision and its impact and identifies key takeaways for covered entities and business associates who are impacted by decision.
Background on Reproductive Health Care Rule
In response to the United States Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, OCR issued a notice of proposed rulemaking on April 17, 2023 to modify the HIPAA Privacy Rule to enhance the privacy of reproductive health care information. OCR issued the final Reproductive Health Care Rule on April 22, 2024. The rule amended existing HIPAA Privacy Rule requirements and strengthened protections for reproductive health care information by prohibiting covered entities and business associates from using or disclosing protected health information (“PHI”) in the following circumstances:
To conduct a criminal, civil, or administrative investigation into, or to impose criminal, civil, or administrative liability on, an individual seeking, obtaining, providing, or facilitating reproductive health care where (i) such care is lawfully provided under the circumstances in the state where it is provided, or (ii) the reproductive health care is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided; or
To identify any individual for the purpose of conducting such investigation or imposing such liability.
To implement these protections, the Reproductive Health Care Rule required that, when information is requested for certain uses, covered entities and business associates must obtain a signed attestation from the requestor that the use or disclosure is not for a prohibited purpose. It also required covered entities to revise their Notice of Privacy Practices (“NPPs”) to include certain additional statements and information relating to the new protections.
Purl Court Decision
In response to the Reproductive Health Care Rule, a Texas physician and her clinic filed a lawsuit against HHS challenging the rule and arguing that it exceeded HHS’s statutory authority and would unlawfully restrict state-mandated reporting of child abuse. The District Court determined that HHS exceeded its statutory authority in issuing the rule and concluded that the rule unlawfully limited the ability of states to enforce their public health laws, including laws requiring reporting of child abuse. The court vacated the majority of the rule pursuant to the Administrative Procedure Act, with the decision taking effect immediately.
The court did not, however, vacate certain provisions of the Reproductive Health Care Rule that amended 45 C.F.R. 164.520 and required covered entities to update their NPPs related to substance use disorder records.
Takeaways for Covered Entities and Business Associates:
Covered entities and business associates will no longer be obligated to comply with the enahnced protections for reproductive health care information under the Reproductive Health Care Rule. HIPAA-regulated entities who already started updating their policies and procedures, revising NPPs and business associate agreements, implementing workforce training, and requiring attestation forms to comply with the rule should consult with legal counsel to determine what changes are needed to remain compliant in light of the Purl decision.
Although the Reproductive Health Care Rule’s specific protections relating to reproductive health information have been vacated, existing HIPAA Privacy Rule and state law requirements continue to extend to such information. Covered entities and business associates should ensure that they are complying with such laws and monitoring evolving state requirements that may provide heightened protections for reproductive health information.
Covered entities should ensure that their workforces receive appropriate training about uses and disclosures of PHI relating to reproductive health care, including how to respond to PHI requests from law enforcement or other individuals and entities, and should ensure that their policies and procedures are up to date on these issues.
Though the Court vacated the majority of the Reproductive Health Care Rule, the NPP updates relating to substance use disorder records remain in effect. Covered entities must be prepared to comply with these requirements by the February 16, 2026 deadline.
If your organization needs help assessing the impact of these changes, London Legal Consulting, LLC is here to assist. Please contact us today.