Northern District of Texas Vacates Most of HHS “Reproductive Health Privacy” HIPAA Rule, by Abbye Alexander, Esq., Christopher Tellner, Esq., and Henry Norwood, Esq., 7-8-2025

The U.S. District Court for the Northern District of Texas recently issued an order vacating nearly all of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, a Final Rule issued by HHS in April 2024.

The June 18th, 2025, order effectively nullifies the rule’s provisions, which were intended to enhance privacy protections for reproductive health care-related information.

The order arose from litigation in Purl, M.D. et al. v. United States Department of Health and Human Services et al), a case contesting the 2024 Final Rule enacted under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Plaintiffs in the Purl case successfully argued the rule violated the Administrative Procedure Act and exceeded the U.S. Department of Health and Human Services (HHS) statutory authority.

Among changes, the order vacated the amendments that:

• Defined “reproductive health care” expansively encompassing services such as abortion, contraception, IVF, gender-affirming care.
• Imposed attestation requirements on covered entities before they disclosed protected health information (PHI) potentially related to reproductive health care affirming that PHI will not be used or disclosed for a prohibited purpose.
• Limited disclosures intended to investigate or penalize individuals for seeking reproductive health services.

Remains in effect:

• Amendments related to Notice of Privacy Practices (NPP) for substance use disorder (SUD) records, including an updated model NPP. Covered entities must update their NPPs by February 16, 2026, to adhere to the regulation related to Part 2’s SUD information requirements.

Nationwide Implications

Although initiated by a case involving a Texas clinic, the Northern District of Texas’ decision applies nationwide. The Northern District of Texas is the only court to weigh in on the issue at this time and guidance from HHS following the decision is still pending.

Core HIPAA Privacy, Security, and Breach Notification Rules still remain fully enforceable, and SUD-related NPP changes remain mandatory. Additionally, entities must still adhere to existing state confidentiality laws, which may have even stricter protections for reproductive health data.

Next Steps to Consider

Policy Revision

• Update internal PHI policies and Business Associate Agreements (BAAs) to reflect restored disclosure norms—remove attestation language and “reproductive health” restrictions.

Notice of Privacy Practices

• Remove reproductive health amendments from NPPs, while retaining SUD provisions.

Training & Compliance

• Retrain applicable workers on pre‑2024 HIPAA rules, while reinforcing SUD confidentiality and existing HIPAA fundamentals.

Monitor Ongoing Legal Developments

• Monitor HHS’ website for guidance regarding the Purl decision and potential new requirements under HIPAA.
• Monitor other federal court decisions regarding the Reproductive Health rue and the Purl

Conclusion

Covered entities should consider promptly adjusting their HIPAA compliance frameworks to comply with the recent court order. Vigilance is essential as HHS provides updated guidance and new legal developments unfold at both federal and state levels. Kaufman Dolowich will continue to monitor developments.

Authors: Abbye Alexander and Christopher Tellner, Co-Chairs of the Health Care/Managed Care Practice Group and Of Counsel Henry Norwood.