On June 18, 2025, a federal court in the Northern District of Texas ordered that the 2024 HIPAA Privacy Rule to Support Reproductive Healthcare Privacy be vacated. This is the latest order in the Purl v. HHS case, which was the subject of an article in the February 11, 2025, edition of Compliance Corner.
Background
In this case, the plaintiffs are a doctor and her clinic. They argued that the rule will impair their ability to report child abuse or participate in public health investigations and that HHS violated the federal Administrative Procedures Act by acting in an arbitrary and capricious manner when the agency promulgated the rule outside its statutory authority. The plaintiffs obtained a preliminary injunction so that they could continue to work with Texas state authorities in their investigations into child abuse. The parties then filed for Summary Judgement, which led to this decision.
The Court’s Opinion
The court relied on the authority granted by the federal Administrative Procedures Act (APA), as well as Supreme Court precedent, to vacate the 2024 Privacy Rule. Under the APA, administrative agencies cannot promulgate rules that go beyond what statutes passed by Congress provide. In addition, the Supreme Court ruled in Loper Bright Enterprises v. Raimundo that courts do not have to defer to agencies when it comes to the subject matter regulated by those agencies. The Supreme Court also established the “major questions” doctrine, under which courts can determine whether an agency rule decides a political question, which is the province of Congress, or interferes with state law. Citing these authorities, the district court concluded that the 2024 Privacy Rule exceeded the authority granted to HHS via HIPAA by preventing states from regulating child abuse, by creating new definitions that extended HHS’s authority beyond that provided by HIPAA, and by asserting authority that Congress did not grant it.
The court agreed with the plaintiffs’ assertion that the 2024 Privacy Rule places limits on states’ ability to require or regulate the reporting of child abuse. The court noted that HIPAA itself states that the statute cannot be used to limit states’ ability to report or regulate child abuse and that the 2024 Privacy Rule can be read to do just that.
The court also determined that HHS included definitions of terms such as “persons” and “public health” in the 2024 Privacy Rule that were not authorized by HIPAA. The court concluded that these new definitions allowed the 2024 Privacy Rule to interfere with the state’s ability to regulate child abuse by excluding unborn children in the rule’s definition of “person,” and excluding both abortions and medical interventions related to gender identity in the “public health” definition. The court reasoned that these definitions provided wider latitude to deny the state access to information that could aid it in determining whether child abuse occurred.
Finally, the court ruled that the “major questions” doctrine required a determination that the 2024 rule exceeds statutory authority because it tackles a subject of political significance that is left to Congress and because it interferes with a law enforcement function that is the province of the states.
For these reasons, the court vacated the 2024 Privacy Rule and granted summary judgment to the plaintiffs in the case. The order to vacate applies nationwide.
Employer Takeaway
Although it is possible that this order will be appealed, it is likely that the 2024 Privacy Rule will remain vacated and will no longer be in effect. This means that group health plans will no longer be required to comply with the additional obligations imposed by the 2024 Privacy Rule regarding reproductive healthcare nor be subject to enforcement by HHS for related violations. However, and importantly, plans must continue to comply with HIPAA's Privacy Rule regarding the protection of PHI, and if applicable, any state laws that provide additional privacy protections. Employers, especially those that sponsor self-insured plans, should work with their legal counsel to review and revise their HIPAA policies and procedures, training materials and other documents, to ensure these conform to current laws and regulations, including when it comes to handling PHI in response to a request by law enforcement or for a judicial or administrative proceeding.