Privacy Rule Addressing Reproductive Health Vacated

On June 18, 2025, the amendment to the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule concerning reproductive protected health information was vacated.

Background

In April 2024, the Department of Health and Human Services (“HHS”) issued a final rule to strengthen the HIPAA Privacy Rule by prohibiting the use or disclosure of protected health information (“PHI”) to investigate or prosecute patients, providers, and others involved in the provision of legal reproductive health care, including abortion care (“rPHI”). The rule resulted from concerns that pregnant women who live in a state where elective abortion is illegal seeking an abortion in a state where elective abortion is legal may have their records sought for the purpose of conducting criminal, civil, or administrative investigations following the Supreme Court’s overturning of Roe v. Wade in the Dobbs case.

Purl v. HHS

An order out of a federal district court in Texas blocked the final rule on a nationwide basis.

The court ruled against the regulations based on the following:

1. HHS went further than HIPAA allows under standards set forth in the Loper Bright case and cannot restrict state rights to regulate abortion, as granted by the Dobbs decision. This is under the major questions doctrine which indicates that if an agency seeks to decide an issue of major national significance, its action must be supported by clear congressional authorization.
2. Defining “person” as excluding an unborn human conflicts with the Dictionary Act.
3. HIPAA cannot curtail state powers such as the power to create state child abuse and public health reporting laws.

It seems unlikely that HHS, under the current Administration, will appeal the decision.

Result

The Purl order immediately resets the compliance requirements for HIPAA-regulated entities, removing the additional protection HHS imposed on the sharing of rPHI. The general HIPAA Privacy Rule remains in effect. Under the general HIPAA privacy rules, a disclosure of PHI related to abortion without court order is prohibited, but that disclosure related to abortion with a court order does not require authorization.

Further Litigation

Texas has filed a separate lawsuit challenging the 2024 rPHI rule as well as the final 2000 rule, which is pending in federal court in Lubbock. Texas argues that the rule violates the Administrative Procedure Act (“APA”) which governs how federal agencies develop and issue regulations. HHS, in a court filing last month, said the Administration is evaluating its position in this case.

Employer Action

Plan Sponsors who amended their HIPAA privacy policies and any other HIPAA-related documents addressing rPHI should remove those references and note that law enforcement is not required to use the model attestation.