Texas District Court Vacates HIPAA Reproductive Healthcare Rule

On June 18, 2025, the U.S. District Court for the Northern District of Texas issued an order to vacate a large portion of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to Support Reproductive Health Care Privacy, which was published by the Department of Health and Human Services (HHS) on April 26, 2024 (the 2024 Rule). The 2024 Rule amended the Privacy Rule under HIPAA, which seeks to protect the rights of US patients regarding their health data. The District Court found that the 2024 Rule impermissibly limits state power and exceeds statutory authority granted to HHS by changing how terms like "public health" and "person" are addressed in the Privacy Rule and prohibiting the disclosure of reproductive health data related to potential child abuse concerns.

The 2024 Rule

In 2022, the Supreme Court ruled in Dobbs v. Jackson Women's Health Organization, 597 U.S. 215, to give regulating authority regarding abortion access and care back to individual states. This decision resulted in a host of litigious, legislative, and regulatory responses, including the 2024 Rule. HHS takes the position that the Dobbs decision could chill individuals' willingness to seek reproductive healthcare (RHC) and that RHC data could be used by states in enforcement actions against those individuals or the doctors providing RHC services.

The 2024 Rule seeks to strengthen privacy protections for RHC protected health information (PHI), a subset of PHI already regulated under HIPAA. Specifically, the 2024 Rule limits the circumstances under which RHC PHI can be disclosed for non-healthcare purposes, namely for conducting criminal, civil, and administrative investigations; imposing liability on any person for the mere act of seeking, obtaining, providing, or facilitating RHC; and identifying any person for the same purpose. Prohibitions under the 2024 Rule only apply when the RHC being sought or provided is considered lawful under state or federal law. However, if there is uncertainty, the 2024 Rule requires the disclosing party to presume lawfulness. Additionally, those seeking disclosure of RHC PHI must provide an authorizing attestation that can be refused if the disclosing party has actual knowledge or a reasonable belief that the attestation is false. Additional new requirements not addressed by the District Court include amendments to the HIPAA Notice of Privacy Practices that detail examples of such disclosure prohibitions to more adequately inform patients of their rights and protections.

Purl v. United States Department of Health and Human Services
In the Texas District Court case, plaintiff Dr. Carmen Purl sought to set aside the 2024 Rule, arguing that it is arbitrary and capricious and exceeds HHS's statutory authority. Dr. Purl's clinic treats pregnant women and collects data related to their pregnancies. In certain circumstances, these women are underage and may be pregnant due to instances of child abuse. Texas Child Protective Services investigates child abuse and, on occasion, sends Dr. Purl a request for an individual's entire medical record. Dr. Purl's position is that the 2024 Rule impedes her ability to comply with state-mandated reporting requirements related to child abuse.

The District Court ruled in favor of Dr. Purl and vacated the 2024 Rule on three grounds: (1) the 2024 Rule is "'contrary to law'" as it limits state power to regulate RHC via public health laws; (2) "the 2024 Rule impermissibly redefines 'person' and 'public health,' in contravention of Federal law and 'in excess of statutory authority'"; and (3) under the major questions doctrine, "the 2024 Rule arrogates to HSS authority [that is] not expressly delegated by Congress."

Limiting State Power

Dr. Purl has a duty to report child abuse under Texas law. The 2024 Rule bars disclosure of RHC PHI for matters relating to criminal investigations. Thus, Dr. Purl argued before the District Court that the 2024 Rule bars her from complying with state law, thereby limiting the state's power to investigate matters relating to child abuse. In response, HHS contended that the 2000 Privacy Rule permits the disclosure of PHI in furtherance of criminal investigations and the 2024 Rule does not modify this because it only prohibits the sharing of RHC PHI in response to a disclosure request and does not prohibit affirmative disclosure of RHC PHI by the clinic. The Texas District Court analyzed the 2024 Rule and found that this distinction between responsive and affirmative disclosure is not reflected in its text, and it ruled in favor of Dr. Purl, determining that HHS is misreading its own regulation.

Revised Definitions

The 2024 Rule revised the term "person" to mean "'a natural person (meaning a human being who is born alive)'" and the term "public health" to mean "'population-level activities to prevent disease in and promote the health of populations'" when used in the terms "public health surveillance," "public health investigation," and "public health intervention." HHS further clarified that "public health" could never mean efforts to conduct investigations or impose liability on individuals who only seek to obtain RHC services. Dr. Purl contended that redefining these terms violates the Dictionary Act, which prohibits affirming, denying, expanding, or contracting any legal status or legal right applicable to any human at any point prior to being born alive. The District Court agreed and further explained that the 2024 Rule functionally prohibits the disclosure of PHI to report child abuse against unborn children (for example, substance abuse), which is inconsistent with the laws of 21 states that define substance abuse during pregnancy as child abuse or neglect.

Major Questions Doctrine

The major questions doctrine is an administrative law that limits the power of federal agencies to regulate issues of vast political or economic significance unless Congress has clearly and explicitly authorized such action. Dr. Purl articulated the position that HHS's action of providing special treatment to a politically favored medical procedure gerrymanders the rules in violation of this doctrine. HHS argued that the major questions doctrine is inapplicable as heightened RHC protections do not involve a matter of public controversy of vast economic or political significance and the 2024 Rule does not constitute a transformative or radical change in HHS's authority. The District Court, finding that the major questions doctrine does apply, cited past examples including "student loan cancellation, pandemic eviction moratoriums, [and] disposal of nuclear waste." Because HHS cannot provide evidence of clear and explicit authority for such action from Congress, the District Court found that the 2024 Rule violated the major questions doctrine.

What to Expect

Vacating the 2024 Rule means HIPAA-regulated entities are released from their compliance obligations and enforcement under the 2024 Rule will halt. However, it is likely that the U.S. Court of Appeals for the Fifth Circuit will consider this District Court decision in the coming months. RHC providers should continue to treat sensitive data such as pregnancy information with care and caution and comply with the HIPAA Privacy Rule and state laws that may impose similar heightened protections for sensitive data.