A Texas Court Vacated the HIPAA Reproductive Health Rule, and the Appeal Was Dropped

The 2024 Final Rule

On 26 April 2024 the Department of Health and Human Services published a final rule titled “HIPAA Privacy Rule To Support Reproductive Health Care Privacy,” at 89 FR 32976 under RIN 0945-AA20. It had been proposed a year earlier at 88 FR 23506.

The rule added a category of protection that the Privacy Rule had not previously drawn. It prohibited certain uses and disclosures of protected health information sought to investigate or impose liability on a person for seeking, obtaining, providing or facilitating lawful reproductive health care, added definitions including one of person, and required a new attestation before information potentially related to reproductive health care could be released for several categories of legal process.

The Attestation Requirement

The mechanism sat at a newly created section, 45 CFR 164.509. It provided that a covered entity or business associate may not use or disclose protected health information potentially related to reproductive health care for the purposes specified in 45 CFR 164.512(d), (e), (f) or (g)(1) — health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners — without first obtaining a valid attestation from the person requesting it.

A valid attestation had to identify the information sought and the persons involved, carry a clear statement that the use or disclosure was not for a prohibited purpose, include a statement that a person may face criminal penalties under 42 U.S.C. 1320d-6 for wrongfully obtaining or disclosing identifiable health information, and be signed and dated. It had to be in plain language, and it was defective if it omitted a required element, contained one that was not required, or if the entity had actual knowledge that material information in it was false.

In practical terms the section put a written, signed gate in front of a subpoena or a law enforcement request where the records touched reproductive health care.

The Vacatur Ruling

The rule was challenged in the Northern District of Texas, Amarillo Division, by a Texas physician and her clinic. On 18 June 2025, Judge Matthew J. Kacsmaryk granted the plaintiffs' motion for summary judgment in Purl v. United States Department of Health and Human Services, No. 2:24-cv-228-Z, in a 65-page memorandum opinion and order.

An unusual feature of the case is that the government largely stopped defending the rule. The opinion records that in their response to the plaintiffs' motion, the defendants wrote that “HHS's new leadership is currently reviewing the Rule, so Defendants do not further address the merits here,” and instead contested only standing and the scope of any relief. The court treated the merits arguments as waived, then considered them anyway.

What the Court Held

The opinion rests on three independent grounds.

• Conflict with 42 U.S.C. 1320d-7(b). That subsection provides that nothing in HIPAA shall be construed to invalidate or limit the authority, power or procedures established under any law providing for the reporting of disease or injury, child abuse, birth or death, public health surveillance, or public health investigation or intervention. The court held the 2024 Rule was not in accordance with it because it impedes, restrains or curtails potential child abuse reporting
• Unlawful redefinition of statutory terms. The court held the rule advanced definitions of person and public health contrary to statute, focusing on the rule's definition of a person as a natural person meaning a human being who is born alive, and its relationship to the Dictionary Act at 1 U.S.C. 8
• Excess of statutory authority. Invoking the major questions doctrine and West Virginia v. EPA, the court held HHS lacked authority to promulgate special protections for a particular, politically contested category of medical care, reasoning that HIPAA authorised protection for patient information generally rather than for selected procedures

On remedy, the court applied Fifth Circuit precedent holding that vacatur under 5 U.S.C. 706(2) is a remedy affecting individuals beyond the parties, citing Braidwood Management, Inc. v. Becerra, 104 F.4th 930 (5th Cir. 2024). It rejected the government's arguments for party-specific relief or remand without vacatur, while noting that the Supreme Court has yet to settle the scope-of-vacatur question.

What Survives the Vacatur

The order is not a clean sweep. Its operative paragraph vacates the 2024 Rule's modifications to 45 CFR parts 160 and 164 as promulgated at 89 FR 32976-33066, but severs and preserves the modifications to 45 CFR 164.520, the Notice of Privacy Practices section — except for paragraphs (b)(1)(ii)(F), (G) and (H), which are also vacated.

The reason is that HHS built a severability statement into the rule. At 89 FR 33048 the Department said the changes to the Notice of Privacy Practices requirements should remain in effect to the extent they are not directly related to a provision held invalid. Most of those changes had come from a separate rulemaking on substance use disorder patient records implementing section 3221(i) of the CARES Act, and had their own compliance deadline. The court found those severable, and the three excepted paragraphs not severable because they exist to describe the vacated provisions — (F) describes the prohibited uses and disclosures, and (G) describes the uses for which an attestation was required.

The Appeal Was Withdrawn

HHS did not appeal. An appeal was docketed in the Fifth Circuit as Purl v. HHS, No. 25-10743, taken by intervenors rather than by the government: the City of Columbus, Ohio, the City of Madison, Wisconsin, and Doctors for America. On 4 September 2025 those appellants filed an unopposed motion to dismiss the appeal under Federal Rule of Appellate Procedure 42, and on 10 September 2025 the clerk entered an order granting it.

With no appeal pending and no further rulemaking published, the district court's judgment stands.

The Text Is Still in the Code

One oddity is worth recording plainly, because a reader checking the regulations will run into it. As of the eCFR edition current to 28 August 2026, section 164.509 is still printed in title 45, carrying the source note “[89 FR 33063, Apr. 26, 2024].” Section 164.512(c)(3) still contains the rule of construction referring to the reproductive health care prohibition at 164.502(a)(5)(iii), and 45 CFR 164.520(b)(1)(ii)(F) and (G) — expressly vacated by the order — are still printed as well.

A search of the Federal Register under RIN 0945-AA20 returns two documents, the 2023 proposed rule and the 2024 final rule, and nothing removing either. So the published Code has not been conformed to the judgment. What legal effect the printed text retains after a vacatur is a question about the judgment rather than about the Code, and it is not one this record answers.

State Law Is on a Different Footing

The vacated rule operated on entities HIPAA already covers, restricting what they could hand over in response to legal process. The state consumer health data statutes that have appeared since 2023 do something structurally different: they reach companies HIPAA does not, and they generally exclude information already regulated as protected health information. Nothing in Purl touches them, because they do not rest on HIPAA's authority.

The practical consequence of the vacatur is therefore narrow but specific. It removed a federal attestation gate that had applied to HIPAA-covered entities responding to subpoenas, law enforcement requests and health oversight demands. The rest of the Privacy Rule's ordinary limits on those disclosures, which predate the 2024 rule, were not before the court.

Frequently Asked Questions