HIPAA's Reproductive Health Rule Is Vacated Nationally

The U.S. District Court for the Northern District of Texas on June 18, 2025, issued an order vacating the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 Fed. Reg. 32976), published on April 26, 2024, which amended the Health Insurance Accountability and Portability Act of 1996 (HIPAA) Privacy Rule (Reproductive Health Rule or Rule). Purl v. United States Department of Health and Human Services, No. 2:24-CV-228-Z, (N.D. Tex. June 18, 2025). The Texas decision left intact amendments to the HIPAA rule regarding certain Notice of Privacy Practice provisions pertaining to substance use disorder regulations.

The U.S. Supreme Court's decision in Dobbs v. Jackson Women's Health Organization, 597 U.S. 215 (2022), returning authority to regulate abortion to the states, prompted nationwide state and federal legislative and regulatory responses. Among the responses was the U.S. Department of Health and Human Services (HHS) Reproductive Health Rule, effective June 25, 2024. HHS responded by amending the Privacy Rule to address concerns that state-level abortion restrictions could "chill" individuals' willingness to seek reproductive healthcare and that protected health information (PHI) could be used in state enforcement actions. A little less than one year from its effective date, the Reproductive Health Rule has been vacated nationwide.

Background

The Reproductive Health Rule was designed to strengthen privacy protections for a subset of PHI broadly defined as related to "reproductive health care" and limit the circumstances under which such information could be disclosed for certain non-healthcare purposes by prohibiting the use or disclosure of PHI for the purpose of conducting criminal, civil or administrative investigations or imposing liability on any person for the mere act of seeking, obtaining, providing or facilitating reproductive healthcare or for identifying any person for such purposes. Under the Reproductive Health Rule, HIPAA-regulated entities must presume that reproductive healthcare was lawful unless they have actual knowledge or a substantial factual basis to believe otherwise. These entities were required to obtain a written attestation from persons requesting PHI related to reproductive healthcare in situations involving health oversight, judicial or administrative proceedings, law enforcement and disclosures regarding decedents such as disclosures to coroners and medical examiners. Since the Reproductive Health Rule effective date, some HIPAA-regulated entities have been struggling with the compliance burden associated with implementation of the rule changes.

In the recently decided Texas case, the plaintiffs, Dr. Carmen Purl and her medical clinic, initiated the action in the Northern District of Texas seeking to set aside the 2024 Reproductive Health Rule on the grounds that it exceeds HHS' statutory authority and unlawfully restricts state-mandated reporting obligations, particularly in the context of child abuse investigations. The plaintiffs successfully sought injunctive relief in November 2024 to remove regulatory impediments to the state-mandated reporting related to child abuse investigations. The injunctive relief was limited to Dr. Purl. The court ordered additional briefing to support the plaintiffs' demand for permanent relief through vacating the rule.

The court's authority to vacate the Reproductive Health Rule arises under the Administrative Procedure Act (APA), which provides the primary framework for judicial review of federal agency action. Under the APA, courts must "hold unlawful and set aside" agency actions that are "not in accordance with law" or are "in excess of statutory jurisdiction, authority, or limitations, or short of statutory right" (5 U.S.C. § 706(2)(A), (C)). Referring to the Supreme Court precedent in Loper Bright Enterprises v. Raimondo, 603 U.S. 369, 416 (2024) (Thomas, J., concurring), the court interpreted HIPAA's statutory provisions and determined that HHS acted outside of the bounds of its statutorily delegated authority and in contravention of federal law. Specifically, the court determined that the Reproductive Health Rule 1) "unlawfully 'limits' state public health laws," 2) "impermissibly redefines 'person' and 'public health,' in contravention of Federal law and 'in excess of statutory authority,'" and 3) was adopted without authority expressly delegated by Congress.

HIPAA includes relevant statutory provisions with explicit instructions regarding the relationship between federal privacy regulations and state public health laws. Notably, 42 U.S.C. § 1320d-7(b) provides that "[n]othing in [HIPAA] shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, death, public health surveillance, or public health investigation or intervention." This provision is interpreted broadly to ensure state public health activities remain unimpeded by federal privacy regulations. The plaintiffs' primary complaint, with which the court agreed, was that the Reproductive Health Rule did just that – unlawfully impeded on Texas state-mandated reporting of child abuse and public health investigations – in contravention of 42 U.S.C. § 1320d-7(b).

The court considered alternatives to vacating the Rule but quickly leaned on precedent in the U.S. Court of Appeals for the Fifth Circuit empowering courts to vacate unlawful agency action as the "default" remedy and emphasizing that vacatur "has nationwide effect, is not party-restricted, and affects persons in all judicial districts equally" (p. 58 - 59 of the Opinion). The court acknowledged that the universality of vacatur may be an issue for Supreme Court resolution.

In vacating the Reproductive Health Rule, the court allowed to remain in place the section of that rule amending 45 C.F.R. 164.520 requirements to update Notices of Privacy Practices related to substance use disorder records by Feb. 16, 2026.

Conclusion

HIPAA-regulated entities are released from compliance obligations related to implementation of the Reproductive Health Rule through policies, training, amendments to business associate agreements and implementation of attestation forms and processes, and are no longer subject to enforcement by HHS for violations of the Rule. Though the heightened protections for reproductive health information under HIPAA's Reproductive Health Rule have been eliminated, healthcare providers and others must continue to comply with HIPAA's Privacy Rule with regard to the privacy of PHI and heed state laws that may provide enhanced privacy for this specific category of health information. In the absence of the Reproductive Health Rule, additional state action may be seen to fill the gap in privacy protections.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.