On June 18, 2025, the U.S. District Court for the Northern District of Texas issued an opinion that vacates the 2024 final rule that enhanced privacy protections for protected health information (PHI) related to reproductive health care (2024 Final Rule). The effect of the District Court’s order is to remove the heightened restrictions on the use and disclosure of PHI imposed by the 2024 Final Rule, including the obligation for covered entities and business associates to obtain an attestation before disclosing PHI potentially related to reproductive health care in response to law enforcement requests, subpoenas, court orders, and regulatory agency oversight requests.
The opinion vacates the 2024 Final Rule almost in its entirety, leaving only provisions relating to covered entities’ Notice of Privacy Practices (NPP) in place.
Implications for Covered Entities and Business Associates
Unless the order is overturned:
- Covered entities and business associates no longer must obtain attestations before disclosing PHI potentially related to reproductive health care. The 2024 Final Rule had restricted disclosures otherwise permitted under the law enforcement exception, the exception for judicial and administrative proceedings, the health care oversight exception and the coroners/medical examiners exception, such that PHI potentially relating to reproductive health care could only be disclosed in response to such requests if the covered entity or business associate first obtained from the requesting entity an attestation that the PHI was not to be used for a prohibited purpose. The 2024 Final Rule prohibited using or disclosing PHI to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care or to identify any person for the purpose of conducting such an investigation.
- Covered entities are still required to update their NPPs by February 16, 2026. However, they are no longer required to include wording related to restricting uses and disclosures of reproductive health care as provided in the 2024 Final Rule. The requirement to update NPPs to address substance use disorder information continues to apply.
- Covered entities and business associates may need to revise policies that had been amended, as well as potentially remove new policies implemented, to comply with the 2024 Final Rule. The 2024 Final Rule impacted definitions of certain terms (such as public health or who is recognized as a personal representative), along with the attestation requirement.
Background
The opinion was issued in connection with a case challenging the 2024 Final Rule on the basis that it unlawfully limited mandatory child abuse reporting and exceeded the United States Department of Health and Human Services’ statutory authority. Purl, M.D. et al, v. United States Department of Health and Human Services et al., 2:24-cv-00228-Z (N.D. Tex.).
Effective immediately, this opinion streamlines HIPAA compliance obligations for covered entities and business associates.
