/>iLast month, Judge Matthew Kaszmaryk of the U.S. District Court, Northern District of Texas, in Purl v. United Stated Department of Health and Human Services, No. 2:24-cv-00228-Z (N.D. Tex Jun. 18, 2025) struck down nearly all of the 2024 Reproductive Health Amendment to the HIPAA Privacy Rule.
HIPAA’s Reproductive Health Amendment
Following the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, 597 U.S. 215 (2022), which overturned Roe v. Wade and returned the regulation of abortion care to the states, the U.S. Department of Health and Human Services (“HHS”) (under the Biden administration) issued a rule designed to limit how reproductive health care information could be disclosed by Covered Entities. HIPAA’s Reproductive Health Amendment (the “2024 Amendment”) prohibited HIPAA Covered Entities from sharing reproductive health information with certain requestors for the purpose of investigating or prosecuting individuals from seeking or providing reproductive health care if that care was lawful where it was provided. The 2024 Amendment required HIPAA Covered Entities or their business associates to obtain a written attestation from individuals or agencies requesting reproductive health information for purposes related to health oversight activities, judicial or administrative proceedings, law enforcement purposes, or disclosures to coroners or medical examiners attesting that their use or disclosure of such information was not for a prohibited purpose under the new Amendment.
The Purl Decision
In late 2024, plaintiff Dr. Purl, a Texas physician, filed a lawsuit against HHS challenging the legality of HIPAA’s Reproductive Health Amendment. Plaintiff argued that the 2024 Amendment exceeded HHS’s statutory authority and that the 2024 Amendment directly conflicted with her mandatory duty to immediately report suspected child abuse under state law.
In his decision, Judge Kacsmaryk found that HHS exceeded its authority in enacting the 2024 Amendment; that the 2024 Amendment conflicted with state law by impermissibly limiting states’ ability to implement their own public health regulations and child abuse reporting statutes; and that HHS violated the “major-questions doctrine by improperly attempting to regulate politically significant issues without the explicit approval from Congress.”
While the Court had initially granted injunctive relief only to the Plaintiff Dr. Purl in November 2024, the June 18, 2025 decision granted summary judgement for the Plaintiff. In so doing, the Court vacated the 2024 Amendment. The Court did limit the vacatur in order to retain those provisions in the 2024 Amendment that applied to Substance Use Disorder information.
What’s Next?
It is unlikely that the current Administration will move to appeal the Texas district court’s decision. As such, HIPAA Covered Entities should consider whether any changes that they made to policies and procedures, Notices of Privacy Practices (“NPPs”), or training under the 2024 Amendment need to be further revised in light of the Purl decision.
Nonetheless, although the 2024 Amendment has been vacated, the long-standing provisions regulating uses and disclosures of PHI contained in the HIPAA Privacy Rule remain in effect. Thus, HIPAA Covered Entities and their Business Associates must ensure that they continue to use and disclose PHI – including PHI related to reproductive health care – only in ways that comply with HIPAA.
