HIPAA Reproductive Privacy Rule overturned

A federal court has overturned the 2024 HIPAA Reproductive Health Rule, and the U.S. Department of Health and Human Services has opted not to appeal.

What happened

According to an article by JD Supra, the U.S. Department of Health and Human Services (HHS) chose not to appeal a June 2025 federal court decision that vacated key portions of the 2024 HIPAA “Reproductive Health Rule.” Because HHS let the August 18, 2025, appeal deadline pass, the district court decision stands, and the protections enacted by the rule are, for now, defunct. 

However, HIPAA-regulated entities must continue to protect reproductive health–related information under existing HIPAA obligations. 

Some parts of the 2024 rule that did not implicate reproductive health remain in place, particularly as they relate to Notices of Privacy Practices (NPPs) and other non-reproductive health disclosures. 

The backstory

In April 2024, HHS issued the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “2024 Rule”) to strengthen protections surrounding the disclosure of patient information related to lawful reproductive health care (e.g., abortion, contraception, fertility treatments, and gender-affirming care). The rule would have required covered entities to obtain pre-disclosure attestations under certain conditions, limit disclosures of reproductive health information to law enforcement or oversight investigations, and revise privacy notices and business associate agreements. The stated purpose was to protect patients’ sensitive medical data from being used against them in jurisdictions where reproductive health care is restricted.

In October 2024, Dr. Carmen Purl, a Texas physician, challenged the rule in federal court, arguing it exceeded the authority of HHS and conflicted with state laws, such as mandatory child abuse reporting statutes. In December 2024, Judge Matthew Kacsmaryk preliminarily enjoined the rule’s enforcement against Dr. Purl.

On June 18, 2025, the district court granted summary judgment in Purl v. HHS. It vacated most of the rule’s reproductive health provisions nationwide, finding that HHS had exceeded its statutory authority and violated procedural limits (such as the “major questions doctrine”).

After that decision, HHS declined to appeal. Some third parties had hoped to intervene to defend the rule (e.g. cities, medical organizations), but varying legal maneuvers, including voluntary dismissals by intervenors, have weakened prospects for resurrecting the rule.

Go deeper: The HIPAA Privacy Rule to Support Reproductive Health Care Privacy

Why it matters

The decision signals limits on administrative reach: protections tied to politically charged domains (like abortion or gender identity) may require explicit legislative backing rather than agency rulemaking.

For patients, particularly in restrictive states, the rollback may reduce assurances that medical and reproductive health records won’t be weaponized in legal or law enforcement proceedings.

See also: HIPAA Compliant Email: The Definitive Guide (2025 Update)

The bottom line

The 2024 HIPAA Reproductive Health Rule, an attempt to amplify privacy protections for patients seeking reproductive health care, has been vacated and now lies dormant, with no federal appeal forthcoming. Nonetheless:

• HIPAA’s core privacy safeguards continue to apply, and entities must still protect patient health data, including reproductive health information.
• Entities that already adapted to the 2024 Rule must now reassess those changes and roll back or adjust policies, notices, or procedures that assumed the rule’s continued existence.

Related:

• Reproductive health: Rules, rights and compliance
• Reproductive health data isn't always protected under HIPAA

FAQS

Why was the rule overthrown?

A Texas federal judge ruled that the Department of Health and Human Services (HHS) exceeded its authority in creating the rule, saying such protections require clear approval from Congress.

Does this mean reproductive health data is no longer protected?

Not entirely. Existing HIPAA rules still protect all health information, including reproductive care. What’s gone are the extra safeguards the 2024 rule would have added.

How does this affect patients?

Patients in states with abortion or reproductive care restrictions may worry their health records could be used in investigations, since there are now fewer limits on disclosures.