The Department of Health and Human Services (HHS) faced significant legal challenges to its 2024 HIPAA Privacy Rule amendments designed to strengthen protections for reproductive health care information. Following multiple federal court lawsuits, a Texas federal judge vacated nearly all provisions of the rule in June 2025, finding that HHS exceeded its statutory authority and unlawfully preempted state public health laws.
Background: The 2024 HIPAA Privacy Rule
On April 26, 2024, HHS published the “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” (the “2024 Rule”) in the Federal Register. The rule was designed to enhance privacy protections for medical records and other health information related to reproductive health care in the post-Dobbs legal landscape, where state laws on reproductive health vary significantly.
Key Provisions of the 2024 Rule
The 2024 Rule established several new protections:
- Enhanced Privacy Protections: Strengthened privacy safeguards for reproductive health care information under HIPAA
- Limited Disclosure Requirements: Restricted circumstances under which covered entities could disclose reproductive health information to law enforcement and other parties
- Attestation Requirements: Required attestations for certain disclosures related to reproductive health care
- Notice of Privacy Practices Updates: Mandated revisions to Notice of Privacy Practices to reflect the new protections
Implementation Timeline
The rule followed a phased implementation schedule:
- June 25, 2024: The rule officially took effect but was not yet enforced
- December 23, 2024: Primary compliance deadline for the reproductive health care record protections
- February 16, 2026: Compliance deadline for Notice of Privacy Practices updates (aligned with substance use disorder record requirements)
Legal Challenges
Texas State Lawsuit
On September 4, 2024, the State of Texas filed the first major lawsuit challenging the 2024 Rule, arguing that it unlawfully interfered with the state’s investigative authority and violated the Administrative Procedure Act. The lawsuit alleged that the federal regulations providing enhanced privacy protections for reproductive health care information exceeded HHS’s statutory authority.
Purl v. HHS Case
The more significant challenge came on October 21, 2024, when Dr. Carmen Purl and her clinic, Dr. Purl’s Fast Care Walk In Clinic, filed a lawsuit against HHS, HHS Secretary Xavier Becerra, the Office for Civil Rights (OCR), and OCR Director Melanie Fontes Ranier. The plaintiffs argued that the 2024 Rule:
- Interfered with mandatory child abuse reporting obligations
- Exceeded HHS’s statutory authority under HIPAA
- Violated procedural requirements under the Administrative Procedure Act
Preliminary Injunction
On December 22, 2024, the U.S. District Court for the Northern District of Texas issued a preliminary injunction in the Purl v. HHS case, temporarily blocking HHS from enforcing the 2024 Rule. However, this injunction initially applied only to the individual plaintiffs—Dr. Purl and her clinic—not nationwide.
The Court’s Final Ruling
Summary Judgment Motion and Decision
On January 17, 2025, the plaintiffs in Purl v. HHS filed a motion for summary judgment. On June 18, 2025, the court issued a significant ruling that vacated the 2024 Rule nationwide, with limited exceptions.
Legal Reasoning
The court found that HHS exceeded its statutory authority in several key areas:
- Preemption of State Public Health Laws: The court determined that the 2024 Rule unlawfully preempted state public health laws, particularly those requiring reporting of child abuse. The rule prohibited such reporting when it would be based solely on lawfully provided reproductive health care.
- Statutory Authority Concerns: The court concluded that HHS lacked the statutory authority under HIPAA to implement the broad privacy protections contained in the 2024 Rule.
- Procedural Violations: The court found that HHS violated procedural requirements in promulgating the rule.
Scope of the Vacatur
The court’s June 18, 2025 ruling vacated the 2024 Rule nationwide, with one important exception: changes related to the Notice of Privacy Practices concerning substance use disorder records were preserved. This exception aligned with the February 16, 2026 compliance date for the separate 2024 Part 2 Rule concerning substance use disorder records.
Current Status and Implications
HHS Response
Following the court’s decision, HHS stated that it would “determine next steps after a thorough review of the court’s decision.” The agency has not yet announced whether it will appeal the ruling or attempt to issue revised regulations.
Impact on Healthcare Providers
The vacatur of the 2024 Rule has several implications for healthcare providers:
- Return to Standard HIPAA Protections: Reproductive health information is now subject to standard HIPAA privacy protections rather than the enhanced protections that were briefly in effect
- State Law Considerations: Providers must navigate varying state laws regarding reproductive health information disclosure, some of which may be more restrictive than federal HIPAA requirements
- Enforcement Uncertainty: While the enhanced federal protections are no longer in effect, existing HIPAA rules still apply to impermissible disclosures
Ongoing Compliance Requirements
Despite the vacatur, certain compliance obligations remain:
- The February 16, 2026 deadline for Notice of Privacy Practices updates related to substance use disorder records remains in effect
- Standard HIPAA privacy protections continue to apply to all health information, including reproductive health records
- State-specific privacy laws may provide additional protections
Additional Legal Challenges
Beyond the successful Purl v. HHS case, other legal challenges emerged. In January 2025, a coalition of 15 state attorneys general filed a separate lawsuit in Tennessee challenging the legality of the 2024 Rule, though this case was rendered largely moot by the subsequent nationwide vacatur.
Future Outlook
The court’s decision represents a significant setback for federal efforts to enhance reproductive health privacy protections through HIPAA modifications. Several factors will influence future developments:
Potential Appeals
HHS has not yet announced whether it will appeal the Texas court’s decision to higher courts. Any appeal would likely focus on:
- The scope of HHS’s statutory authority under HIPAA
- The balance between federal privacy protections and state public health laws
- Procedural aspects of the rule’s promulgation
Alternative Regulatory Approaches
If HHS chooses not to appeal or if appeals are unsuccessful, the agency may consider:
- Issuing revised regulations with a narrower scope
- Providing guidance on existing HIPAA protections for reproductive health information
- Working with Congress to obtain clearer statutory authority
State-Level Developments
In the absence of enhanced federal protections, state legislatures may consider their own privacy legislation. Some states have already enacted comprehensive reproductive health privacy laws that exceed federal HIPAA requirements.
Conclusion
The legal challenges to the 2024 HIPAA Privacy Rule highlight the complex intersection of federal healthcare privacy law, state public health authority, and reproductive health policy. While the rule’s vacatur removes enhanced federal protections that were briefly in effect, the underlying privacy challenges in the post-Dobbs landscape remain. Healthcare providers must continue to navigate this evolving legal environment while ensuring compliance with existing HIPAA requirements and applicable state laws.
The outcome of any potential appeals and future regulatory actions by HHS will significantly impact how reproductive health information is protected in the United States healthcare system. Until then, healthcare entities must rely on existing HIPAA protections and state law requirements to safeguard patient privacy while fulfilling their legal obligations for reporting and disclosure.
Note: This article is based on information available as of July 2025. Legal developments in this area continue to evolve, and readers should consult current legal counsel for the most up-to-date guidance on HIPAA compliance and reproductive health privacy requirements.
