Last year, on June 25, 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published an extensive Final Rule amending the Health Insurance Portability and Accountability Act (HIPAA) privacy rule, providing new protections for reproductive health information (RHI) privacy. This Final Rule was penned in the attempt to balance state autonomy with HIPAA’s objectives of maintaining health information privacy for individuals by prohibiting the use or disclosure of protected health information (PHI) for certain activities such as criminal investigations against individuals for seeking, obtaining, providing, or facilitating lawful reproductive healthcare. This also included the requirement to obtain a signed attestation before using or disclosing any PHI potentially related to RHI.
Compliance was required by December 23, 2024, except for the notice of privacy practices (NPP) provisions, which were required by February 16, 2026. Among other things, we previously recommended medical professionals’ compliance with the Final Rule by familiarizing themselves with the rule, training staff, updating HIPAA policies, and drafting attestations for completion with all PHI requests that could potentially contain RHI. More information on the 2024 Final Rule can be read here.
Well, compliance was required. Last week on June 18, 2025, U.S. District Judge Matthew J. Kacsmaryk for the Northern District of Texas vacated portions of the 2024 Final Rule for multiple reasons, ruling that was “contrary to law” as it illegally preempts or limits “more stringent” state public health-information laws. In such cases, the courts have the power to set aside unlawful agency actions.
Why Did Dr. Purl Sue?
Plaintiffs Family Practice Physician Carmen Purl, MD and her clinic, sued, stating that the 2024 Rule was “arbitrary and capricious” and impaired her state-mandated obligation to report child abuse or participate in public health investigations. As an aside, Dr. Purl was not the only one who sued HHS over the Final Rule – at least 15 different states were embroiled in lawsuits generally arguing that the Rule impedes the ability to gather information related to serious misconduct like child and elder abuse, as well as Medicare fraud. The Texas suit took it further, by not only arguing that the updated HIPAA Rule be vacated but also alleged that HHS exceeded its authority.
What Happened?
First, the government argued, among other things, that the Final Rule did not interfere with Dr. Purl’s or her staff’s ability to report abuse and therefore lacked standing, or the ability to sue in this case. Dr. Purl responded that she had “increased regulatory burdens” – interestingly, the very recommendations we previously mentioned for compliance with the new Rule, including the Plaintiffs’ education regarding the updated Rule, training employees, updating the clinic’s policies, and business associate agreements (BAAs). The Court believed that compliance with these recommendations constitutes an ”injury” and thus the Plaintiffs had standing and could sue.
The government maintained its position that physicians and providers’ ability to report abuse would not be hampered under the Final Rule. The Plaintiffs disagreed, stating that the Rule imposed layers of “incomprehensible standards,” functionally limited reporting and abuse. Specifically, in instances when medical professionals are forced into situations where they need to interpret legal situations and/or situations (that even the Supreme Court could not agree with) in which they could be prohibited from making disclosures. The Court also considered Plaintiff’s arguments that HIPAA (1) cannot preempt specific state laws regarding reporting fraud and abuse, nor (2) invalidate the public health exception, which prohibits HIPAA regulations from limiting public-health related goals. Judge Kacsmaryk also did not believe HIPAA had any authority to shield “political ends like protecting access to abortion and gender-transition procedures.”
Takeaways: What Now?
We note that not all of the Final Rule’s changes were affected; for example, compliance with the remaining NPP modifications related to Part 2 information (i.e., HIPAA protections for substance use disorder treatment records) is still required by February 16, 2026. Additionally:
- Portions of the Rule that were vacated will not be completely final until HHS exhausts its appeals.
- For now, medical professionals do not need to obtain attestations under the rule.
- As a result of the ruling, covered entities and business associates should revisit and consider revising policies, procedures, training programs, business associate agreements, and notices of privacy practices that were updated to comply with the now-vacated rule.
- Despite the vacatur, the HIPAA Privacy Rule continues to protect RHI, and enforcement actions for impermissible disclosures of such information remain possible under the existing HIPAA framework. In December 2024, before the Final Rule was effective, OCR entered into its first settlement against a health care provider centered around, and specific to, an impermissible disclosure of an individual’s RHI. This demonstrates that OCR considers RHI highly sensitive and will take enforcement action accordingly under the HIPAA Privacy Rule as it currently stands.
This blog post was drafted by Christine Chasse, an attorney in the Plano, Texas, office of Spencer Fane. For more information, visit www.spencerfane.com.
Click here to subscribe to Spencer Fane communications to ensure you receive timely updates like this directly in your inbox.
