On June 18, 2025, the U.S. District Court for the Northern District of Texas issued a ruling that vacates most provisions of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, a rule finalized in April 2024 and with a compliance date of December 23, 2024. The rule was designed to strengthen privacy protections for reproductive health information, but its legal future is now uncertain.
The case, Carmen Purl, et al. v. U.S. Department of Health and Human Services, challenged the rule on several grounds. The court declared large portions of the rule unlawful, including specific updates to the Notice of Privacy Practices (NPP), namely sections 164.520(b)(1)(ii)(F), (G), and (H).
However, covered entities and business associates still must revise their NPPs to include:
- A description of new privacy protections for Substance Use Disorder (SUD) patient records
- A statement explaining the potential redisclosure of Protected Health Information (PHI)
These changes reflect broader efforts to align HIPAA with existing protections under 42 CFR Part 2 and other regulations.
Now What?
With most of the reproductive health privacy protections now eliminated at the federal level, healthcare providers, health plan sponsors, and business associates must continue to comply with HIPAA Privacy Rules and stay informed about state-level laws, which may offer additional protections for reproductive health data. The court’s decision may prompt more states to step in with their own privacy measures.
HHS has stated that it will review the ruling and determine next steps. As that process unfolds, Medcom Benefit Solutions will continue to monitor developments and provide updates to help ensure our clients remain compliant.
Looking to stay ahead on HIPAA compliance? Medcom offers On-Demand HIPAA Privacy & Security Training, designed to fit your schedule with expert-led content and flexible support options. Sign up or learn more about Medcom’s HIPAA Privacy & Security training via Thinkific.
Resources: Larry Grudzien.
