Texas Federal Court Strikes Down HHS’ HIPAA Reproductive Health Rule; Upholds Requirement to Update Notice of Privacy Practices Related to Substance Use Disorder Records
June 24, 2025
On June 18, 2025, in Purl v. United States Department of Health and Human Services, the United States District Court for the Northern District of Texas (the “Court”) struck down the Department of Health and Human Services’ (“HHS”) HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “2024 Rule”), finding that the 2024 Rule was contrary to law because it unlawfully limits state public health laws, impermissibly redefines “person” and “public health” contrary to statute, and otherwise exceeds the authority delegated by Congress.
Takeaways
Healthcare providers no longer need to comply with the 2024 Rule as it relates to reproductive healthcare information:
- Healthcare providers are no longer obligated to obtain attestations when they receive requests for health oversight, judicial or administrative proceedings, law enforcement, or disclosures regarding decedents.
- To the extent healthcare providers updated their HIPAA policies and procedures to incorporate the new definitions related to reproductive healthcare information and attestations, healthcare providers can revert back to their prior policies and procedures.
- Healthcare providers must continue to ensure that uses and disclosures of health information comply with HIPAA regulations.
- To the extent healthcare providers have updated their Notices of Privacy Practices, they can remove the language regarding reproductive healthcare information. The new language regarding substance use disorder should remain in the Notices of Privacy Practices.
- To the extent healthcare providers have not yet updated their Notices of Privacy Practices, they will need to complete the update for substance use disorder no later than Feb. 16, 2026, as outlined below.
Background: 2024 Rule
In response to the United States Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, 597 U.S. 215 (2022), the Biden administration’s HHS amended the HIPAA Privacy Rule to limit the circumstances under which an individual’s reproductive healthcare information could be used or disclosed for certain non-healthcare purposes. Specifically, the 2024 Rule prohibited uses and disclosures of reproductive healthcare information “to conduct a criminal, civil, or administrative investigation into or to impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive healthcare, or to identify any person to initiate such activities.” 89 Fed. Reg. 32989. For certain disclosures (health oversight, judicial or administrative proceedings, law enforcement, or disclosures regarding decedents), the 2024 Rule required healthcare providers to obtain a signed attestation from the requestor attesting to the fact that the information would not be used for a prohibited purpose. 89 Fed. Reg 33027-33040. Additionally, healthcare providers were required to update their HIPAA Notice of Privacy Practices to support reproductive healthcare privacy. 89 Fed. Reg. 33045- 33048. The 2024 Rule also required healthcare providers to train their workforce on the new requirements.
The compliance deadline was Dec. 23, 2024, except for updates to the Notice of Privacy Practices, which had a deadline of Feb. 16, 2026. Since promulgation, the 2024 Rule has caused compliance concerns for healthcare providers related to policy updates, training, and obtaining attestations. Healthcare providers have faced significant pushback from state auditing agencies and state departments of health in executing attestations. In some cases, the Centers for Medicare and Medicaid Services (“CMS”) health oversight capacity staff have refused to sign attestations. These challenges have placed healthcare providers in the difficult position of potentially violating HIPAA or giving auditors and surveyors access to protected health information that may contain reproductive healthcare information in order to pass surveys and maintain licensure.
The 2024 Rule was published in 89 Fed. Reg. 32976 and is available here.
Further Background: Purl Decision
In Purl, the plaintiff physician advanced three primary arguments:
- The 2024 Rule “unlawfully limits disclosures about abuse and public health to state authorities,” impeding her ability to report suspected child abuse.
- The 2024 Rule was contrary to law because it redefined “person” and “public health.”
- The 2024 Rule exceeded statutory authority because it used HIPAA to impose “special rules for abortion.”
The plaintiff prevailed on all three arguments. Notably, defendant HHS did not respond to the merits of the plaintiff’s arguments in its response brief: “HHS’s new leadership is currently reviewing the Rule, so Defendants do not further address the merits here.” HHS only challenged the plaintiff’s standing and scope of potential relief. However, HHS did present merit arguments in support of the defendant’s motion for summary judgment, so the Court elected to consider those arguments as part of the Court’s decision.
In vacating the 2024 Rule, the Court relied upon the Administrative Procedures Act (“APA”), which is the framework for judicial review of federal agency action, and the recent United States Supreme Court decision in Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), where the Supreme Court held that “[f]ederal agencies cannot ‘exercise powers reserved to another branch of Government.’” The Court also relied upon precedent from the U.S. Court of Appeals for the Fifth Circuit supporting the ability of courts to vacate unlawful federal agency action and that “[v]acatur ‘has nationwide effect, is not party-restricted, and affects persons in all judicial districts.’”
HHS argued that if vacatur was the appropriate remedy, then the Court should “sever and preserve” the lawful provisions. In so arguing, HHS zeroed in on one key provision – the requirement to update the Notice of Privacy Practices related to substance use disorder records. The update was proposed as part of the Confidentiality of Substance Use Disorder (SUD) Patient Records, 87 Fed. Reg. 74216, available here. The Court agreed.
Pursuant to the 2024 Rule, the implementation specifications and separate statement requirements for Notices of Privacy Practices were updated to require all covered entities (not just covered entities that are substance use disorder providers) to include:
- A statement addressing any prohibition or material limitation by other applicable law, such as the substance use disorder regulations promulgated in 42 C.F.R. Part 2, which may invoke a more stringent use or disclosure obligation than otherwise permitted under HIPAA. The description must contain sufficient detail for the individual to be put on notice of the uses and disclosures that are permitted or required under HIPAA and other applicable law, such as 42 C.F.R. Part 2.
- A statement that substance use disorder treatment records received from programs subject to 42 C.F.R. Part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided in 42 C.F.R. Part 2.
- A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed.
- A statement that if a covered entity creates or maintains records subject to 42 C.F.R. Part 2 and intends to use or disclose such records for fundraising for the benefit of the covered entity, the individual must first be provided with a clear and conspicuous opportunity to elect not to receive any fundraising communications.
For More Information
If you have questions or want more information regarding compliance with this update, contact your legal counsel. If you do not have regular counsel for such matters, Foulston Siefkin LLP would welcome the opportunity to work with you to meet your specific needs. For more information, contact Brooke Bennett Aziere at 316.291.9768 or baziere@foulston.com or Amanda M. Wilwert at 913.253.2181 or awilwert@foulston.com. For more information on the firm, please visit our website at www.foulston.com.
Established in 1919, Foulston Siefkin is the largest Kansas-based law firm. With offices in Wichita, Kansas City, and Topeka, Foulston provides a full range of legal services to clients in the areas of administrative & regulatory; antitrust & trade regulation; appellate law; banking & financial services; business & corporate; construction; creditors’ rights & bankruptcy; e-commerce; education & public entity; elder law; employee benefits & ERISA; employment & labor; energy; environmental; ERISA litigation; estate planning & probate; family business enterprise; franchise & distribution; government investigations & white collar defense; governmental liability; government relations & public policy; healthcare; immigration; insurance regulatory; intellectual property; litigation & disputes; long-term care; mediation/dispute resolution; mergers & acquisitions; oil, gas & minerals; OSHA; privacy & data security; private equity & venture capital; product liability; professional malpractice; real estate; renewable energy, storage, and transmission; securities & corporate finance; startup/entrepreneurship; supply chain management; tax-exempt organizations; taxation; trade secret & noncompete litigation; and water rights.
Additional Resources
Sign up to receive Foulston's issue alerts straight to your inbox here.
Get to know Brooke Bennett Aziere