We previously reported here and here about the 2024 updates to the HIPAA Privacy Rule (the “2024 Rule”) that required changes to HIPAA policies and procedures (“P&P”) for group health plans. However, a recent ruling out of the U.S. District Court for the Northern District of Texas has vacated almost the entirety of the 2024 Rule, which impacts updated P&P that recently went into effect for covered entities.
The 2024 Rule prohibits the use or disclosure of PHI related to reproductive health care by a covered entity for certain purposes, such as investigating and imposing liability, health oversight activities, judicial and administrative proceedings, law enforcement purposes, and informing coroners and medical examiners. In Purl v. United States Department of Health and Human Services, the plaintiffs challenged the 2024 Rule as being “‘arbitrary and capricious’ and ‘in excess of statutory authority’”, arguing that (i) HIPAA is being used “to impose ‘special rules’ for abortion” and (ii) the 2024 Rule’s reporting prohibitions would impair the health clinic’s state reporting obligations on abuse and public health.
On summary judgment, the district court held that the 2024 Rule is “unlawful” in “several ways” and vacated the provisions of the 2024 Rule pertaining to reproductive health care. The recent ruling did not impact the 2024 Rule’s provisions requiring changes to reflect Title 42 C.F.R. Part 2: Confidentiality of Substance Abuse Disorder Patient Records (“Part 2”).
The 2024 Rule required HIPAA-regulated covered entities, such as employer-sponsored group health plans, to comply by December 23, 2024, and amend their required Notices of Privacy Practices by February 16, 2026. Group health plans that adopted amended P&P effective as of December 23, 2024, should thus revert back to the prior versions of those P&P.
An updated Notice of Privacy Practices (“NPP”) will still be required by February 16, 2026; however, the NPP should only include changes pertaining to Part 2.
The Memorandum Opinion and Order in Purl v. United States Department of Health and Human Services, decided on June 18, 2025, is available here.