What Happened
On June 18, 2025, the Northern District of Texas granted a request to vacate the Department of Health and Human Services’ April 2024 Reproductive Health Privacy Rule. In its opinion, the court concluded that HHS exceeded the authority Congress granted in HIPAA when it created special, heightened protections for reproductive and gender-affirming care information. The court also ruled that the 2024 Rule unlawfully encroached on states’ ability to enforce their own healthcare and criminal statutes, particularly those regulating abortion. The case citation is Purl, M.D. et al. v. United States Department of Health & Human Services, No. 2:24 cv 00228 Z (N.D. Tex. June 18, 2025).
Background: The 2024 Reproductive Health Privacy Rule
HHS adopted the Reproductive Health Privacy Rule in April 2024 as an amendment to the HIPAA Privacy Rule. The amendment bars covered entities and business associates from disclosing protected health information (PHI) about reproductive care, including abortion services and gender-affirming treatment, if the information is sought for civil, criminal, or administrative investigations or proceedings. It also requires requesters to provide a signed attestation confirming that the disclosure was not for an impermissible purpose. HHS’ stated goal was to shield patients and providers in states that restrict or criminalize abortion or gender-affirming procedures.
Appeal Landscape & Multiple Litigation Tracks
Although the decision in the Northern District of Texas is currently the most consequential, it is not the only litigation challenging the 2024 Rule. Because multiple suits are ongoing, conflicting rulings are possible, which creates the possibility for eventual review by the U.S. Supreme Court.
What This Means for Covered Entities and Business Associates
With the 2024 Rule vacated, covered entities and business associates must revert to HIPAA’s baseline Privacy Rule. State law once again plays the primary role in governing whether, when, and how reproductive and gender-affirming health information may be disclosed. All subpoenas, court orders, or other requests for PHI must now be evaluated under standard HIPAA provisions, unless a state law provides heightened protection to the information at issue. Washington State healthcare organizations should make sure they are familiar with Washington’s Shield Law (RCW 7.115) and how it may apply to out-of-state legal actions seeking information about reproductive care and gender-affirming care provided legally by Washington providers.
Immediate Action Steps for Covered Entities and Business Associates
- Review State Law. Conduct a survey of every jurisdiction in which you operate to identify reporting mandates or other requirements that may be back in force
- Train Staff. Re-educate compliance, records, legal, and clinical teams on standard HIPAA protocols and the specific state laws that govern reproductive-health disclosures.
- Use Caution with Attestations. The court’s order eliminated the federal attestation requirement, but covered entities and business associates may still request attestations as a best practice. If a requester declines to sign an attestation, evaluate the disclosure solely under baseline HIPAA and applicable state requirements; do not require an attestation as a condition for disclosure of PHI.
- Monitor Legal Developments. Track current cases related to this issue. Be prepared for periods in which courts issue conflicting or overlapping orders.
Bottom Line
The nationwide vacatur is effective immediately, but it may be temporary. HIPAA covered entities and business associates should adjust their compliance programs to the current legal landscape while staying ready to restore the 2024 Rule’s heightened protections if an appellate court revives them.
This summary is a broad overview of a complex topic, and it does not constitute legal advice. If you have any questions, feel free to contact Casey Moriarty ([email protected]), Maddie Haller ([email protected]), Kate Robertson ([email protected]) any other attorney of the Ogden Murphy Wallace, P.L.L.C. Healthcare Group.
