The 2024 HIPAA Final Rule is (mostly) dead. If you read my most recent post, you know that we have been waiting to see if the Fifth Circuit Court of Appeals was going to permit the cities of Columbus, Ohio and Madison, Wisconsin, along with a nonprofit organization called Doctors for America (hereinafter, the “proposed intervenors”) to intervene in the case Purl v. Department of Health and Human Services. On September 4, 2025, the intervenors filed an unopposed motion for voluntary dismissal, which was granted by the Fifth Circuit on September 10, 2025. Read on for more information about the implications for HIPAA covered entities and business associates.

Status of the Purl Lawsuit

As I explained in my most recent post on the 2024 HIPAA Final Rule, at the end of August the looming question in the Purl case was whether the Fifth Circuit would permit the proposed intervenors to intervene in the lawsuit and defend the 2024 HIPAA Final Rule in place of the U.S. Department of Health and Human Services (HHS). If the Fifth Circuit had allowed the proposed intervenors to intervene, then the Purl lawsuit would have been kept alive and there may have been additional opportunities to challenge the lower court’s June 2025 decision vacating almost all of the 2024 HIPAA Final Rule. Alternatively, if the Fifth Circuit denied the proposed intervenors’ request to defend the 2024 Final Rule in place of HHS, then the proposed intervenors could have appealed the issue of whether they should be allowed to intervene to the U.S. Supreme Court.

In what may have been a surprise twist to some case-watchers, neither of these outcomes came to fruition. Instead, on September 4, 2025, the proposed intervenors changed course and filed a voluntary motion to dismiss their appeal in the Purl case. In their motion to dismiss, the proposed intervenors explained that they “have concluded that the resources of the parties and the courts would be best conserved by dismissing this appeal.” The result? There can be no further action in the Purl case and Judge Kacsmaryk’s June 2025 decision, which vacated almost all of the 2024 HIPAA Final Rule, is final and binding.

Implications for Covered Entities and Business Associates

In his June 2025 order, Judge Kacsmaryk vacated most of the 2024 HIPAA Final Rule, except for a small subset of provisions in 45 C.F.R. 164.520. This meant that all of the 2024 HIPAA Final Rule- except those provisions in 45 C.F.R. 164.520 that were carved out in Judge Kacsmaryk’s order- is unenforceable. The language in the 2024 HIPAA Final Rule about PHI that is “potentially related to reproductive health” and attestations can still be found in the text of the HIPAA regulations, but those provisions hold no power. Following this final action in the Purl case, HHS cannot take enforcement action against covered entities and business associates for failing to comply with these parts of the law.  Covered entities and business associates that had updated their practices and policies to come into compliance with the HIPAA 2024 Final Rule now need to revert to their pre-2024 HIPAA Final Rule practices and policies. For example, covered entities and business associates should stop requiring attestations before making certain disclosures of PHI that is potentially related to reproductive health care under 45 C.F.R. 164.509.

Notice of Privacy Practices: Next Steps

As noted above, not all of the 2024 Final Rule was vacated because some (but not all) of the new requirements in 45 C.F.R. 164.520  were allowed to remain in effect. Those familiar with HIPAA will know that 45 C.F.R. 164.520 governs the notice of privacy practices (NPPs) that a covered entity (but not business associates) must develop and make available to the people it serves. The 2024 HIPAA Final Rule impacted the NPP requirements at 45 C.F.R. 164.520 in two main ways. First, the 2024 Final Rule required covered entities to update the language in their NPPs related to the 2024 Final Rule’s new protections around PHI that is potentially related to reproductive health. Second, the 2024 Final Rule required covered entities that create or maintain substance use disorder (SUD) treatment records protected under 42 C.F.R. 2 to update their NPPs to align with changes made to 42 C.F.R. 2 in 2024 as part of a separate HHS rulemaking effort. Covered entities were given until February 16, 2026 to make these changes to their NPPs.

In light of the final decision in the Purl case, covered entities are not required to make changes to their NPPs regarding disclosures of PHI that is potentially related to reproductive health care. Furthermore, covered entities that have already made these updates to their NPPs should revise their documents and remove any language they added as a result of the 2024 HIPAA Final Rule.  The only piece of the 2024 HIPAA Final Rule that was not vacated by Judge Kacsmaryk’s June 2025 decision in Purl was the set of provisions requiring holders of SUD treatment records protected under 42 C.F.R. 2 to update their NPPs. This means that covered entities that create or maintain confidential substance use disorder treatment information should continue preparations to amend their NPPs in compliance with 45 C.F.R. 164.520 before February 16, 2026 (if they have not made those updates already).

Questions?

Feel free to send me an email about this or other North Carolina public health legal questions at kirsten@sog.unc.edu.