In the wake of the Supreme Court’s ruling in Dobbs v. Jackson Women’s Health Organization, states began implementing extreme abortion bans and restricting access to reproductive health services. To help safeguard access to reproductive health care and patient privacy, the Department of Health and Human Services (HHS) issued a rule strengthening reproductive health privacy protections under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Republican attorneys general in Missouri, Tennessee (on behalf of 14 states), and Texas, as well as a Texas-based clinician, Dr. Carmen Purl, brought four separate lawsuits challenging the HIPAA reproductive health privacy rule.
On June 18, Judge Matthew Kacsmaryk, a district court judge in Texas known for hearing high-profile reproductive health-related lawsuits, ruled in favor of Dr. Purl and vacated the majority of the rule, preventing it from being enforced nationwide. He issued a ruling with nationwide effect after declining to allow stakeholders, such as Doctors for America, to intervene and represent the privacy interests of women and health care providers across the country.
The ruling in Purl v. Department of Health and Human Services means that women, their health care providers, and their loved ones have lost the benefit of the rule’s essential privacy protections, which previously applied in every state. While health care providers must still comply with long-standing HIPAA protections, the court’s decision will further undermine access to a wide range of reproductive health care. This is especially true for patients living in states with abortion bans who face fear, uncertainty, and barriers to obtaining reproductive care in states where it is lawful.
This article summarizes the HIPAA reproductive health privacy rule, the court’s decision in Purl v. HHS, and what to expect in continued litigation over Biden-era efforts to protect reproductive health privacy.
The HIPAA Reproductive Health Privacy Rule
In April 2024, HHS issued a final rule that strengthened HIPAA privacy protections for reproductive health-related information. The rule prohibits a covered health entity (which includes health care providers, health plans, and health care clearinghouses) from disclosing protected health information (PHI) for an investigation that would impose criminal, civil, or administrative penalties on an individual for seeking, obtaining, providing, or facilitating access to lawful reproductive health care. The rule applies to reproductive care that is legal under state or federal law. For example, the rule protects abortion-related PHI for a woman who travels from a state with an abortion ban (such as Texas) to a state where abortion is legal (such as California) to obtain care, in addition to a wide range of non-abortion-related PHI for care, such as contraception use or infertility.
Complaint in Purl v. HHS
In October 2024, Dr. Purl and her medical practice filed their suit before Judge Kacsmaryk, who has issued past rulings overturning various Biden administration actions — including on access to medication abortion (where litigation is ongoing), the Title X family planning program, and Planned Parenthood’s potential liability under the False Claims Act.
Purl challenged the HIPAA reproductive health privacy rule, arguing that it lacked statutory authority and was arbitrary and capricious under the Administrative Procedure Act, the law governing agency rulemaking authority. Specifically, Dr. Purl argued that the HIPAA statute did not authorize HHS to issue regulations focused on reproductive health care, define the term “person” to exclude a fetus, or define the term “public health” in a manner that interferes with state laws on abortion or gender-affirming care. Further, Dr. Purl asserted that the rule prevents her from complying with Texas’ mandatory child abuse reporting requirements and leaves her and her staff to speculate about whether various medical procedures qualify as lawful reproductive health care (or not). She also alleged that the rule imposes imminent compliance costs because she must update privacy notices, retrain staff, and develop updated procedures. Following the 2024 election and ahead of the rule’s December 2024 enforcement date, Dr. Purl asked the court to invalidate the rule and prevent HHS from enforcing it nationwide.
The Biden administration argued that Purl lacked standing to challenge the HIPAA reproductive health privacy rule, failed to show that she faced an actual or imminent irreparable injury from the rule, and raised only speculative concerns about compliance costs. HHS also emphasized that the rule in no way prohibits Purl from disclosing information related to unlawful abortions or gender-affirming care in Texas, because the rule “does not prohibit entities from complying with legitimate investigations in unlawful reproductive health care.” Further, Purl had never reported child abuse related to reproductive health care, received a subpoena related to reproductive health care, or treated a minor receiving gender-affirming care.
In a December 2024 ruling, Judge Kacsmaryk rejected the Biden administration’s arguments. Finding that the rule likely interfered with Purl’s obligations under state abuse reporting laws and exceeded HHS’ statutory authority, he granted Purl’s motion and enjoined HHS from enforcing the rule against Purl and her medical practice. The rule otherwise remained in effect nationwide.
Continued Proceedings and Request To Intervene
In January 2025, Purl filed a motion for summary judgment, where she alleged that the rule also violated the U.S. Constitution. She asserted that the rule violated the major questions doctrine (a judicial doctrine used to overturn agency action that involves “a public controversy of vast economic and political significance”), the due process clause, and the non-delegation doctrine, arguing that Congress could not give HHS the authority to interpret HIPAA broadly.
In its waning days, on January 17, the Biden administration requested that Judge Kacsmaryk dismiss the case or grant summary judgment in favor of HHS. That same day, the cities of Columbus, Ohio, and Madison, Wisconsin, joined by Doctors for America, asked to intervene in Purl to defend the rule. These stakeholders argued that the rule is critical to public health and ensuring that their patients receive the care they need — and that the rule is consistent with HHS’ statutory authority under HIPAA. Both Purl and the Trump administration opposed this request.
