9/16/2025: Please see this blog post for an update on this public health law topic.
In June 2024, changes to the HIPAA Privacy Rule aimed at supporting reproductive health care privacy went into effect. I wrote about these changes in a blog post, and also published a follow-up post with more detail about the Privacy Rule’s new attestation requirement. In October 2024, a lawsuit was filed in federal district court challenging the authority of the U.S. Department of Health and Human Services (HHS) to enact the 2024 changes to the Privacy Rule and the judge ruled in favor of the challenger. The U.S. government did not seek to appeal the court’s decision, but several cities and a nonprofit are asking to be allowed to intervene and appeal the decision in the federal government’s place. So where does this leave the individuals and entities that must comply with HIPAA? Read on to find out more.
Background
In July 2022, following the U.S. Supreme Court’s decision in Dobbs v. Jackson, then-President Biden issued an executive order instructing HHS to explore pathways for increasing the protection of sensitive information related to reproductive health care services. In April of 2023, HHS issued a notice of proposed rulemaking (NPRM) to amend the HIPAA Privacy Rule in furtherance of the goals identified in the President’s order. On April 26, 2024, HHS published the 2024 Final Rule, which can be read in its entirety here.
The 2024 Final Rule enacted multiple changes to the HIPAA regulations, which I described in this blog post. Key among those changes was a new requirement for covered entities and business associates to obtain attestations before making certain disclosures of protected health information (PHI) when the PHI involved is potentially related to reproductive health. I wrote about the attestation requirement in detail here. Individuals and organizations that are subject to HIPAA- referred to as “covered entities” and their “business associates”- had to come into compliance with the new regulations by December 23, 2024. The 2024 Final Rule also required covered entities to update their notices of privacy practices (NPP) with new language about PHI that is potentially related to reproductive health and certain substance use disorder treatment records no later than February 16, 2026.
Purl v. Department of Health and Human Services
In October 2024, Carmen Purl, a family physician in Dumas, Texas, filed a lawsuit against the U.S. government in federal district court, arguing that HHS had exceeded its regulatory authority when it enacted the 2024 Final Rule. HHS, then led by the Biden administration, defended the 2024 Final Rule and HHS’s authority. On June 18, 2025, Judge Matthew Kacsmaryk issued a decision in favor of Dr. Purl by granting her request for summary judgment. In his order, Judge Kacsmaryk explained that all of the 2024 Final Rule would be vacated, except for the new provisions in 45 C.F.R. 164.520 that required covered entities and business associates that hold substance use disorder treatment records protected under 42 C.F.R. 2 to update language in their NPPs.
Under Rule 4 of the Federal Rules of Appellate Procedure, the deadline for asking to appeal a decision rendered by a federal district court is typically 30 days; however, when the U.S. government is a party to the lawsuit, the deadline for giving notice of appeal is extended to 60 days from when the court’s decision was issued. In the Purl case, this meant that HHS—now led by the Trump administration—had until August 18, 2025 to seek an appeal of Judge Kacsmaryk’s decision vacating most of the 2024 Final Rule. That deadline passed, and HHS did not file a notice of appeal.
The Intervenors
HHS, the defendant in the Purl case, did not try to have the decision against it appealed—and in most situations, that would be the end of this story. However, two U.S. cities and a nonprofit organization have asked to be allowed to “intervene” in the lawsuit, and their actions are keeping the Purl case alive, for now. In civil litigation (that is, in non-criminal cases), an intervenor is someone who was not named in the original lawsuit but wants to join the lawsuit- either on the side of the plaintiff or the defendant- because the intervenor believes they have a personal stake in the outcome of the case. The party or parties who want to intervene must file a motion with the court hearing the case, and the court can choose to approve or deny the request.
In January 2025, the cities of Columbus, Ohio, and Madison, Wisconsin, along with the non-profit organization Doctors for America, filed a motion to intervene in the Purl lawsuit and be allowed to defend the 2024 Final Rule if HHS, the original defendant in the case, stopped defending the 2024 Final Rule. In a memorandum in support of their motion to intervene, the cities of Columbus and Madison argued that they should be allowed to intervene because their health departments would be directly impacted by the outcome in Purl. Similarly, and in the same memorandum, Doctors for America explained that it represented more than 27,000 physicians, medical students, and other health professionals, many of whom are subject to HIPAA and would be impacted by the court’s decision.
In April 2025, Judge Kacsmaryk denied the motion to intervene. In June 2025, Doctors for America and the cities of Columbus and Madison appealed the denial. While the proposed intervenors waited for a decision from the Firth Circuit, and before the August 18 deadline for HHS to appeal the judgement in Purl had passed, the proposed intervenors also submitted a notice seeking to preserve their right to appeal the decision in Purl in the event that the Fifth Circuit granted their request to intervene in the case.
What Happens Next?
We wait. If the Fifth Circuit allows the cities of Columbus and Madison and Doctors for America to intervene, then Judge Kacsmaryk’s decision in Purl ordering that most of the 2024 Final Rule be vacated could be reconsidered by the Fifth Circuit. Alternatively, if the Fifth Circuit denies the proposed intervenors’ request to defend the 2024 Final Rule in place of HHS, then the proposed intervenors could make one final move by appealing the issue to the U.S. Supreme Court. Either way, once the fate of the 2024 Final Rule is finalized, I will publish a blog post here on Coates’ Canons explaining the outcome.
Individuals and entities that must comply with HIPAA may be wondering where this leaves them. What are covered entities and their business associates required (or not required) to do while we await resolution in the Purl case? For now, Judge Kacsmaryk’s June 2025 decision in the Purl case stands. This means that almost all of the 2024 Final Rule is vacated, except for the provisions in 45 C.F.R. 164.520 that Judge Kacsmaryk carved out in his order.
The language in the 2024 Final Rule about PHI that is “potentially related to reproductive health” and attestations can still be found in the text of the HIPAA regulations, but those provisions hold no power—at this time, HHS cannot take enforcement action against covered entities and business associates for failing to comply with these parts of the law. Covered entities and business associates therefore do not need to require attestations before making certain disclosures of PHI that is potentially related to reproductive health care under 45 C.F.R. 164.509.
As noted above, not all of the 2024 Final Rule was vacated because some of the new requirements in 45 C.F.R. 164.520 were allowed to remain in effect. Those familiar with HIPAA will know that 45 C.F.R. 164.520 governs the notice of privacy practices (NPP) that a covered entity (but not business associates) must develop and make available to the people it serves. The 2024 Final Rule impacted the NPP requirements at 45 C.F.R. 164.520 in two main ways. First, the 2024 Final Rule required covered entities to update the language in their NPPs related to the 2024 Final Rule’s new protections around PHI that is potentially related to reproductive health. Second, the 2024 Final Rule required covered entities that create or maintain substance use disorder treatment records protected under 42 C.F.R. 2 to update their NPPs to align with changes made to 42 C.F.R. 2 in 2024 as part of a separate HHS rulemaking effort. Covered entities were given until February 16, 2026 to make these changes to their NPPs.
Following Judge Kacsmaryk’s decision in Purl, covered entities are not required to make changes to their NPPs regarding disclosures of PHI that is potentially related to reproductive health care (at least for now- this could change if a higher court reverses Judge Kacsmaryk’s order). However, covered entities that create or maintain confidential substance use disorder treatment information should continue preparations to amend their NPPs in compliance with 45 C.F.R. 164.520 before February 16, 2026.
Watch This Space
As promised, once the fate of the 2024 Final Rule is known, I will publish a new blog post explaining the outcome. In the meantime, feel free to email me your questions at kirsten@sog.unc.edu.
