Federal Court Vacates HIPAA Reproductive Health Privacy Rule Nationally
On June 18, 2025, the U.S. District Court for the Northern District of Texas struck down most of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (“Reproductive Health Rule” or “Rule”). The ruling applies nationwide, effectively eliminating enhanced federal privacy protections for reproductive health information. However, healthcare providers and certain regulated individuals and entities must still comply with applicable state privacy laws regarding reproductive health information – where such laws exist – which may provide similar or greater protections than those under the now-vacated Reproductive Health Rule.
Background
Following the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, which overturned the federal right to an abortion, the Office for Civil Rights (“OCR”) within the Department of Health and Human Services (“HHS”) implemented the Reproductive Health Rule to safeguard against certain types of uses or disclosures of reproductive health information The Rule went into effect on June 24, 2024, with most compliance requirements taking effect on December 23, 2024.
Among other requirements, the Reproductive Health Rule prohibited covered entities and business associates from using or disclosing protected health information (“PHI”) for the following purposes:
- To conduct any criminal, civil, or administrative investigation or proceeding against an individual related to reproductive health care that is lawful under the circumstances.
- To identify a person for the purpose of initiating such an investigation or proceeding.
The Rule further required regulated entities to obtain attestations prior to certain uses or disclosures of PHI related to reproductive health care, implement new policies, document disclosures and attestations, and make certain updates to their Notice of Privacy Practices. A more in-depth discussion of the requirements of the Reproductive Health Rule can be found here.
The Challenge and Court’s Reasoning
The plaintiff (Dr. Carmen Purl and her medical clinic) in Purl v. United States Department of Health and Human Services challenged the Reproductive Health Rule arguing that it exceeds HHS’s statutory authority under HIPAA and unlawfully restricts state-mandated reporting obligations.
The Purl court agreed, and vacated the Reproductive Health Rule on the grounds that it (1) unlawfully impeded compliance with state-mandated reporting of child abuse and public health investigations, (2) impermissibly redefined “person” and “public health,” in contravention of Federal law and “in excess of statutory authority,” and (3) exceeded HHS’s authority by adoption without receiving express authority delegated by Congress.
In vacating the Rule, the court left intact the amendments requiring covered entities update their Notices of Privacy Practices related to substance use disorder records by February 16, 2026.
Given that it is unlikely the Trump Administration will appeal the decision, HIPAA-regulated entities are no longer bound by the enhanced federal privacy protections specific to reproductive health information established under the Rule, including requirements to implement new policies, trainings, attestations, BAA amendments, etc. However, healthcare providers must still continue to comply with the HIPAA Privacy Rule for PHI generally, in addition to heeding state privacy and consumer protection laws that may impose heightened requirements around safeguarding reproductive health information.
State Law Protections
In the wake of the Dobbs opinion, many states have sought to fill the gap in privacy protections for sensitive health information. Such laws are not preempted by HIPAA, because they afford greater privacy protection to individuals.
For example, in California, recent amendments to the Confidentiality of Medical Information Act prevent health care providers, health plans, contractors, and employers from releasing abortion-related medical information to law enforcement agents or pursuant to a subpoena or request if the purpose of the disclosure is tied to out-of-state laws or foreign legal actions that conflict with California’s Reproductive Privacy Act. Cal. Civ. Code §§56.108-56.109. Likewise, Maryland prohibits health information exchanges or electronic health networks from disclosing Mifepristone data or the diagnosis, procedure, medication or related codes for abortion care and other sensitive health services without written patient consent. MD Code, Health – General, § 4-302.5.
The Purl decision adds to the ongoing tension between federal and state authorities over reproductive health policy in the post-Dobbs environment. The vacating of the Rule removes a significant federal privacy protection that attempted to shield both patients and providers from certain types of investigations related to lawful reproductive health care. Health care providers must now navigate an increasingly complex environment where federal and state requirements may diverge significantly, particularly regarding reproductive health information.
As courts continue to assess various health care regulations and as state legislatures consider their own approaches to reproductive health privacy, health care organizations should maintain close attention to both judicial developments and legislative changes that may impact their compliance obligations.
Professional
HLB’s Digital Health Practice will continue monitoring any developments or changes to HIPAA or state law enforcement and compliance relating to reproductive health information. For more information, please contact any member of the Digital Health practice, including Andrea Frey, Stephen Phillips, Alicia Macklin, or Sunaya Padmanabhan.
