A federal court in Texas has vacated a 2024 HIPAA rule directed at shielding reproductive health data from law enforcement inquiries.
What happened
A Texas district judge has ruled that the U.S. Department of Health and Human Services (HHS) exceeded its authority by adopting a 2024 update to the HIPAA Privacy Rule intended to strengthen privacy protections for reproductive health data. The rule, which would have limited disclosures of protected health information (PHI) related to lawful abortion services, has now been vacated.
The decision, issued on June 18, 2025, in Purl v. United States Department of Health and Human Services, follows legal challenges from a Texas physician and medical clinic who argued the rule conflicted with state-mandated reporting obligations.
Going deeper
In response to the Supreme Court’s 2022 ruling in Dobbs v. Jackson Women’s Health Organization, which overturned Roe v. Wade, HHS introduced the HIPAA Privacy Rule to Support Reproductive Health Care Privacy. It barred HIPAA-covered entities from disclosing PHI related to lawful reproductive care for purposes such as investigations, litigation, or administrative enforcement.
Entities were required to presume reproductive care was legal unless they had actual knowledge to the contrary, and requesting parties had to submit attestations confirming the information was not being sought for prohibited uses.
The rule went into effect in June 2024, with full compliance (excluding notice of privacy practices) required by December 23, 2024. However, the Texas court found that the rule unlawfully restricted state enforcement capabilities and redefined statutory terms without proper congressional authorization.
What was said
Judge Matthew J. Kacsmaryk wrote that while HIPAA gives HHS authority to regulate the protection of identifiable health information, it does not permit selective privacy protections based on policy goals like abortion access. He allowed the notice of privacy practices provision relating to substance use disorder records to remain in place but vacated the rest of the rule.
The court concluded that HHS had improperly attempted to preempt state public health laws, particularly those involving child abuse reporting, and had acted outside its statutory authority.
The big picture
The ruling returns HIPAA compliance requirements to their pre-2024 interpretation. Covered entities may disclose reproductive health information when allowed under HIPAA, such as in response to subpoenas or law enforcement requests, but are not obligated to do so. Providers and business associates must now tackle a mix of state laws, balancing HIPAA's discretionary disclosures with state-level requirements and protections.
FAQs
Does this ruling apply only to Texas, or is it nationwide?
Because the final rule was vacated in federal court, the ruling effectively blocks enforcement of the rule nationwide unless overturned on appeal.
What should HIPAA-covered entities do now?
Entities should review their pre-2024 HIPAA privacy policies and align them with both federal and current state law requirements, particularly in states with mandatory reporting statutes.
Can healthcare providers still refuse to disclose abortion-related information?
HIPAA allows but does not require disclosure of PHI for law enforcement. Providers may still decline to disclose if permitted under state law and organizational policy.
What legal authority did the court use to overturn the rule?
The court acted under the Administrative Procedure Act, which allows federal regulations to be vacated if found to exceed the agency’s statutory authority or violate federal law.
Farah Amod
