HIPAA Reproductive Health Rule Vacated Nationally

Newsletter

A federal judge in Texas has vacated almost all of the 2024 HIPAA Rule to Support Reproductive Health Care Privacy that created special protections for reproductive health care information, finding that the U.S. Department of Health and Human Services (“HHS”) exceeded its statutory authority. The decision vacates the Reproductive Health Rule nationwide, effective immediately. What does the ruling in Purl v. United States Department of Health and Human Services mean for your company’s handling of reproductive health data? Read on for more details.

The 2024 HIPAA Reproductive Health Rule – A Refresher

As a reminder, in April 2024, HHS issued a Final Rule amending the HIPAA Privacy Rule in a few significant ways:

  • Defining “reproductive health care” broadly to include services like gender affirming care, abortion, IVF, STD screenings, maternity care, contraception, vasectomies, and mammograms.
  • Prohibiting HIPAA covered entities from using or disclosing reproductive health care information if such information would be used for a prohibited purpose, including investigating provision or receipt of lawful reproductive health care.
  • Requiring HIPAA covered entities to obtain attestations prior to disclosing reproductive health data, whereby a records requestor must attest that the requested information would not be used or disclosed for a prohibited purpose.

Providers subject to HIPAA still had the ability to make disclosures of PHI for other law enforcement purposes under the Privacy Rule, but not if the disclosures related to investigating or imposing liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.

The 2025 Purl Decision

In late 2024, Dr. Carmen Purl and her clinic sued HHS challenging the Reproductive Health Rule on the grounds that it unlawfully limited the provider’s limited mandatory child abuse reporting obligations, impermissibly redefined key statutory terms, and exceeded HHS’s regulatory authority in issuing special rules for reproductive health care information. The plaintiffs successfully sought injunctive relief (limited only to Dr. Purl). Under the Biden administration’s leadership, HHS filed a motion for summary judgment. With the change of administration, the case moved forward despite HHS’s position on the merits shift under the Trump administration’s leadership.

On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the 2024 HIPAA Reproductive Health Rule (leaving intact only amendments related to certain notice of privacy practices updates related to substance use disorder regulations). Significant takeaways of the decision include:

  • As a threshold matter, the court found that the Plaintiffs have standing. Any covered entity would have standing based on the increased regulatory burden of the Reproductive Health Rule compliance costs, and the court noted that even small financial burdens can establish an injury sufficient to confer standing.
  • HHS cannot redefine statutory terms (e.g., “person” and “public health”) to preempt state law or restrict state reporting obligations.
  • The court applied the major-questions doctrine, finding that HHS’s statutory authority to promulgate privacy regulations does not extend to addressing “politically favored medical procedures.”
  • The court found HIPAA “confers authority to promulgate regulations protecting ‘individually identifiable health information,’ but confers no authority to distinguish between types of health information.” Absent a clear congressional authorization (not simply a plausible textual basis) for distinguishing between types of protected health information, HHS acted outside the bounds of its statutory authority.
Now What?

Entities now return to the compliance obligations in place pre-2024 Reproductive Health Rule but post-Dobbs. Entities should consider compliance program updates in light of this shifting context:

  • Update policies and procedures to reflect the current regulatory landscape, including removing the additional HIPAA analysis from the 2024 Rule and confirming processes comply with evolving state requirements. A HIPAA preemption analysis will be key in many states.
  • Revise workforce training materials – particularly role-based training for HIM, ROI, and legal departments – to account for new procedures.
  • Update business associate agreements and other contracts as necessary to address changes in HIPAA but remaining state law.
  • The 2024 Rule required covered entities to revise notices of privacy practices as of February 16, 2026 to address both (1) substance use disorder regulations and (2) the Reproductive Health Rule. Covered entities that have already made updates will need to update their NPPs again. The NPP requirements related to Part 2 regulations remain unchanged, and February 2026 updates are still required.

While entities make updates to their compliance programs, they must consider the full regulatory landscape, including:

  • With the Purl order, enforcement of the HIPAA Reproductive Health Rule’s extra protections for reproductive health data is halted nationwide; note, though, that the HIPAA Privacy Rule is still in effect, and entities subject to HIPAA must comply with its requirements regarding use and disclosure of PHI when assessing law enforcement requests. HIPAA still includes requirements for protected health information regarding reproductive health care. As we noted in a prior client alert, HHS has entered into a settlement agreement related to impermissible disclosure of reproductive health care information in violation of the HIPAA Privacy Rule prior to the effective date of the Reproductive Health Rule.
  • Stakeholders are watching for additional consequences of the ruling, including implications of the court applying the major-questions doctrine to prohibit regulations related to “politically favored medical procedures.”
  • Stakeholders are also watching for potential state legislative activity, including amendments to state law exemptions that currently exempt protected health information regulated under HIPAA from compliance obligations under state consumer health privacy laws (e.g., Washington, Nevada, and Connecticut) and reproductive health privacy laws (e.g., Virginia).

We will also watch over the next 60 days whether the Trump administration decides to appeal this decision (which could be plausible based on how the Trump HHS has been handling other cases challenging the Reproductive Health Rule). In addition, the state of Texas has filed a lawsuit attempting to overturn the entirety of the HIPAA Privacy Rule that will likely be impacted in some way by this ruling.

If you have any questions regarding application of the Purl ruling to your compliance obligations or handling of reproductive health care information, please contact your Quarles privacy attorney or:

Please visit our Federal Policy Watch: Monitoring White House Developments page for more insight about navigating changes at the federal level.

Follow Quarles

Subscribe Media Contact
Back to Main Content

We use cookies to provide you with the best user experience on our website and to analyze statistics related to our website. To understand more about how we use cookies, or for instructions to change your preference and browser settings, please see our Privacy Notice. Please note that if you choose to reject cookies, doing so may impair some of our website's functionality.