On June 18, 2025, a Texas federal court struck down a 2024 Department of Health and Human Services (HHS) Rule that created special protections for reproductive health care information under the Health Insurance Portability and Accountability Act (HIPAA). As a result of the decision in Purl v. HHS, effective June 18, 2025, HIPAA-regulated entities across the nation are no longer required to comply with the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (RHC Rule) and its particular requirements related to reproductive health care information. The court’s decision is grounded in three major findings: (1) the RHC Rule is contrary to law because it unlawfully limits state child abuse reporting laws; (2) HHS exceeded its statutory authority by impermissibly defining “person” and “public health”; and (3) HHS did not have congressional authorization to create special protections to reproductive health care information.
Background
The RHC Rule was published on April 26, 2024 as a response to the Supreme Court’s decision in Dobbs v. Jackson’s Women’s Health Organization. It prohibited HIPAA-regulated entities from disclosing reproductive health care information when the purpose of the request for such information was to investigate or impose liability for lawful reproductive health care services. As part of the RHC Rule, HHS added and updated several definitions in HIPAA, including adding a definition of “person” to mean “a human being who is born alive.” The RHC Rule also required HIPAA-regulated entities to obtain attestations from requestors of reproductive health care information attesting that they were not requesting the information for a prohibited purpose.
Dr. Carmen Purl and her practice filed a complaint against HHS in September 2024, claiming that the RHC Rule prevented her from complying with Texas law mandating child abuse reporting. Purl was granted injunctive relief in November 2024, preventing HHS from enforcing the RHC Rule against her and her practice.
In this most recent ruling, the Purl court vacated the RHC Rule, resulting in a nationwide effect.
Opinion
Contrary to law
In its analysis, the court relied heavily on the HIPAA statute deeming that nothing in the HIPAA regulations could be interpreted in a manner that invalidates or limits child abuse reporting requirements under state law. The court reasoned that the RHC Rule placed impermissible restrictions on state authority by requiring HIPAA-regulated entities to assess the legality of reproductive health care before disclosing information, redact such information from disclosures, and obtain attestations from requestors.
Unlawful redefinition of statutory terms
The court also took issue with HHS’s establishment of definitions of “person” and “public health” under the RHC Rule. First, the court concluded that HHS unlawfully redefined the term “person” under the RHC Rule in a manner that conflicted with the existing definition under the Dictionary Act. Second, the court concluded that HHS lacked congressional authority to apply restrictions to the meaning of “public health” under HIPAA, unlawfully redefining the term under the RHC Rule.
Excess of statutory authority
Finally, the court applied the major questions doctrine to the RHC Rule, concluding that the HIPAA statute did not provide clear congressional authorization for HHS to create special protections for reproductive health care information.
Implications
As of June 18, 2025, HIPAA-regulated entities are no longer required to comply with the RHC Rule and its particular requirements for reproductive health care information. However, the ruling does not impact other HIPAA regulations as they existed before the RHC Rule. HIPAA-regulated entities must still safeguard protected health information (PHI) and limit disclosures to those explicitly permitted by the HIPAA Privacy Rule or authorized by the individual. HIPAA-regulated entities should remember, too, that HIPAA is a permission-based law – the HIPAA Privacy Rule states when disclosing PHI to third parties “may” be permissible but does not expressly mandate disclosures to third parties, other than HHS to assess HIPAA compliance.
Finally, as the legal landscape continues to evolve, HIPAA-regulated entities will need to closely monitor and adapt to these developments. While it remains to be seen whether the current Administration’s Department of Justice will appeal the Purl decision, other changes in law could impact the ruling. For example, the Supreme Court recently heard arguments related to the enforceability of nationwide injunctions in Casa v. Trump. While the Texas court recognized this, it concluded that it must follow its own precedent for the time being and nationally vacate the RHC Rule. It also remains unclear how individual states may respond or whether certain states may pass their own laws similar to the RHC Rule.
Stay tuned for further updates as the ramifications of the Purl ruling unfold.
If you have any questions, or would like additional information, please contact one of the attorneys on our Health Care team.
You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.