- within Food, Drugs, Healthcare and Life Sciences topic(s)
- in United States
- with readers working within the Healthcare industries
- within Food, Drugs, Healthcare and Life Sciences topic(s)
In 2024, the U.S. Department of Health and Human Services' ("HHS") implemented a new privacy rule under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") that applied specifically to reproductive health information (the "2024 Rule"). On June 18, 2025, Judge Matthew J. Kacsmaryk of the U.S. District Court for the Northern District of Texas issued an opinion largely vacating the 2024 Rule. The decision in Purl v. U.S. Department of Health and Human Services nullifies the 2024 Rule, except for technical provisions unrelated to reproductive health information.
Judge Kacsmaryk held that HHS exceeded its statutory authority when it created "special protections for medical information produced by politically favored medical procedures..." without a clear congressional mandate. Relying on the major questions doctrine and principles of federalism, the opinion concludes that HIPAA does not authorize HHS to distinguish among categories of protected health information to advance policy goals. The court further found that the 2024 Rule impermissibly: limited state public health and child abuse reporting laws; redefined the terms "person" (to exclude unborn humans) and "public health"; required an attestation prior to the release of certain information; and forced HIPAA covered entities to ascertain the lawfulness of the reproductive services provided before responding to information requests (an obligation Judge Kacsmaryk deemed unworkable).
Because the court vacated the 2024 Rule based on the Administrative Procedure Act, the HIPAA framework in place prior to the 2024 Rule is back in effect. Under that framework, disclosures of protected health information for law enforcement and public health purposes are permissible, but not mandatory (without the need for an attestation regarding how the information will be used), subject to the existing HIPAA Privacy Rule conditions and any state law protections more stringent than HIPAA.
Judge Kacsmaryk's ruling is effective nationwide, but HHS could seek a stay or pursue an appeal to the Fifth Circuit.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
