Federal Judge Vacates HIPAA Reproductive Health Privacy Rule: What Regulated Entities Should Know
Amita Sanghvi, Coppersmith Brockelman, PLC
On June 18, 2025, a federal judge in Texas vacated the “HIPAA Privacy Rule to Support Reproductive Health Care Privacy,” (the 2024 Rule)[1] leaving in place only the provisions updating Notices of Privacy Practices (NPPs) for 42 USC 290dd-2 and 42 CFR Part 2 (collectively, “Part 2”) substance use disorder (SUD) treatment records. This decision in Purl v. HHS,[2] applies nationwide, and lifts the additional compliance requirements for handling reproductive health-related protected health information (PHI) under the 2024 Rule.
Background and Ruling
The 2024 Rule established new categorical prohibitions on the use or disclosure of PHI related to reproductive health care. These prohibitions specifically prevented regulated entities from disclosing PHI to impose criminal, civil, or administrative liability on individuals for seeking, obtaining, providing, or facilitating lawful reproductive health care. . The court found that:
- The rule unlawfully preempted state public health laws;
- HHS exceeded its statutory authority by redefining “person” and “public health;” and
- It was adopted without authority expressly delegated by Congress to issues such a significant privacy expansion.
The court vacated the rule, with nationwide effect, under the Administrative Procedure Act (APA). HHS did not appeal the decision, but a group of proposed intervenors, appealing the court’s denial of their motion to intervene, has filed a protective notice of appeal. HHS faces similar lawsuits challenging the 2024 Rule, including a lawsuit from the state of Texas, which is also filed in the Northern District of Texas, one from the state of Missouri and a suit by 14 states, led by the state of Tennessee. In the Missouri case, the parties have requested a stay until the appellate proceedings in Purl are resolved. This stay has been granted in the Texas case. While HHS has not formally withdrawn the rule, since it did not appeal it is bound by the national vacatur decision and as a result the 2024 changes are unenforceable.
Status of National Vacatur
In a separate, and unrelated case, on June 27, 2025, the Supreme Court of the United States (SCOTUS) limited the ability of federal judges to issue nationwide injunctions in Trump v. CASA.[3] The 6-3 majority held that federal courts lack statutory authority under the Judiciary Act of 1789 to issue injunctions against executive branch policies that apply to individuals who are not parties to the case.[4] However, SCOTUS clarified that they did not resolve “the distinct question [as to] whether the APA authorizes federal courts to vacate agency action.”[5] Because the holding in Purl was based on this APA authority with respect to agency action, the CASA limitation on nationwide injunctions does not apply to this case. Nevertheless, SCOTUS has cast doubt on a court’s reliance on the APA to vacate a rule nationwide. Thus, while the question remains open, it is an issue that likely will be litigated.[6]
What this Means for Regulated Entities
In the wake of the decision, regulated entities are relieved of significant compliance burdens and should proceed with the following compliance processes:
- Review Internal Procedures:Entities that updated their HIPAA policies to ensure compliance with the 2024 Rule’s restrictions on disclosure of PHI related to lawful reproductive health care can revert to their pre-2024 policies now. While these new prohibitions are vacated, regulated entities must continue to comply with the requirements that existed for disclosures of PHI under the pre-2024 Rule. Similarly, the definition of “person” should revert to the pre-2024 definition, and there is no longer a HIPAA regulatory definition for “public health” as used in the terms “public health surveillance,” “public health investigation,” and “public health intervention.”
- No more HIPAA attestations: Regulated entities are no longer required to receive an attestation from requestors for PHI potentially related to reproductive health care.
- Staff Training: Offer targeted training to staff, explaining the updated processes.
- Update HIPAA NPPs: Only implement the Part 2 SUD updates for NPPs by Feb. 16, 2026.
- Monitor Developments: Continue monitoring litigation and a possible appeal by the federal government.
While the compliance burdens have lifted, entities may still be concerned about the privacy of sensitive information. HIPAA’s baseline privacy protections still apply, but navigating patient privacy and responding to law enforcement requests will now require careful review of both federal and state laws. Importantly, the HIPAA Privacy Rule never required disclosure of PHI to law enforcement; rather, the law allowed for the disclosure under specific conditions. If these conditions are not met, regulated entities would not be permitted under HIPAA to disclose PHI. Refusing to disclose PHI also does not violate the federal Information Blocking Rule (42 USC 300jj-52 and 45 CFR Part 172) when exceptions apply, such as the recently finalized Protecting Care Access exception for reproductive health care.[7]
Even where federal law may not require a disclosure, regulated entities will also need to account for state law requirements. For instance, Arizona requires health care providers to disclose medical records without the patient’s written authorization as otherwise required by law or when ordered by a court or tribunal of competent jurisdiction.[8] While state law may require certain disclosures, HIPAA preemption provisions and regulatory frameworks ensure that such disclosures comply with federal privacy standards. Thus, disclosures mandated by ARS 12-2294(A) fit within HIPAA’s scope insofar as they are legally required and compatible with HIPAA Privacy Rule’s requirements and safeguards. At the same time, Arizona has a shield law that prohibits state agencies from assisting in out-of-state investigations relating to reproductive health care and gender-affirming health care that would not be punishable under Arizona law.[9] Without the 2024 Rule, decisions about reproductive health related PHI disclosures will require case-by-case review, considering HIPAA, state law, and information blocking rules. Covered entities should evaluate any requests for PHI related to reproductive health care carefully, balancing patient privacy interests with legal obligations and potential risks in this evolving regulatory landscape.
[1] 89 Fed. Reg. 32976-01 (Apr. 26, 2024).
[2] N.D. Tex., 2:24-CV-228-Z, Jun. 18, 2025 (the “Decision”).
[3] 606 U.S. ___ (2025).
[4] Id.
[5] Id., note 10.
[6] In United States v. Texas, Justice Neil Gorsuch (joined by Justices Clarence Thomas and Barrett) suggested that universal vacatur under the APA may be incompatible with traditional equitable principles and Article III. See United States v. Texas, 599 U.S. 670 (Gorsuch, N. concurrence).
[7] 45 CFR § 171.206.
[8] ARS § 12-2294(A).
[9] Ariz. Exec. Order 2023-11, Protecting Reproductive Freedom and Healthcare in Arizona (June 22, 2023), available at: https:// azgovernor.gov/sites/default/files/executive_order_2023_11.pdf; Ariz. Exec. Order 2023-12, Ensuring Access to Medically Necessary Gender-Affirming Healthcare (June 27, 2023), available at https://azgovernor.gov/sites/default/files/executive_order_2023-12.pdf.