Introduction
Last year, the federal Office for Civil Rights (OCR) modified the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to strengthen protections for reproductive health care information (the “2024 Rule”). OCR issued the 2024 Rule in response to the 2022 U.S. Supreme Court decision in Dobbs v. Jackson Women’s Health Organization, which held that the U.S. Constitution does not confer a right to abortion, returning the power to regulate abortion to the states. The 2024 Rule significantly altered how HIPAA covered entities — such as health care providers, fully-insured health plans and self-funded health plans — handle protected health information (PHI) that includes information about reproductive health care. To comply with the 2024 Rule, covered entities were required to undertake substantial implementation efforts, including updating their HIPAA privacy policies and procedures, conducting comprehensive staff training on the new reproductive health care disclosure restrictions, implementing new attestation requirements for certain PHI requests, and revising their Notice of Privacy Practices to reflect the enhanced protections.
However, on June 18, a federal district court in Texas vacated the 2024 Rule in large part, resulting in a nationwide effect. In Purl v. U.S. Department of Health and Human Services, the court found the 2024 Rule unlawfully restricted state authority and exceeded statutory authority of the Department of Health and Human Services (HHS) under the Administrative Procedure Act. Covered entities must now reassess any steps taken to comply with the 2024 Rule.
Summary of the Court’s Ruling in Purl v. HHS
In Purl v. U.S. Department of Health and Human Services, the court ruled that the 2024 Rule:
- Interferes with State Authority: The 2024 Rule improperly restricted states’ ability to conduct child abuse investigations and public health oversight, violating federal law that protects state authority in these areas.
- Created Unauthorized Redefinitions: HHS rewrote key legal definitions (such as “person” and “public health”) without proper authority from Congress.
- Exceeded Agency Powers: HHS lacked clear congressional permission to create special privacy rules for reproductive health care PHI.
The court determined these problems made the 2024 Rule unlawful, and the court vacated it entirely with nationwide effect. This means the 2024 Rule is immediately unenforceable across the U.S.
Key Provisions No Longer in Effect
The court’s ruling means the following key provisions in the 2024 Rule are no longer in effect:
- Expanded Definition of Health Care: The broadened definition of reproductive health care information.
- Prohibition on Disclosure: The blanket prohibition on disclosures of PHI related to reproductive health care for law enforcement, oversight or administrative purposes.
- Presumption of Legality: The presumption that reproductive health care is lawful unless proven otherwise.
- Attestation Requirement: The requirement covered entities must obtain attestations from requestors affirming that PHI will not be used for prohibited purposes.
- Notice of Privacy Practices Updates for Reproductive Health Care: The requirement for covered entities to update their HIPAA Notices of Privacy Practices by Feb. 16, 2026, to reflect the reproductive health care protections under the 2024 Rule. However, covered entities should note separate Notice of Privacy Practices updates related to substance use disorder records, which were included in the same February 2026 deadline, remain in effect and are unaffected by this court ruling.
Recommended Compliance Tips
While the 2024 Rule has largely been vacated, covered entities should:
- Pause Implementation Efforts: If you have not yet finalized policy changes, attestations or staff training based on the 2024 Rule, consider suspending those updates pending further legal or regulatory guidance.
- Review Prior Updates: If your organization already implemented policy or procedural changes based on the vacated 2024 Rule, reassess whether to retain, revise or reverse those changes in light of the court’s decision.
- Monitor for Appeals: The court’s ruling may be appealed, and future federal guidance or rulemaking could address the regulatory gap left by the vacatur. Stay alert for developments.
- Continue General HIPAA Compliance: Covered entities should continue to maintain robust HIPAA training, documentation and access protocols.