The Trump administration continued to defend the rule before Judge Kacsmaryk but limited its defense to procedural grounds, maintaining the Biden administration’s arguments that Purl lacked standing to sue. While defending the rule on procedural grounds, the Trump administration expressly declined to defend the substance of the rule, stating that the rule’s underlying policies were under review by new HHS leadership.
In April, Judge Kacsmaryk denied the request from the two cities and Doctors for America to intervene, after asserting that the coalition did not offer additional arguments or insights that the federal government had not already presented. These parties then filed an amicus brief in support of the rule and appealed Judge Kacsmaryk’s denial of their request to the Fifth Circuit Court of Appeals.
Vacating the HIPAA Reproductive Health Privacy Rule
Without acknowledging HHS’ existing authority under HIPAA to bolster patient privacy, in June, Judge Kacsmaryk agreed with Purl and vacated most of the HIPAA reproductive health privacy rule. The court’s decision rendered the rule void and unenforceable as to the reproductive health privacy provisions on a nationwide basis. Since the Trump administration did not defend the substance of the rule and focused only on whether Purl had standing to file the suit, the court relied on the arguments presented in the Biden administration’s motion for summary judgment when addressing Purl’s challenges to the substance of the rule.
Standing
Purl had standing to challenge the rule because, Judge Kacsmaryk found, she and her practice are the “object” of the rule — in other words, she and her clinic are required to follow the rule’s prohibitions. Both the Trump and Biden administrations argued that the rule did not prevent Purl from complying with state child abuse reporting laws, nor had Purl ever actually reported child abuse related to reproductive health care; they further argued that her estimates of compliance costs lacked evidence. However, the court found that Purl had standing because the rule “requires or forbids” her from taking some action and that she is not required to “meet a certain threshold” or offer precise estimates, so long as she faces some additional compliance costs.
Statutory Authority
Turning to Purl’s APA claims, Judge Kacsmaryk again ruled that the rule exceeded HHS’ authority under HIPAA. Dismissing the Biden administration’s arguments, he concluded that the rule unlawfully prevented compliance with Texas child abuse reporting laws (a claim that data privacy experts have criticized as flawed and troubling). Further, the court determined that the rule’s definitions of “person” and “public health” exceeded HHS’ statutory authority, as they undermine state laws that recognize fetal personhood and interfere with state public health powers. The court decided not to address whether the rule was arbitrary and capricious under the APA, having already found that the rule violated the APA on other grounds.
Major Questions Doctrine
Finally, Judge Kacsmaryk held that the rule violated the major questions doctrine. HHS argued that the major questions doctrine was inapplicable because the reproductive health privacy rule does not involve a public controversy of vast economic and political significance, nor does it represent a radical change to HHS’ long-standing authority to regulate the permissible uses and disclosures of PHI, as authorized by the HIPAA statute.
Judge Kacsmaryk rejected HHS’ arguments, concluding that the agency “lacked clear delegated authority to fashion special protections for medical information produced by politically favored medical procedures.” Without grappling at all with the text of the HIPAA statute or HHS’ long-standing authority to protect PHI, he cursorily concluded that the rule “intrude[d] into an area that is the particular domain of state law.”
Implications and What Happens Next
The court’s ruling will lead to uncertainty for health care providers and their patients and undermine access to reproductive health care nationwide. If Judge Kacsmaryk’s decision stands, the rule’s reproductive health privacy protections will be vacated nationwide and, thus, no longer enforceable. Without these protections in place, the 2000 HIPAA rule’s protections will remain instead and continue to apply to reproductive health information, as will state laws with heightened privacy protections, such as those in Colorado and New York. However, providers will still be confused about how to comply with HIPAA and protect patients’ sensitive health information when receiving requests for reproductive health PHI. There may also be a chilling effect on patient care if women forego or delay needed lawful reproductive health care out of concern that their PHI could be shared with local or state law enforcement authorities.
The Trump administration has until August 18 to file an appeal before the Fifth Circuit. It remains to be seen whether they will choose to continue defending the rule, withdraw or rescind it, or amend the Biden-era rule. At a minimum, litigation will continue before the Fifth Circuit in the pending appeal filed by the coalition of two cities and Doctors for America challenging Judge Kacsmaryk’s denial of their motion to intervene. If the Trump administration decides not to appeal the district court’s ruling, the coalition may have a strong argument as to why they should be allowed to intervene to defend the rule.
The same coalition also has pending motions to intervene in the other three challenges to the HIPAA reproductive health privacy rule. However, courts have already granted the Trump administration’s requests to pause briefing in two other challenges to the rule — the cases brought by Missouri and Texas. Notably, the Trump administration has yet to respond in the Texas lawsuit, where the state seeks to invalidate not only the 2024 rule but the original 2000 HIPAA rule in its entirety. In the challenge led by Tennessee, briefing remains ongoing, although the Trump administration is likely to request a pause in that case as well.
The stakes are high for women and their providers, as the Trump administration decides whether to continue to defend the reproductive health privacy rule and broader HIPAA protections in court. Without the rule, patients across the country will be left with fewer protections for their medical records and sensitive reproductive health-related information.
DISCLAIMER: The views and opinions expressed in this piece are those of the author and do not reflect the views of the O’Neill Institute.
