Compliance
A Texas Court Ruling and the Effects on the 2024 HIPAA Privacy Rule
In the wake of heightened concerns around reproductive health rights and data privacy, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has completed a major update to the HIPAA Privacy Rule. This Final Rule, issued in April 2024, aims to better protect patients’ reproductive health care information, especially in an era where legal access to care varies by state.
A prominent court case has challenged and vacated most of the amendments to the 2024 Final Rule.
This blog outlines the key provisions that remain in the Final Rule, the nationwide changes it introduces, what these changes mean for patients and healthcare providers, the new protections established, and what future updates may be expected.
Why This Rule Was Originally Issued
Following the Supreme Court’s decision by Dobbs v. Jackson Women’s Health Organization, states now have different laws regarding abortion and reproductive health, raising concerns about the privacy of medical records, especially for those seeking care across state lines. To address whether health information could be used legally against patients obtaining care elsewhere, the Office for Civil Rights issued a Final Rule to strengthen HIPAA. This rule restricts disclosure of reproductive health data in legal or investigative contexts, enhancing protection for patients, and providing clearer guidelines for providers.
The key protections of the Final Rule included:
- New restrictions on disclosing reproduction health information
- Presumption of lawfulness
- Required attestations for disclosures for law enforcement, court orders, or agency investigations
Legal Challenges to the Final Rule
Texas Case (Carmen Purl et al. v. HHS)
On June 18, 2025, the U.S. District Court for the Northern District of Texas issued a ruling in Carmen Purl et al. v. U.S. Department of Health and Human Services, overturning the majority of the HIPAA Privacy Rule provisions intended to protect reproductive health care information. Dr. Carmen Purl and her clinic sued HHS on the grounds that the new ruling limited the provider’s ability to report child abuse obligations.
The Texas court’s decision to vacate the rule nationwide has raised questions about the scope of judicial authority and federal preemption. When the Texas court vacated the federal rule, the implications were broad because it affects how the rule is enforced nationwide. The court ruled that the 2024 final rule is invalid because it conflicts with state laws, impressible definitions (to include “person” and “public health”), and due to the Rule’s regulation of politically significant issues.
The Department of Health and Human Services (HHS) announced its intention to thoroughly review the decision and determine whether to pursue an appeal by August 18, 2025. However, on September 10, 2025, the motion to appeal was dismissed.
Nevertheless, the court upheld modifications pertaining to the Notice of Privacy Practices (NPP). Health care organizations are still required to comply with the revised NPP standards by February 16, 2026.
Summary of Rule Changes
| Provision | Status |
| Restrictions on reproductive health disclosures | Vacated |
| Attestation requirements | Vacated |
| Notice of Privacy Practices (NPP) updates | Still required (by Feb 16, 2026) |
Changes to HIPAA Notices of Privacy Practices (NPP) (Still in effect)
HIPAA-covered entities must update their Notice of Privacy Practices (NPP) to reflect these new reproductive health protections. This notice is the document patients often receive on their first visit, outlining how their health information is used and protected.
The updated NPPs must be in place by February 16, 2026, and include clear information about:
- The prohibition on certain disclosures
- Patients' rights related to reproductive health care information
What Health Care Organizations Must Do
Considering ongoing legal uncertainty, health care providers and insurers have several tasks to address. Key areas of focus include:
- Updating privacy notices to meet the 2026 deadline
- Reviewing policies related to ensuring alignment with the current regulatory requirements and in compliance with preemptive state laws
- Update training programs and learning materials to reflect operational changes
With federal protections vacated, state laws now largely govern reproductive health privacy. Organizations should consult local counsel to ensure compliance with applicable state regulations.
What This Means for Patients
If you're a patient, this rule is about reclaiming control of your private health information.
- You should expect clearer privacy notices from your provider.
- Even if court decisions have limited protection, the push for stronger privacy rights in reproductive care is still advancing.
Regardless of the litigation’s final outcome, the focus on reproductive health privacy has set a precedent for broader discussions about patient data, interstate healthcare, and the future of HIPAA modernization.
Here’s the call: Update NPPs by Feb 16, 2026. Monitor legal developments. Review policies for state law alignment.