On June 18, 2025, the U.S. District Court for the Northern District of Texas invalidated provisions of the HIPAA Privacy Rule To Support Reproductive Health Care Privacy (2024 Rule) in the case of Purl v. United States Dep’t of Health & Hum. Servs., No. 2:24-CV-228-Z, 2025 WL 1708137 (N.D. Tex. June 18, 2025).
The 2024 Rule had amended the HIPAA Privacy Rule to add protections for protected health information (PHI) related to lawful reproductive health care. In Purl, thecourt held that the U.S. Department of Health and Human Services (HHS) had exceeded its statutory authority in promulgating the 2024 Rule. The court’s decision, declaring unlawful and vacating most of the 2024 Rule, applies nationwide.
The original HIPAA Privacy Rule was not impacted by the court’s decision. However, HIPAA covered entities that modified their use and disclosure procedures to comply with the 2024 Rule should now review those actions in light of this ruling. Covered entities should also review their use of attestations and Notice of Privacy Practices and consider what is compliant moving forward, along with updating any form business associate agreements or training materials that may have been modified for the 2024 Rule.
