On June 18, 2025, Judge Matthew Kacsmaryk of the Northern District of Texas vacated the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to Support Reproductive Health Care Privacy (the Rule). The court found that the Rule exceeded HHS’s authority on privacy protections concerning abortions and gender affirming care. The court’s decision applies nationwide.
The Rule became effective in 2024 under the Biden Administration after the Supreme Court overturned Roe v. Wade. It expanded protections for reproductive health information under HIPAA by prohibiting regulated entities from using or disclosing an individual’s protected health information (PHI) for the purpose of conducting a criminal, civil, or administrative investigation into or proceedings against a person in connection with seeking, obtaining, providing, or facilitating reproductive health care where the health care provided was lawful under state or federal law. (See April 17, 2023 Health Headlines). The Rule also prohibited a regulated entity from disclosing PHI to identify an individual for purposes of initiating an investigation into a person who obtained, sought, provided or received lawful reproductive health care services.
The case is based on Texas plaintiffs, Dr. Carmen Purl and her medical clinic. The clinic treats children, young women, and pregnant women, including a substantial number of child-abuse victims. In 2024, Judge Kacsmaryk issued a preliminary injunction that blocked HHS from enforcing the Rule against Dr. Purl. The court ordered additional briefing to consider plaintiffs’ request that the court vacate the Rule entirely based on plaintiffs’ allegations that the Rule was “arbitrary and capricious” and “in excess of statutory authority” in violation of the Administrative Procedure Act. Further, the plaintiffs alleged that the Rule impaired their practice by limiting the clinic’s obligations under Texas law to report child abuse and participate in public health investigations.
In its order, the court determined that the Rule improperly regulated politically sensitive issues like abortion and gender transition and that the defendants had to “identify a ‘clear congressional authorization’” in support of their arguments for higher protection for certain PHI. The court found that defendants failed to do so.
The order stated further that the regulation infringed on state authority to enforce child welfare and public health laws. Judge Kacsmaryk wrote, “[U]ntil the people speak through their representatives, agencies must fall silent on issues of abortion or other matters of great political significance. Thus, HHS lacked the authority to promulgate the 2024 Rule.” Since the June order vacated the Rule on the merits, the order applies with nationwide effect.
A copy of the court’s opinion and order is available here.
