On June 18, 2025, the U.S. District Court for the Northern District of Texas issued a decision in Carmen Purl, et al. v. United States Department of Health and Human Services, et al., vacating nearly all of the 2024 HIPAA Privacy Rule amendments concerning privacy protections for reproductive protected health information held by a HIPAA-covered entity or its business associates. The court found that the Department of Health and Human Services (HHS) exceeded its statutory authority by restricting disclosures related to reproductive healthcare as well as redefining statutory terms including “person” and “public health.” The decision has immediate and nationwide effect, eliminating the 2024 Privacy Rule’s requirement for covered entities to revisit their privacy practices and Notices of Privacy Practices (NPPs). HHS may appeal within 60 days of the decision.
Background: the 2024 HIPAA Reproductive Health Privacy Rule
HHS issued the 2024 Final Rule to bolster privacy protections for reproductive health information. The rule was set to be effective on June 25, 2024, and with a compliance deadline for NPP-related changes of February 16, 2026. The rule sought to:
- Prohibit the use or disclosure of protected health information (PHI) for the investigation or imposition of liability related to lawful reproductive healthcare (including abortion, contraception, IVF, and gender-affirming care).
- Require covered entities to obtain attestations from requestors that PHI would not be used for prohibited purposes.
- Redefine “reproductive healthcare,” “person,” and “public health” for purposes of HIPAA compliance.
- Mandate revisions to NPPs to reflect these new protections.
Factual and procedural history of Purl v. HHS
Plaintiffs challenged the 2024 rule, arguing it unlawfully interfered with state-mandated legal obligations to report child abuse and cooperate with public health investigations. Plaintiffs contended that the rule’s new definitions and special protections for reproductive health information exceeded HHS’s statutory authority granted by Congress in HIPAA and conflicted with state legal mandates.
The district court agreed, holding that:
- Contrary to law: The rule unlawfully limited state public health and child abuse reporting laws, violating HIPAA’s express provision that federal privacy rules cannot “invalidate or limit” such state laws (42 U.S.C. § 1320d-7(b)).
- Redefinition of statutory terms: HHS’s definitions of “person” (excluding unborn children) and “public health” were inconsistent with federal law and improperly curtailed states’ ability to investigate or report certain conduct.
- Major questions doctrine: The rule addressed matters of great political significance (abortion, gender-affirming care) without clear congressional authorization, intruding upon areas reserved to the states. HIPAA authorizes the protection of health information generally, but HIPAA does not permit HHS to create special protections for politically sensitive procedures absent clear statutory language granting such authority.
The ruling vacates all of the 2024 HIPAA Privacy Rule amendments concerning reproductive health privacy, including the prohibitions on certain uses and disclosures of PHI related to lawful reproductive healthcare, and specifically including the Notice of Privacy Practices (NPP) disclosure requirements. However, other unrelated NPP requirements—such as those addressing substance use disorder (SUD) records—were not affected and remain in effect, with the compliance deadline of February 16, 2026.
Implications for Notices of Privacy Practices (NPPs)
- Reproductive health provisions vacated: Covered entities that have already updated their NPPs to incorporate the 2024 rule’s reproductive health provisions should now remove those disclosures and revert to the prior NPP language. The district court’s decision likely constitutes a “material change” under HIPAA and triggers a requirement to redistribute the revised NPP within 60 days.
- Other NPP modifications survive: All other NPP modifications contained in the 2024 rule unrelated to reproductive health remain in effect, and covered entities must comply with these by the February 2026 deadline.
Continued compliance with state law
While the federal reproductive health privacy protections have been vacated, covered entities remain subject to any applicable state privacy and consumer protection laws. Many states impose additional or more stringent requirements regarding reproductive health information, and the Purl decision does not relieve entities of these obligations.
Nationwide effect of the ruling
Although the Supreme Court’s recent decision in Trump v. CASA limited the use of nationwide injunctions, the district court’s vacatur in Purl continues to have nationwide effect. The CASA decision addressed executive orders and the judiciary’s authority to issue nationwide injunctions but expressly declined to resolve whether courts may set aside or universally vacate agency rules under the Administrative Procedure Act (APA). As a result, the Fifth Circuit’s approach—treating vacatur as the default remedy for unlawful agency action—remains in force, and the Purl decision nullifies the reproductive health portions of the 2024 rule nationwide unless and until reversed on appeal.
What this means for you: next steps for covered entities
- Review and revise NPPs: If your organization updated its NPP to reflect the 2024 rule’s reproductive health protections, promptly revert to the pre-2024 language and redistribute the NPP within 60 days of the Purl decision, by August 17, 2025.
- Monitor for appeals or further guidance: While an appeal is possible, it is considered unlikely at this time. Continue to monitor for HHS or judicial updates.
- Comply with remaining HIPAA obligations: The original HIPAA Privacy Rule remains in effect, including its general requirements for PHI disclosure and state law preemption provisions. State law requirements may still impose additional or more stringent privacy obligations.
- Prepare for February 16, 2026: Covered entities must implement the remaining, non-vacated NPP changes (such as those for SUD records) by this date.
Contact us
For further assistance with HIPAA compliance or to discuss how these developments may impact you, please contact a member of our Healthcare Regulatory or Employee Benefits teams.