On June 18, 2025, U.S. District Judge Matthew Kacsmaryk of the Northern District of Texas vacated[1] most provisions of the Department of Health and Human Services’ (“HHS”) 2024 modifications to the HIPAA Privacy Rule aimed at enhancing protections for “reproductive health information” (the “Rule”) [2]. The case, Purl v. Department of Health and Human Services, was initiated by Texas physician Dr. Carmen Purl and her medical practice, represented by the conservative legal group Alliance Defending Freedom. Dr. Carmen argued the Rule unlawfully interfered with their ability to comply with state-mandated reporting obligations, particularly in cases of suspected child abuse[3]. The ruling has nationwide implications for patients, healthcare providers, and employers.
The Rule sought to strengthen privacy protections for “reproductive health care,” a term broadly defined to include services such as abortion, contraception, and fertility treatments[4]. A key provision of the Rule would have prohibited the use or disclosure of a patient’s protected health information (PHI) for the purpose of a criminal, civil, or administrative investigation or to impose liability on any person for seeking, obtaining, providing, or facilitating lawful reproductive health care[5]. To enforce this, the Rule would have required entities to obtain a signed attestation from those requesting such information, confirming that the request was not for a prohibited purpose[6].
Judge Kacsmaryk’s decision to invalidate the majority of the rule was based on several findings:
- Exceeding Statutory Authority: The court determined that HHS overstepped its authority under HIPAA by imposing additional conditions on PHI disclosures, particularly those that conflicted with state-mandated reporting obligations, such as child abuse reporting laws[7].
- Impermissible Redefinitions: The rule’s redefinitions of terms like “person” and “public health” were found to conflict with existing federal statutes, thereby exceeding HHS’s regulatory authority[8].
- Major Questions Doctrine: Invoking the major questions doctrine, the court held that HHS lacked clear congressional authorization to enact regulations addressing politically significant issues like abortion and gender-affirming care, especially in the wake of the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization[9].
However, the judge’s order did not strike down all aspects of the HHS rule. A provision related to the notice of privacy practices for substance use disorder information under 42 CFR Part 2 remains in effect[10]. This means that health plans and providers must still update their notices of privacy practices to comply with these specific requirements by February 16, 2026[11].
As a result of the ruling, heightened federal privacy protections for reproductive health information are no longer in effect. HIPAA-covered entities like hospitals, doctors’ offices, and certain employers are not bound by the additional restrictions that would have been imposed by the Rule. These entities will need to review and likely revise their policies, procedures, and training materials that were updated to comply with the now-vacated rule. However, covered entities must still adhere to the underlying HIPAA Privacy Rule and any applicable state privacy laws, which may provide their own protections for reproductive health information.
Complicating the nationwide scope of this order is the Supreme Court’s recent decision in Trump v. CASA, Inc. (2025)[12], which limited the ability of federal courts to issue nationwide injunctions. While that ruling creates new questions about broad judicial orders, the decision in Purl may be different. Judge Kacsmaryk’s order did not issue an injunction but rather vacated the rule under the Administrative Procedure Act (“APA”), which gives courts the power to “set aside” unlawful agency actions. The Supreme Court in CASA explicitly stated it was not ruling on the separate question of whether the APA allows for a universal vacatur of a rule[13]. Therefore, an open question remains as to whether this type of nationwide order is proper, leaving the ultimate scope of the Purl decision subject to further legal challenges.
Given the change in administration, it is considered unlikely that HHS will appeal the ruling and defend the rule in its current form. For now, the legal landscape for the privacy of reproductive health information has reverted to the pre-existing framework of HIPAA and varying state laws, with an added layer of uncertainty about the reach of federal court rulings.
[1] Purl v. U.S. Dep’t. of Health & Human Services, No. 2:24-CV-228-Z, ECF No. 110 (N.D. Tex. June 18, 2025), https://litigationtracker.law.georgetown.edu/wp-content/uploads/2024/10/Purl_2025.06.18_MEMORANDUM-OPINION-AND-ORDER.pdf.
[2] HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. 32 (Apr. 26, 2024).
[3] Purl, No. 2:24-CV-228-Z, at 8–9.
[4] U.S. Dept. of Health & Human Services, HIPAA Privacy Rule to Support Reproductive Health Care Privacy: Final Rule Fact Sheet, https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html.
[5] Id.
[6] Id.
[7] Purl, No. 2:24-CV-228-Z, at 20–37.
[8] Id. at 37–46.
[9] Id. at 46–56.
[10] Id. at 62–64.
[11] 89 Fed. Reg. 116.
[12] Trump v. CASA, Inc., No. 24A884, slip op. at ___ (U.S. June 27, 2025), https://www.supremecourt.gov/opinions/24pdf/24a884_8n59.pdf.
[13] Id. at 11 n.10.
