Federal judge strikes down reproductive health privacy protections

A federal judge in Texas has overturned the Biden administration’s landmark healthcare privacy regulation designed to shield women from being outed to the authorities when seeking reproductive care.

U.S. District Judge Matthew J. Kacsmaryk of the Northern District of Texas ruled on June 18 that the Department of Health and Human Services (HHS) overstepped its legal boundaries when it established the stronger privacy protections under the HIPAA Privacy Rule to Support Reproductive Health Care Privacy. 

The sweeping nationwide decision immediately nullifies regulations that had forbidden healthcare providers, insurance companies, and other covered entities from releasing protected health information when authorities sought it for investigations into legal reproductive health care, including abortion, contraception, fertility treatments, and gender-affirming care.

Background: Post-Dobbs privacy concerns

The Biden administration enacted the reproductive health privacy regulations in April 2024, nearly two years following the Supreme Court’s landmark Dobbs v. Jackson Women’s Health Organization decision that overturned the federal constitutional right to abortion. Officials developed these protections to address mounting concerns that medical records were being pursued by law enforcement to prosecute individuals who crossed state boundaries for legal reproductive care.

The enhanced privacy rule prohibited the use or disclosure of protected health information (PHI) by covered health care providers, health plans, health care clearinghouses, or their business associates for investigations targeting those who sought lawful reproductive healthcare.

The regulation became effective in June 2024, with organizations required to achieve full compliance by December 2024. It mandated that healthcare entities obtain signed attestations from law enforcement or other officials requesting medical records, verifying that the information would not be used to investigate or prosecute individuals for pursuing legal reproductive care.

The legal challenge

The successful legal challenge was initiated by Dr. Carmen Purl, a family medicine physician who runs Dr. Purl’s Fast Care Walk-In Clinic in Dumas, Texas. According to court documents, Dr. Purl contended that the 2024 regulation would interfere with her and her staff’s state-mandated obligations to report suspected child abuse or participate in public health investigations. Court filings indicate that Purl frequently treats children and pregnant women and has provided care for numerous child-abuse victims, with her office responding to requests from Texas Child Protective Services approximately 10-12 times annually.

Judge Kacsmaryk identified three fundamental legal grounds for invalidating the privacy protections in his 116-page ruling.

Exceeding federal authority

The judge determined that “HHS lacked clear delegated authority to fashion special protections for medical information produced by politically favored medical procedures.” The court concluded that while “HIPAA confers authority to promulgate regulations protecting ‘individually identifiable health information,’ it confers no authority to distinguish between types of health information to accomplish political ends like protecting access to abortion and gender-transition procedures.”

The ruling found that the reproductive health privacy regulation activates the major questions doctrine because it governs an area of “great political significance,” particularly since “matters involving [reproductive health care], particularly abortion and gender-transition operations, are quintessential matters of great political significance.”

The court found the regulation unlawfully constrained state public health laws and expanded HIPAA’s definitions beyond their original scope, including redefining “person” to exclude unborn children and restricting what constitutes “public health” activities.

Broader legal landscape

The Texas decision represents one component of a wider legal offensive against Biden-era reproductive health protections. According to Fisher Phillips, the 2024 rule has faced challenges in lawsuits filed by at least 17 states, in addition to the private family medical practice in Texas that secured the June 18 nationwide injunction.

Additional litigation remains active in federal courts in Tennessee and Missouri, where state coalitions are working to overturn the privacy protections. Separately, Texas Attorney General Ken Paxton has filed a more comprehensive lawsuit seeking to invalidate not only the reproductive health rule, but the entire HIPAA Privacy Rule that has governed healthcare privacy since 2003.

Administrative response

The Department of Health and Human Services has not yet declared whether it will appeal Judge Kacsmaryk’s ruling. According to the HHS fact sheet, “HHS will determine next steps after a thorough review of the court’s decision.”

However, legal observers note that on January 31, 2025, the court granted HHS’s request to “hold all current deadlines in abeyance to allow incoming leadership personnel at [HHS] additional time to evaluate their position in this case and determine how best to proceed.” The parties must provide a status report by May 1, 2025.

Given the change in administration, it is considered unlikely that HHS will appeal the ruling and defend the rule in its current form.

Looking forward

The elimination of the reproductive health privacy protections returns the regulatory environment to the baseline HIPAA Privacy Rule established in 2000. For patients and healthcare providers, the immediate practical consequence is that the special privacy protections for reproductive healthcare information that had been in effect for the past year are no longer available, returning medical record disclosure decisions to the judgment of individual healthcare organizations operating under the standard HIPAA Privacy Rule framework.