Background on the reproductive healthcare guidance and the District Court decision that rescinded it

The final rule on reproductive healthcare, which became effective December 23, 2024, prohibited covered entities from disclosing protected health information (PHI) related to lawful reproductive healthcare in certain situations. Specifically, it restricted covered entities (e.g., health plans, healthcare clearinghouses or healthcare providers) and business associates from using or disclosing an individual’s PHI for the purpose of conducting a criminal, civil or administrative investigation into or to impose criminal, civil or administrative liability on any person for the “mere act of seeking, obtaining, providing or facilitating lawful reproductive healthcare.”

The final rule also required covered entities to obtain a signed written attestation from the person requesting reproductive health PHI that the use or disclosure is not for a prohibited purpose.

In addition to the amendments related to reproductive health, the final rule required covered entities to revise their Notices of Privacy Practices by February 16, 2026, to address new privacy protections under the Part 2 Rule for the Confidentiality of Substance Use Disorder Patient Records, published on February 16, 2024. For more information about the final rule, see our May 16, 2024, insight.

The District Court ruling

On June 18, 2025, in Purl v. Department of Health and Human Services, the U.S. District Court N.D. Texas vacated the final rule. The court ruled that the final rule’s protections for reproductive healthcare exceeded the statutory authority of the Department of Health and Human Services (HHS). The court struck down nationwide the final rule’s protections for PHI related to reproductive healthcare.

Final rule on PHI related to substance use disorders

The court left intact the final rule’s new HIPAA privacy notice requirements related to substance use disorder patient records, which will take effect on February 16, 2026.

On August 26, 2025, the Secretary of HHS delegated authority to the Office for Civil Rights to administer and enforce the final rule on the confidentiality of substance use disorder patients’ records.

Implications for plan sponsors

Covered entities, including group health plans, must continue to comply with the HIPAA privacy and security requirements that were in place before the 2024 final rule took effect. However, any updates to policies and procedures that specifically address the final rule on reproductive healthcare should not be followed, particularly in response to law enforcement activity.

Plan sponsors that amended their Notice of Privacy Practices and HIPAA policies and procedures to include the special rules on reproductive healthcare should determine, in consultation with legal counsel, next steps for removing those rules and communicating the changes to plan participants. Plan sponsors that amended their Notice of Privacy Practices to include both information on the reproductive healthcare rule and the new substance use disorder notice, should delete the reproductive healthcare information and retain the substance use disorder information.

If the Notice of Privacy Practices has not yet been updated to include the additional protections and consent requirements for records pertaining to substance use disorder services, it must be updated no later than February 16, 2026.