On June 18, 2025, the U.S. District Court for the Northern District of Texas in Purl v. United States Department of Health and Human Services, vacated most of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (“Reproductive Health Care Rule”) published in April 2024. The District Court’s order vacating the majority of the Reproductive Health Care Rule aligns with the District Court’s preliminary injunction that was issued in the case in December 2024, preventing the Department of Health and Human Services (HHS) from enforcing the rule against the plaintiffs pending the resolution of litigation. The District Court’s order vacating the majority of the Reproductive Health Care Rule applies nationwide with immediate effect.

As background, the Reproductive Health Care Rule adopted a “purpose-based prohibition” on the disclosure and use of reproductive healthcare-related information of individuals under HIPAA, amending existing HIPAA privacy rules. The Reproductive Health Care Rule prohibited a health plan (or other covered entity) and its business associates from using or disclosing protected health information (PHI) of a covered individual for the following purposes:

1. When conducting a criminal, civil or administrative investigation into, or to impose criminal, civil or administrative liability on, any individual that seeks, obtains, provides or facilitates reproductive healthcare, so long as such healthcare is lawful under the circumstances for which such services are provided, in the jurisdiction where reproductive health services are received (i.e., subject to applicable local, state and federal rules) and/or the reproductive health care is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided.
2. When identifying any individual for the purpose of investigating or imposing liability on any covered entity concerning the above-listed matters in bullet point 1.

The District Court determined that HHS exceeded its statutory authority when issuing the Reproductive Health Care Rule, focusing on the Loper Bright decision. The Court found that HHS promulgated a regulation that exceeded the statutory authority granted to HHS under the Health Insurance Portability and Accountability Act (“HIPAA”).

The District Court determined that the rule unlawfully limits state public health laws, including a Texas law requiring reporting of child abuse and disclosures for public health investigations. Further, the Court found that the “2024 Rule impermissibly redefines ‘person’ and ‘public health,’ in contravention of Federal law and ‘in excess of statutory authority’.”

A separate section of the Reproductive Health Care Rule relates to modifications to HIPAA Notices of Privacy Practices (NPPs) related to substance use disorder (SUD) patient records. In February 2024, HHS issued a separate rule, the 2024 Confidentiality of Substance Use Disorder (SUD) Patient Records Final Rule, that included changes to the HIPAA NPP requirements for substance use disorder patient records. However, HHS did not finalize those changes until the April 2024 Reproductive Health Care Rule, where HHS indicated they were aligning the compliance dates for the changes to the NPP for both rules “so that covered entities regulated under both rules can implement all changes to their NPPs at the same time. Covered entities are expected to be in compliance with the modifications to 45 CFR 164.520 on February 16, 2026.” The parties and the District Court agreed that the SUD changes to the NPP requirements were separate issues from the reproductive health issues; therefore, the NPP requirement related to SUD records was not vacated by the Court and the deadline to amend NPPs to address SUD records remains as February 16, 2026.

Takeaways for covered entities and plan sponsors

• Covered entities and related business associates will no longer be subject to the requirements of the Reproductive Health Care Rule, including requirements to update policies and procedures, NPPs, and training, to potentially amend business associate agreements, and to use attestation forms related to reproductive health care.
• Covered entities such as group health plans remain subject to the remaining HIPAA Privacy Rules and other applicable state laws and local rules that may provide additional privacy protections for reproductive health care information and PHI. Covered entities (e.g., group health plans) should consult with their legal counsel to determine the impact of this decision on their privacy obligations.
• Covered entities and related business associates who modified their HIPAA policies and procedures and HIPAA Notice of Privacy Practices, and have been requiring attestations before disclosing reproductive health PHI to comply with the Reproductive Health Care Rule should review their policies and procedures and consult with legal counsel to determine whether changes are necessary to remain compliant following the District Court’s decision.
• While the Court vacated the majority of the Reproductive Health Care Rule, the February 16, 2026 deadline for HIPAA covered entities to update their Notices of Privacy Practices to include information related to the protection of substance use disorder records remains in effect.

Regulatory and Legislative Strategy Group