Federal Court Strikes Down HIPAA Reproductive Health Privacy Rule Lifting Compliance Requirements for Regulated Entities

In a sweeping decision published in June, a federal court in Texas struck down most of the HIPAA Rule to Support Reproductive Health Care Privacy (Reproductive Health Rule) enacted in 2024 under the Biden administration to strengthen privacy protections for reproductive health information.[1]

What does this mean for HIPAA regulated entities?

The court’s decision in Purl v. U.S. Department of Health and Human Services vacated most of the Reproductive Health Rule. It also included a nationwide injunction that releases HIPAA regulated entities across the United States from having to comply with the Rule’s new requirements related to reproductive health information.

The Reproductive Health Rule went into effect on June 25, 2025, and amended HIPAA to impose significant new compliance obligations on HIPAA regulated entities related to protecting the privacy of reproductive health information.

While the Texas decision gutted all the Rule’s amendments to HIPAA related to reproductive health information, the decision left intact HIPAA amendments related to substance use disorder (SUD) information. The compliance date for the SUD-related amendments remains February 16, 2026.[2]

Importantly, HIPAA’s core Privacy Rule remains unchanged. Regulated entities must continue to comply with the Privacy Rule’s longstanding requirements related to uses and disclosures of protected health information.

How does the Supreme Court’s recent decision on nationwide injunctions factor into the equation?

Shortly after the Texas decision, the U.S. Supreme Court limited the use of nationwide injunctions by federal district courts in its landmark decision, Trump v. CASA, Inc.[3]

However, the Texas court’s decision in Purl continues to have nationwide effect.

The Supreme Court’s decision in CASA involved an executive order and the question of whether the Judiciary Act of 1798 authorizes federal courts to issue nationwide (or “universal”) injunctions. Purl, on the other hand, involved a nationwide injunction to vacate a rule or action of a federal agency under the Administrative Procedure Act (APA).

The Supreme Court in CASA expressly declined to decide the issue of universal injunctions under the APA.[4] This means the nationwide injunction established by the Texas court in Purl remains in place.

What is the backstory of the Reproductive Health Rule?

On April 26, 2024, the U.S. Department of Health and Human Services Office for Civil Rights (HHS-OCR) published a Final Rule amending the HIPAA Privacy Rule to strengthen protections for reproductive health information. This Final Rule (a.k.a. the Reproductive Health Rule) was enacted under the Biden administration in response to the U.S. Supreme Court’s decision to overturn Roe v. Wade, which led to new state laws restricting abortions and other types of reproductive health care.[5]

In the preamble to the Final Rule, HHS asserted that the changing legal landscape “increases the potential that use and disclosure of PHI about an individual's reproductive health will undermine access to and the quality of health care generally.” HHS stated that the Rule was designed to provide heightened protections to sensitive reproductive health information, while improving access to and quality of health care.

The Rule prohibited the use or disclosure of Protected Health Information (PHI) related to reproductive health care for the purpose of conducting criminal, civil, or administrative investigations or imposing liability on individuals seeking, obtaining, providing, or facilitating legal reproductive health care.[6] Examples of these services include a wide range of reproductive health services such as contraception, pregnancy-related care, fertility and infertility treatments, and gender-affirming care.[7]

To help safeguard this information, the Rule required covered entities to obtain a signed attestation from requestors affirming that the PHI would not be used for prohibitive purposes when the request is made for certain non-health purposes, including health care oversight activities, law enforcement purposes, judicial and administrative proceedings, and to coroners and medical examiners.[8] This requirement applied even to providers who do not primarily offer reproductive health care services. If a patient’s reproductive health information were included in their medical record as part of the medical history or shared during the course of treatment, it could still be subject to the Reproductive Health Rule.

Why did the Texas court strike down the Reproductive Health Rule?

In Purl, the Court found that HHS exceeded its authority in promulgating the Reproductive Health Rule. It reasoned that the rule was impermissibly designed to “accomplish political ends like protecting access to abortion and gender-transition procedures.” The Court stated that while HIPAA gives authority to HHS to promulgate regulations protecting “individually identifiable health information,” the law does not give authority to “distinguish between types of health information” to accomplish a political agenda. The Court also argued that the Rule unlawfully limits state public health laws.

What happens next?

It is important to note that HHS has not yet formally withdrawn or amended the Reproductive Health Rule, so additional guidance may be forthcoming. In addition, the legal landscape continues to change with decisions such as Trump vs. CASA, which shifted the balance of power between the executive and judicial branch, and Loper Bright Enterprises v. Raimondo, which overturned the Chevron doctrine of judicial deference to agency interpretation when interpreting ambiguous statutes.

For now, the Texas court’s injunction stands, and HIPAA-regulated entities are released from complying with the 2024 amendments related to reproductive health information.

We are closely monitoring the legal updates that may impact the Reproductive Health Rule and will keep you informed of any changes that may impact your compliance obligations.  

_{[1] Purl v. United States Dep't of Health & Hum. Servs., No. 2:24-CV-228-Z, 2025 WL 1708137, at *26 (N.D. Tex. June 18, 2025).}

_{[2] https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html}

_{[3] Trump v. CASA, Inc., No. 24A884, 2025 WL 1773631 (U.S. June 27, 2025).}

_{[4] Trump v. CASA, Inc., No. 24A884, 2025 WL 1773631, at *8 (U.S. June 27, 2025)(“Nothing we say today resolves the distinct question whether the Administrative Procedure Act authorizes federal courts to vacate federal agency action.”).}

_{[5] https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html.}

_{[6] 45 CFR 164.502(a)(5)(iii).}

_{[7] HIPAA broadly defines reproductive health care as “health care that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.” 45 CFR 164.103.}

_{[8] https://www.hhs.gov/sites/default/files/model-attestation.pdf}