On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated most of the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy (“Reproductive Health Rule”) in Purl v. HHS. This decision removes national-level restrictions on disclosing protected health information (PHI) for law enforcement purposes related to reproductive health. However, the Supreme Court may soon limit the ruling’s reach.
Key Takeaways for Employers and HIPAA-Covered Entities
- Vacated Provisions. The court struck down the Reproductive Health Rule’s limitations on disclosing PHI for reproductive health-related criminal and civil investigations. It also nullified the requirement that requestors of such PHI attest their purpose was not related to reproductive health enforcement.
- Core HIPAA Rules Remain in Force. HIPAA’s original Privacy Rule still governs permissible uses and disclosures of PHI, including for treatment, payment, and healthcare operations. Additionally, changes related to substance use disorder disclosures under the CARES Act remain in effect.
- Policy Revisions and Training Required. Covered entities should:
- Review and update HIPAA policies and notice materials.
- Audit existing workflows involving PHI attestation and disclosures.
- Communicate policy changes to staff and business associates.
- Retrain teams handling subpoenas or legal requests involving PHI.
- State Law May Still Impose Stricter Protections. HIPAA does not preempt more stringent state-level privacy laws. Employers must ensure their practices comply with applicable state laws governing reproductive health data disclosures.
SCOTUS Decision May Narrow Nationwide Impact
Of note, on June 27, 2025, the U.S. Supreme Court issued its ruling in Trump v. CASA, Inc., holding that universal injunctions likely exceed the equitable powers granted to federal courts. This ruling casts doubt on the nationwide application of the Texas court’s vacatur and may limit its effect to the plaintiffs in Purl v. HHS.
Employers should be aware that the regulatory landscape remains fluid. The Department of Health and Human Services (HHS) is expected to review the decision and announce the next steps.
Next Steps for Employers
To ensure compliance, HIPAA-covered employers should:
- Audit Current Practices: Reassess any reliance on the 2024 Reproductive Health Rule provisions and determine necessary updates in policies, workflows, and training.
- Monitor State Laws: Stay informed about state-specific reproductive health data privacy protections that may still apply.
- Stay Updated on Federal Developments: Watch for guidance from HHS in response to the Supreme Court’s ruling in CASA.
HR Works will continue to monitor this topic and provide updates as more information is made available.
