2024 HIPAA Reproductive Health Privacy Rule Vacated

PDF

By: Colin Clark | Staff Attorney

What is (was) the 2024 HIPAA Reproductive Health Privacy Rule?

In 2024, under the Biden Administration, the Department of Health & Human Services (“HHS”) issued the 2024 Reproductive Health Privacy Rule (the “2024 Final Rule”), modifying parts of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). This rule was aimed at protecting reproductive health care privacy and was a direct response from the Biden Administration and HHS to the United States Supreme Court decision in the landmark case of Dobbs v. Jackson Women’s Health Organization. Dobbs overturned the well-known Roe v. Wade case, ultimately leaving abortion regulation in the hands of the states. The 2024 Final Rule broadly expanded the definition of reproductive health care, prohibited the use of protected health information (“PHI”) by a regulated entity for the purposes of investigations or imposing liability on “any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided,” and required covered entities to obtain signed attestations that the use or disclosure of reproductive health care PHI was not for a prohibited purpose.

U.S. District Court for the Northern District of Texas Vacates 2024 Rule

The rule was initially challenged by a Texas physician in Purl v. United States Department of Health and Human Services. The plaintiff filed suit on October 21, 2024, in the U.S. District Court for the Northern District of Texas. In Purl, the plaintiffs alleged that HHS exceeded their statutory authority in issuing the rule, as well as restricted the plaintiff’s ability to comply with state law regarding mandatory reporting in suspected cases of child abuse. The U.S. District Court for the Northern District of Texas agreed with the argument that HHS had exceeded its authority, and on June 18, 2025, Judge Matthew Kacsmaryk ordered the final rule vacated, noting that “HIPAA did not grant HHS the power to promulgate special protections for politically favored medical procedures.”

In addition, Plaintiffs argued that the 2024 Final Rule made compliance with mandatory reporting state laws essentially impossible. The plaintiff routinely treats patients who are victims of child-abuse, and, in conjunction with the Texas Child Protective Services Department, exchanges reproductive health care PHI for victims in accordance with Texas law. Such exchanges of PHI were in direct contradiction with the 2024 Final Rule. The court agreed here as well, stating that the “2024 Rule restricts their ability to comply with state child-abuse reporting laws.”

Next Steps and Future Considerations

Compliance obligations imposed by the rule no longer remain and show no immediate signs of returning. While technically HHS can appeal the decision, it is unlikely that the current administration will champion any challenges to this ruling. Some may view this recent court decision as a reprieve from the many requirements of HIPAA, but covered entities and business associates must remain diligent in complying with the rest of HIPAA – which remains unchanged. Another important consideration is state laws surrounding privacy. Many, if not all, states have their own requirements related to sensitive and personal information such as PHI. This recent ruling does not relieve covered entities and other affected parties from any state law obligations that existed prior to this ruling, or any that may come into effect after this ruling. Lastly, topics surrounding reproductive health are often at the forefront of public discourse and staying updated on such matters (including this case) remains an important compliance consideration.