Federal Court Vacates the 2024 HIPAA Reproductive Health Privacy Rule in Purl v. HHS

A federal judge in Texas has wiped out one of the most significant updates to medical privacy law in years. On June 18, 2025, the U.S. District Court for the Northern District of Texas entered final judgment in Purl, M.D. v. United States Department of Health and Human Services, vacating the 2024 HIPAA Privacy Rule to Support Reproductive Health Care.

The rule, finalized in April 2024, had added special restrictions on when a doctor, hospital, or health plan could hand over reproductive health records to investigators. With the court's ruling, those added protections were removed, and the only appeal was later dismissed.

Information last verified on June 20, 2026.

Status: As of June 20, 2026, the district court's June 18, 2025 judgment vacating the rule is in effect. HHS declined to appeal, and the lone appeal filed by proposed intervenors at the U.S. Court of Appeals for the Fifth Circuit (No. 25-10743) was voluntarily dismissed on September 10, 2025, leaving the vacatur in place. This remains an evolving area of law, and HHS could issue new guidance or a new rule in the future.

What the 2024 Rule Did

The rule at the center of the case was the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, issued by the HHS Office for Civil Rights. It was published in the Federal Register at 89 Fed. Reg. 32976 on April 26, 2024, took effect on June 25, 2024, and set a general compliance date of December 23, 2024.

The rule modified the HIPAA Privacy Rule at 45 CFR Parts 160 and 164. Its central feature was a new prohibition. Covered entities, meaning health care providers, health plans, and clearinghouses, were barred from using or disclosing protected health information to investigate or impose liability on a person for seeking, obtaining, providing, or facilitating reproductive health care, when that care was lawful in the circumstances in which it was provided.

To enforce that limit, the rule required a covered entity to obtain a signed attestation before releasing reproductive health information for certain purposes, such as law enforcement requests. The attestation was meant to confirm the request was not for a prohibited investigative purpose. HHS framed the rule as a response to the post-Dobbs legal landscape, aiming to keep patients from avoiding care out of fear their records would be used against them or their providers.

These were targeted additions sitting on top of the existing HIPAA framework. The baseline rules that govern how long providers keep charts and how patients get copies of their files were not changed by this rule, and you can review those separately in our explainer on medical records retention law.

The Lawsuit and the Ruling

The challenge came from Dr. Carmen Purl and her clinic. The case, Purl, M.D. v. United States Department of Health and Human Services, was filed on October 21, 2024, and assigned to Judge Matthew J. Kacsmaryk in the Amarillo Division of the Northern District of Texas, docket number 2:24-cv-00228.

The suit was brought under the Administrative Procedure Act, the federal statute that lets courts set aside agency rules that exceed the agency's legal authority or are otherwise unlawful. The plaintiff argued that HHS lacked the power under HIPAA to impose the reproductive-care-specific disclosure limits and that the rule conflicted with other legal duties, including state child-abuse and public-health reporting obligations.

The court agreed with the challenge. According to the docket, the case was terminated on June 18, 2025, when the court entered final judgment vacating the 2024 reproductive health rule. Vacatur is a powerful remedy. Rather than simply blocking enforcement against one plaintiff, it removes the rule itself, which is why a single judgment can ripple out to providers nationwide.

The ruling drew a brief appellate fight, but it did not last. HHS declined to appeal by its deadline. A group of proposed intervenors, the cities of Columbus, Ohio, and Madison, Wisconsin, along with Doctors for America, filed a notice of appeal to the U.S. Court of Appeals for the Fifth Circuit under docket number 25-10743 in August 2025. Those intervenors then voluntarily moved to dismiss, and the Fifth Circuit dismissed the appeal on September 10, 2025. As of June 20, 2026, no appeal of the vacatur was pending.

What Changed for Records Holders, and What Did Not

The practical effect of vacatur is that the reproductive-care-specific layer added in 2024 no longer carries federal force. The attestation requirement tied to reproductive health requests and the special prohibition on disclosing reproductive health records for investigations into lawful care were the heart of what the rule created, and they fell with it.

What did not change is just as important. The underlying HIPAA Privacy Rule still governs how providers and plans handle protected health information generally. Patients still have a federal right to access their own records, and providers still face the same baseline duties they did before 2024. The ordinary obligations covered in our guide to how long hospitals keep medical records were not on the table in this case.

State law also continues to operate independently. Each state sets its own retention periods, fee caps, and access rules, and those did not move because of this decision. Anyone weighing how a record is stored or released should still start with the state framework summarized in our medical records retention laws by state overview, because state requirements apply regardless of the federal rule's fate.

What Happens Next

With no appeal pending, the district court's vacatur stands. Because HHS did not appeal and the intervenors' appeal was dismissed in September 2025, the 2024 reproductive health additions are not in effect as of June 20, 2026, and there is no appellate ruling on the horizon that would automatically revive them. Any return of these protections would most likely come from a new HHS rulemaking, which would take its own time, or from separate litigation.

There is also a separate moving part. The broader 2024 rule had set a later compliance date of February 16, 2026 for certain updates to Notices of Privacy Practices, the documents providers give patients describing how their information is used. The court left in place the notice-of-privacy-practices changes unrelated to reproductive health, including those tied to substance use disorder records, so covered entities should still address those updates and watch for further HHS guidance. The reproductive-care language the vacated rule would have required, however, is no longer mandated.

Providers, plans, and patients should still treat federal health privacy as an evolving area. The safest approach is to track any new HHS rulemaking or guidance, because the federal rules on disclosing reproductive health records could change again if the agency revisits the issue.

Analysis: Why This Matters

The following analysis reflects the views of the Recording Law Editorial Team.

The Purl judgment is a reminder that medical privacy is not a fixed body of law but a contested one. A rule that took years to develop, went through notice and comment, and reached its general compliance date was undone in a single judgment. For anyone who assumes that once a federal health privacy rule is final it is permanent, this case shows how quickly an Administrative Procedure Act challenge can change the ground.

The remedy is what gives the ruling its reach. Vacatur does not just protect one clinic. It strips the rule out of the regulatory framework, which is why a decision from one district can affect record holders well beyond Texas. That breadth is also exactly why the appeal matters so much. The same feature that made the ruling consequential makes its reversal consequential too.

It is worth being precise about scope. This case targeted a specific 2024 addition, not HIPAA itself. The patient access right, the core confidentiality duties, and state retention and fee rules all survive untouched. People sometimes hear that a court struck down a HIPAA rule and assume their basic privacy protections are gone. They are not. What changed is a narrow, reproductive-care-specific overlay.

The deeper lesson is about durability. The vacatur now stands without an appeal to undo it, but that does not make the policy question settled. A future administration could attempt a new rulemaking, and fresh litigation could test any replacement. Providers building compliance programs face the task of operating under today's framework while watching for the next regulatory move. Patients trying to understand who can see their reproductive health records have a clearer federal answer than they did mid-appeal, though their state's rules remain the more stable layer.

None of this is legal advice. Anyone with questions about how the current state of the rule affects a specific records request, investigation, or compliance obligation should consult a licensed attorney about their particular situation.