On June 18, 2025, a federal district court in Texas vacated regulations providing protections for reproductive health information as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The court found that the Department of Health and Human Services (HHS) exceeded its authority and unlawfully limited state law, effectively eliminating the rule and its compliance obligations.
The 65-page opinion is far from typical; it includes a grammar lesson on postpositive modifiers and a deep dive into the major questions doctrine, both rare territory for a healthcare and privacy lawyer like me. Still, there’s plenty of substantive analysis on agency authority for the admin law lovers.
Stay tuned for part two later this week, where I’ll break down what this decision means for HIPAA compliance going forward.
Background
In April 2024, HHS issued a final rule creating new protections for reproductive health information (the “2024 Rule”), with a compliance date of December 23, 2024. For a summary of its requirements, see The Final Rule: Protection of Reproductive Health Information under HIPAA.
A physician challenged the 2024 Rule in the Northern District of Texas in the fall of 2024, claiming that it interfered with child abuse reporting obligations to the state. One day before the 2024 Rule’s effective date, the court issued a preliminary injunction blocking enforcement of the rule only as to the plaintiffs while the parties submitted summary judgment briefs.
During briefing, a change in federal leadership led HHS to “waive their merits arguments” because “new leadership is currently reviewing the Rule, so Defendants do not further address the merits here.”[i] Still, the court considered the original arguments HHS had raised.[ii]
The Decision
Judge Matthew J. Kacsmaryk’s opinion contains several notable and thought-provoking aspects. For now, I’ll keep the overview high-level and refrain from in-depth analysis, as I’m still digesting the details. Below are the court’s key findings and conclusions.
Standing is Not a High Bar
Simply put, the court concluded that Plaintiffs had standing because they are subject to the 2024 Rule, which imposes an “increased regulatory burden” of some kind.[iii] This burden includes compliance efforts such as policy changes, training and legal analysis.[iv] The court emphasized that no specific cost threshold or estimate is required; rather, “Plaintiffs need to show only that they will suffer some cost, time or money suffice, arising from 2024 Rule compliance — even if it is a small cost.”[v]
The 2024 Rule Improperly Impacts State Child Abuse Reporting Requirements
“The 2024 Rule is not in accordance with 42 U.S.C. Section 1320d-7(b) because it impedes, restrains, or curtails potential child abuse reporting.”[vi] HIPAA’s enabling statute at 42 USCS § 1320d-7 states:
(b) Public health. Nothing in this part [42 USCS §§ 1320d et seq.] shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention.
The court later referred to this as the “public health anti-preemption provision.”[vii]
As part of its analysis, the court points to the 2024 Rule’s prohibition of child abuse reports based solely on lawful reproductive healthcare (RHC). It also focuses on the burdens on providers to determine whether the protected health information (PHI) contains RHC and the lawfulness of the RHC service in the PHI[viii] as well as obtain an attestation.[ix],[x] It classifies these prohibitions and burdens as limitations and, therefore, impermissible under the enabling statute.[xi]
HHS Defined Terms in the 2024 Rule without Authority
The court found that HHS’ revised definition of “person” and new definition of “public health” violate the federal statute’s “public health anti-preemption provision.”[xii] HHS revised the definition of “person” to include the parenthetical “(meaning a human being who is born alive).”[xiii] It also added a definition of “public health” that limited public health activities to “population-level activities.”[xiv]
Congress did not define “person” or “public health” in the enabling statute. Because Congress did not define either term in the enabling statute, the court concluded that HHS lacked clear authority to limit the “anti-preemption” provision.[xv]
Based on the Major Questions Doctrine, HHS Acted Outside of its Authority
Under the major questions doctrine, the court concluded that “HHS lacked clear delegated authority to fashion special protections for medical information produced by politically favored medical procedures.”[xvi] I will leave a deeper discussion of this doctrine to my legal scholar friends, but here are a few key quotes and concepts from the opinion:
The Constitution vests Congress with all legislative [p]owers. … Of course, Congress often delegates it to agencies. But political accountability demands that agencies exercise their delegations somewhat like Congress might legislate should the same question present. The major-questions doctrine aids that goal. It prevents agencies from invoking broad congressional delegations of authority from one time period as a source of authority … to take later action that would not currently receive legislative support and address problems the original Congress did not contemplate or consider. … Agencies skirt political accountability when they rely on vague, old statutes to solve the pressing problems of the day to promulgate regulations that were never considered by the people’s elected representatives – which should trouble those committed to representative government. … Thus, the major-questions doctrine works against agencies squelching the people’s voice on weighty issues where their voice matters.[xvii]
The court found the doctrine applicable here for two reasons:
- The 2024 Rule “creates special rules for information about [] politically favored procedures that implicate fundamental and hotly debated questions.”[xviii]
- HHS “tiptoe[d] its way back into abortion-related matters” after Dobbs returned the issue “entirely to ‘the people and their elected representatives.’”[xix]
Once the doctrine applies, the agency must have clear congressional authorization to act.[xx] The court concluded that HHS lacked such authority to “create differing standards for some PHI and not for others.”[xxi] It held that although HHS offered a “plausible textual basis” under its general HIPAA authority, it failed to show the required “clear congressional authorization” to treat certain types of information differently.[xxii]
Curiously, the court contrasted this with psychotherapy notes — HIPAA’s only existing category of specially treated PHI — stating that their distinction was valid because psychotherapy notes were not “sourced from politically favored health procedures.”[xxiii] The court added that “HIPAA has no history of weaponization to achieve protections for politically favored medical procedures—psychotherapy notes notwithstanding.”[xxiv]
I’ll let others more versed in constitutional and administrative law unpack that analysis.
