A recent decision from the Northern District of Texas has upended the Department of Health and Human Services' 2024 amendments to the HIPAA Privacy Rule (the 2024 Rule), which were intended to bolster privacy protections for reproductive health care information.
The court's ruling in Purl v. HHS vacates almost all of these amendments, finding that HHS overstepped its statutory authority and improperly interfered with state law.
The 2024 Rule: What HHS Tried to Do
In the wake of the Supreme Court's Dobbs decision, which returned abortion regulation to the states, HHS issued a rule designed to limit how reproductive health care information could be disclosed. The 2024 Rule prohibited HIPAA-covered entities from sharing such information with state authorities for the purpose of investigating or prosecuting individuals for seeking or providing reproductive health care, if that care was lawful where it was provided. The 2024 Rule also required covered entities to presume the lawfulness of care unless they had actual knowledge or a substantial factual basis to believe otherwise, and it imposed new attestation requirements on those requesting reproductive health information. HHS further redefined terms like “person” and “public health,” narrowing the circumstances under which states could access information for public health or child abuse investigations.
Why Plaintiffs Objected: The Clash with State Law
Dr. Carmen Purl and her clinic, the plaintiffs in this case, argued that the new federal requirements would put them in an impossible position under Texas law. Texas imposes a strict, immediate duty on health care providers to report suspected child abuse, and the clinic regularly receives requests from state authorities for unredacted medical records in the context of child abuse investigations. The 2024 Rule, according to the plaintiffs, would have forced them to navigate a complex new set of federal requirements before complying with these state mandates.
The core of their objection was that the federal rule introduced legal and procedural hurdles that could delay or even prevent them from fulfilling their state-law obligations. For example, before responding to a child abuse investigation, the clinic would have been required to determine whether the care in question was “lawful” under the relevant state or federal law — a nuanced legal judgment that most medical professionals are not equipped to make, especially in areas where the law is unsettled or rapidly evolving. The 2024 Rule also required the clinic to obtain and review detailed attestations from state authorities, adding further administrative burdens and the risk of delays in urgent situations. Plaintiffs argued that these requirements could expose them to liability under state law for failing to report suspected abuse in a timely manner, all while increasing their compliance costs and operational complexity.
The Court's Reasoning
The court found that the 2024 Rule was “contrary to law” because it unlawfully limited state public health laws, including those governing child abuse reporting and public health investigations. HIPAA explicitly states that it cannot be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease, injury, child abuse, or public health investigation. The court concluded that even if the 2024 Rule did not absolutely prohibit disclosures, any restriction or procedural hurdle amounted to a forbidden “limit” under the statute.
The court also found that HHS had exceeded its statutory authority by redefining “person” and “public health” in ways that conflicted with federal law and the Dictionary Act. The Rule's new definitions excluded the unborn from the category of “person” and narrowed the meaning of “public health” to exclude certain state investigations, effectively overriding state law.
Finally, the court applied the “major questions doctrine,” holding that agencies require clear congressional authorization to make major policy decisions, particularly on politically charged issues like abortion and gender identity. The court found that HIPAA's general grant of authority was insufficient to support HHS's attempt to create special protections for reproductive health information or to override state law in these areas.
The decision specifically vacated most of the 2024 Rule and did not provide a universal injunction. The court discussed the difference between a vacatur and a universal injunction. As explained by the court, “vacatur ‘empowers courts to set aside – i.e., formally nullify and revoke – an unlawful agency action'” which “operates nationwide because it ‘operates on the status of agency action in the abstract.'” The court argued that it is not the same as injunctive relief and “implicates fewer of the constitutional concerns universal injunctive relief implicates.” This is important because the subsequent Supreme Court decision in Trump v. CASA, Inc., 606 U.S. ___ (2025), would have immediately invalidated the universal injunction in this case. Whether a vacatur, as described above, is truly different than a universal injunction (which the Supreme Court described in Trump as “'improperly intrud[ing]' on ‘a coordinate branch of the Government'” and preventing “the Government from enforcing its policies against nonparties”) remains to be seen.
What Remains of the 2024 Rule
While the court vacated nearly all of the 2024 Rule, it did leave in place certain amendments to the HIPAA Notice of Privacy Practices requirements at 45 C.F.R. Section 164.520. However, even within this section, the court vacated the provisions at 45 C.F.R. Section 164.520(b)(1)(vi)(F), (G), and (H). The remaining, non-vacated amendments relate to general updates in how covered entities must describe their privacy practices, but do not include the changes specific to reproductive health information disclosures. In practical terms, the pre-2024 HIPAA Privacy Rule remains in effect, except for these limited notice updates.
Practical Guidance for Employer-Sponsored Health Plans and other Covered Entities
For employer-sponsored group health plans and other covered entities subject to HIPAA, the immediate takeaway is to reconsider the implementation of the 2024 reproductive health privacy amendments, except for the limited Notice of Privacy Practices updates that remain in force. Plans can revert to the prior HIPAA standards for all other aspects of protected health information use and disclosure, including those related to reproductive health care. This will require amendments to group health plans' privacy policies, business associate agreements, forms, and Notice of Privacy Practices, to the extent they were updated to conform with the 2024 amendments.
However, plans and other covered entities subject to HIPAA providing reproductive health care services in states in which certain types of reproductive health care services are still legal may want to consider whether to continue to provide enhanced procedures for determining whether types of information should be provided in cases where PHI may be disclosed (as opposed to cases where the disclosure of PHI is required). Plans and other covered entities should also review their compliance with applicable state laws, especially in states with their own health privacy or mandatory reporting requirements. If enhanced procedures are retained, covered entities should coordinate with third-party administrators (where applicable) and legal counsel to ensure that all compliance activities align with the current legal landscape.
At this time, it is unclear whether HHS will appeal this decision. Although HHS did not request a pause on proceedings in the Purl case, the 2024 Rule was one of the agency actions from the Biden administration that was under consideration at HHS. Plan sponsors should monitor legal developments closely and be prepared to adjust their policies and procedures if the regulatory environment changes again.
For now, the HIPAA status quo prevails. There is no special federal privacy shield for reproductive health information, and covered entities must navigate a complex patchwork of state and federal requirements. The tension between federal privacy regulation and state public health and reporting laws remains unresolved, and further litigation is almost certain.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
