Privacy & Cybersecurity Law Blog

On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “Final Rule”) issued by the U.S. Department of Health and Human Services (“HHS”) under the Biden Administration. The Final Rule had amended the HIPAA Privacy Rule to limit the circumstances in which protected health information (“PHI”) about reproductive health care could be used or disclosed for the purpose of (1) conducting a criminal, civil or administrative investigation into any person for seeking, obtaining, providing or facilitating lawful reproductive health care, or 2) identifying individuals in connection with such investigation.

U.S. District Court Judge Matthew J. Kacsmaryk ruled that HHS overstepped its authority in promulgating the Final Rule, citing constitutional concerns, the Dobbs v. Jackson Women’s Health Organization decision, and the major-questions doctrine, which limits agency authority on politically significant matters without clear Congressional approval.

The lawsuit was brought by Dr. Carmel Purl, an urgent care clinic owner in Texas, who argued that the Final Rule impeded her ability to report child abuse, including in cases involving abortion or gender care. The Court agreed that the Final Rule unlawfully restricted state public health laws and expanded HIPAA’s definitions beyond the law’s original scope, such as redefining “person” to exclude unborn children and limiting what constitutes “public health” activities.

Judge Kacsmaryk held that “HHS lacked clear delegated authority to fashion special protections for medical information produced by politically favored medical procedures.” The opinion vacates the Final Rule on a nationwide basis, not only as applied to Purl (as a previous injunction issued in December had done).

In his decision, Judge Kacsmaryk indicated that HHS under the Trump Administration is in the process of reviewing the Final Rule. HHS had not yet responded to the ruling at the time of this post.