The 2024 Rule is Vacated
One of the most significant aspects of the decision is the court’s remedy. While the U.S. Supreme Court has not ruled on whether vacating a final agency rule is proper, the district court noted that the Fifth Circuit has precedent supporting it.[xxv]
The court vacated the entire 2024 Rule except for the provisions updating the Notice of Privacy Practices (NPP) related to substance use disorder under 45 CFR §164.520.[xxvi] However, the NPP provisions related to reproductive health at 45 CFR §164.520(b)(1)(ii)(F), (G), and (H) were also vacated.[xxvii]
Does this Mean that the 2024 Rule is Vacated Nationwide?
Yes. Unlike the court’s December 2024 ruling, which granted preliminary relief only to the plaintiffs, this decision vacates the 2024 Rule related to RHC nationwide. The court did not stay its ruling, and HHS does not appear to have requested a stay.
Legally, there are significant issues on which HHS could seek appellate review. Substantively, however, HHS has shown little interest in defending the 2024 Rule. HHS has 60 days from June 18, 2025, to appeal.
What Now?
Tune in next week for a follow-up post on what this means for HIPAA-covered entities and business associates. The short version: there is no obligation to comply with the 2024 Rule but be aware of state laws like those in Connecticut that protect reproductive health information. Those still apply. I’ll also share strategies for organizations that wish to continue protecting RHI under HIPAA rules that existed prior to the 2024 Rule.
[i] Purl v. United States HHS, No. 2:24-CV-228-Z, 2025 U.S. Dist. LEXIS 116234, at *15–16 (N.D. Tx. June 18, 2025)(while HHS waived its “merits arguments,” it did challenge standing and the potential scope of relief).
[ii] Id.
[iii] Id. at *19-22.
[iv] Id. at *22-23.
[v] Id. at *27 (emphasis in original).
[vi] Id. at *29.
[vii] Id. at *67.
[viii] Noting the “legal subtleties” along with “confusion and false information” related to the lawfulness analysis, the court stated that “medical professionals cannot answer legal questions that divide Supreme Court Justices.” Id. at *48.
[ix] The court misunderstands the scope of the attestation requirement, which is evident in its statement that “a covered entity must comply with an attestation requirement whenever it receives a disclosure request for RHC PHI.” Id. at *38. This is inaccurate. An attestation is required only when the request falls into one of four specific categories under HIPAA’s permissive disclosure rules, not to all requests. See 45 CFR §164.509. This misunderstanding, however, certainly highlights the complexity of the 2024 Rule.
[x] 2025 U.S. Dist. LEXIS 116234, at *37-38.
[xi] Id.
[xii] Id. at *67.
[xiii] 45 CFR §160.103.
[xiv] Id.
[xv] 2025 U.S. Dist. LEXIS 116234, at *66–68.
[xvi] Id. at *71.
[xvii] Id. at *75 (internal quotations and citations omitted).
[xviii] Id. at *78.
[xix] Id. at *79.
[xx] Id. at *81-84.
[xxi] Id. at *82.
[xxii] Id.
[xxiii] Id. at *83.
[xxiv] Id.
[xxv] 2025 U.S. Dist. LEXIS 116234, at *86.
[xxvi] Id. at *85-96.
[xxvii] Id.