On June 18, 2025, a federal district court in Texas vacated regulations providing protections for reproductive health information (the 2024 Rule) as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The court found that the Department of Health and Human Services (HHS) exceeded its authority and unlawfully limited state law, effectively eliminating the majority of the 2024 Rule and its compliance obligations.
In an earlier blog post, I explored the details in the Purl v. HHS decision. In this post, I focus on the practical implications of the court’s action for healthcare providers.
Is the Decision to Vacate the 2024 Rule Final?
The district court did not issue a stay, so its ruling is immediately effective nationally. The parties have 60 days (August 18, 2025) to appeal. If neither party files an appeal, the district court’s action will stand.
While an appeal may not seem likely given the current administration’s position on the 2024 Rule generally, an appeal is possible given the unique nature of some aspects of the decision. If either party files an appeal, the appeals court could stay the district court’s ruling while it considers the matter. And, of course, an appeals court could reverse some or all of the district court’s ruling.
How do Healthcare Providers Proceed?
As of now, the vast majority of the 2024 Rule is vacated (there is a small exception related to the Notice of Privacy Practices). Absent a stay or reversal on appeal, the provisions in the 2024 Rule are no longer effective. This means that if the 2024 Rule required an attestation, such an attestation is no longer required. It also means that all the HIPAA provisions in place prior to the 2024 Rule remain effective. This is important as explained below.
Should Healthcare Providers Undo All Policy Changes?
Given the uncertainty around the possibility of appeal, it would be best to wait to reverse any policy changes until after the appeal period ends (August 18, 2025). If neither party appeals, healthcare providers can make changes to the policies again without worrying about a legal ping-pong match.
While waiting on policy changes may be advisable, providers should train medical records personnel that the 2024 Rule is no longer in effect and attestations are no longer required. Medical records personnel should process all requests for records in the same manner they did prior to the 2024 Rule.
Importantly, any state laws regarding the protection of reproductive health information (RHI) still apply. In Connecticut and California, there are state laws that provide specific protection to RHI without regard to the 2024 Rule, and other states may have recently passed or are considering similar laws.
What about Notice of Privacy Practices (NPP) Changes?
The 2024 Rule amended the HIPAA NPP requirements to address reproductive health information and Part 2 Records held by covered entities.[i] The district court in Purl vacated the portions of the 2024 Rule that applied to reproductive health information but did not vacate changes related to Part 2 records. Therefore, if a healthcare provider receives Part 2 records, it must update its NPP to ensure that it complies with the requirements under the 2024 Rule which remain effective.
Given that the compliance date for the NPP changes is not until February 16, 2026, it is best to wait a while to make NPP changes. There are two reasons. First, waiting until after the Purl appeal period is recommended as I describe above. Second, remember the proposed changes to HIPAA back in 2021? Yeah, I mean the ones proposed more than 4 years ago.
Those proposed changes included proposed revisions to the NPP which were not part of the 2024 Rule. This means that either HHS abandoned those proposals or it could still finalize additional changes to the NPP. Since there are administrative burdens associated with changing the NPP substantively[ii] (e.g., sending the revised NPP out to all patients and changing all the postings), I think it is best to wait until early February 2026 to pull the trigger on any NPP changes.
How Can Healthcare Providers Ensure Protection of Reproductive Health Information Under HIPAA without the 2024 Rule?
As I noted shortly after the reversal of Roe v. Wade in 2022, HIPAA gives healthcare providers some flexibility in determining whether to disclose PHI when there is no authorization from the patient. In that article, I provided strategies for healthcare providers to use in responding to requests for reproductive health information when the patient has not authorized the disclosure. Providers should employ those strategies detailed in Section II of the article.
As noted above, some states, like Connecticut and California, adopted laws protecting RHI in the wake of the reversal of Roe v. Wade. More of those laws may pop up around the country. The Purl decision has no effect on those state laws, and providers must comply with any state laws that provide more protection to health information than HIPAA.
Conclusion
The Purl decision significantly alters the legal landscape for protecting reproductive health information under HIPAA, but it does not leave providers without tools or obligations. While the 2024 Rule is no longer in effect (pending appeal), HIPAA’s pre-2024 framework still governs, and more protective state laws remain fully enforceable. In the near term, providers should hold off on reversing policy changes until after the August 18 appeal deadline and delay Notice of Privacy Practices updates until closer to the February 2026 compliance date—when the regulatory environment may be more settled.
In the meantime, healthcare providers should rely on HIPAA’s permissive disclosure framework and state-specific laws to guide their handling of sensitive health information. Careful planning, ongoing staff training, and legal awareness remain essential to navigating this evolving area of law.
[i] 45 CFR § 164.520.
[ii] 45 CFR § 164.520(b)(3).