On June 18, 2025, the U.S. District Court for the Northern District of Texas issued an order declaring unlawful and vacating provisions of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “Reproductive Health Rule”). The ruling applies nationwide. The decision did not affect amendments to the Notice of Privacy Practices requirements related to Part 2 substance use disorder regulations, which are still set to take effect on February 16, 2026.

The Reproductive Health Rule, published in April 2024, amended the HIPAA Privacy Rule to introduce additional protections for protected health information (“PHI”) related to reproductive heath care. The Rule prohibited HIPAA-regulated entities from disclosing PHI to persons involved in conducting criminal, civil, or administrative investigations into individuals for seeking or obtaining lawful reproductive health care, unless specific conditions were met. Namely, if a regulated entity received a request for medical records that might contain PHI potentially related to reproductive health care, and if those records were being sought in connection with certain activities, then the regulated entity was required to obtain a written attestation from the requestor, certifying that the PHI would not be used or disclosed for a purpose prohibited by the Reproductive Health Rule.

In the recently decided case, Carmen Purl, et al. v. U.S. Department of Health and Human Services, et al., No. 2:24-cv-00228-Z (N.D. Tex. June 18, 2025), plaintiffs Dr. Carmen Purl and her medical clinic argued that the U.S. Department of Health and Human Services (“HHS”) exceeded its statutory authority by issuing the Reproductive Health Rule and that the Rule interfered with state-mandated reporting obligations, particularly in the context of child abuse investigations. The Texas court ruled in favor of the plaintiffs, finding that the Reproductive Health Rule unlawfully limits state public health laws, impermissibly redefined the terms “person” and “public health” in violation of Federal law and in excess of statutory authority, and that the rule was adopted without authority expressly delegated by Congress. As such, the court vacated the Reproductive Health Rule, allowing only those amendments at 45 C.F.R. § 164.520 that relate to substance use disorder records to remain in place.

The ruling vacates the Reproductive Health Rule nationwide, effectively nullifying the enhanced privacy protections it provided. As a result, HIPAA-regulated entities are no longer subject to the Rule’s prohibition and attestation requirements, and may revert to their HIPAA policies and procedures in effect prior to the enactment of the Reproductive Health Rule.

To be clear, HIPAA does not require—and has never required—that health care providers disclose patients’ PHI in connection with investigations into lawful reproductive health care. As HHS previously confirmed following the Dobbs v. Jackson Women’s Health Organization decision, the Privacy Rule permits, but does not compel, the disclosure of PHI for law enforcement purposes. Regulated entities must, however, comply with the mandatory reporting and health care privacy laws of the state in which they operate.

In a June 20th statement published on its official website, HHS confirmed that regulated entities must still comply with the amended notice of privacy practices requirements by February 16, 2026, but indicated that it will determine “next steps” following a through review of the court’s decision.

Koley Jessen will continue to monitor further developments regarding the Reproductive Health Rule. If you have questions about the impact this decision may have on your organization or current HIPAA obligations please contact a member of Koley Jessen’s Health Law practice group.

_{This content is made available for educational purposes only and to give you general information and a general understanding of the law, not to provide specific legal advice. By using this content, you understand there is no attorney-client relationship between you and the publisher. The content should not be used as a substitute for competent legal advice from a licensed professional attorney in your state.}