On June 18, 2025, U.S. District Judge Matthew Kacsmaryk of the Northern District of Texas (the “District Court”) vacated a 2024 final rule issued by the U.S. Department of Health and Human Services (“HHS”) under the Biden Administration that amended the HIPAA Privacy Rule to increase protections for reproductive health and gender-affirming care information (the “Reproductive Rule”). The Reproductive Rule was promulgated following the 2022 U.S. Supreme Court, Dobbs v. Jackson Women’s Health Organization, which overturned Roe v. Wade and shifted authority to regulate abortion to individual states.
HHS created the Reproductive Rule to prevent the use or disclosure of protected health information (“PHI”) to investigate or prosecute individuals for seeking, providing, or facilitating lawful reproductive or gender-affirming care. Saul Ewing previously wrote an alert describing the impact of the Reproductive Rule.
The District Court held that HHS exceeded its statutory authority under the Administrative Procedure Act (“APA”) and the Health Insurance Portability and Accountability Act (“HIPAA”) and rescinded the vast majority of the Reproductive Rule.
What You Need to Know:
- The Reproductive Rule prohibited HIPAA-covered entities from disclosing PHI for law enforcement or administrative proceedings related to legally obtained reproductive health care services.
- Following the District Court decision, HIPAA-covered entities must now revert to HIPAA regulations existing prior to the Reproductive Rule, which permit but do not require disclosures of PHI in response to law enforcement requests, subpoenas, or legal proceedings.
- HIPAA-covered entities must continue to ensure compliance with applicable state privacy laws, which may impose additional or conflicting obligations regarding the disclosure of reproductive health information.
HHS issued the Reproductive Rule in response to concerns that states with restrictive abortion laws might seek to obtain PHI to investigate patients and providers involved in legal out-of-state care. The Reproductive Rule required HIPAA-covered entities to presume the legality of care unless there was substantial evidence to the contrary, and mandated written attestations before any disclosure of related PHI.
The District Court case—Purl v. United States Department of Health and Human Services—was brought by Dr. Carmel Purl, a Texas urgent care physician who alleged that the rule interfered with her and her clinic’s obligation to report child abuse to Texas authorities. The District Court determined that the Reproductive Rule unlawfully redefined statutory terms such as “person” and “public health,” conflicted with state public health enforcement frameworks, and created protections not authorized by HIPAA. The District Court also ruled that HHS lacked clear congressional authorization to create special privacy protections for politically sensitive procedures like abortion and gender-transition care. The District Court relied, in part, upon the “major-questions doctrine,” which limits the ability of federal agencies to regulate issues of significant political or economic consequence without express statutory authority. The District Court opinion noted, “Indeed, few issues command as much political controversy as abortion and gender-identity-related procedures,” and added that “The 2024 Rule creates special rules for information about these politically favored procedures that implicate fundamental and hotly debated questions. Accordingly, it triggers the major-questions doctrine because HHS is regulating on a matter of great political significance.”
The District Court decision allowed unrelated changes to HIPAA’s Notice of Privacy Practices provisions concerning substance use disorder records from the Reproductive Rule to remain in effect.
The District Court decision removes protections that were included in the Reproductive Rule. As of the date of this alert, HHS has not announced whether it will appeal the decision, although it is reasonable to assume that HHS will not appeal the decision given the views of the Trump Administration on this issue as compared to the views of the Biden Administration.
With regard to important next steps, HIPAA-covered entities should review (and modify as needed) their HIPAA privacy policies, Notice of Privacy Practices, business associate agreements, and training directives, and otherwise ensure that overturned provisions relating to the Reproductive Rule are revised consistent with the District Court’s decision, while continuing to remain compliant with their state law obligations.
