Careers

Experiences

Industries

Offices

Our Firm

Pages

Our People

Updates

Practices

Warner Norcross + Judd LLP is a corporate law firm with over 230 attorneys serving clients in nine offices throughout Michigan. Among the largest law firms in Michigan, Warner works in virtually all areas of business law.

Michigan Law Firm - Warner Norcross + Judd LLP

core/heading

Last year, the federal Office for Civil Rights (OCR) modified the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to strengthen protections for reproductive health care information (the “2024 Rule”). OCR issued the 2024 Rule in response to the 2022 U.S. Supreme Court decision in Dobbs v. Jackson Women’s Health Organization, which held that the U.S. Constitution does not confer a right to abortion, returning the power to regulate abortion to the states. The 2024 Rule significantly altered how HIPAA covered entities — such as health care providers, fully-insured health plans and self-funded health plans — handle protected health information (PHI) that includes information about reproductive health care. To comply with the 2024 Rule, covered entities were required to undertake substantial implementation efforts, including updating their HIPAA privacy policies and procedures, conducting comprehensive staff training on the new reproductive health care disclosure restrictions, implementing new attestation requirements for certain PHI requests, and revising their Notice of Privacy Practices to reflect the enhanced protections.

core/paragraph

However, on June 18, a federal district court in Texas vacated the 2024 Rule in large part, resulting in a nationwide effect. In Purl v. U.S. Department of Health and Human Services, the court found the 2024 Rule unlawfully restricted state authority and exceeded statutory authority of the Department of Health and Human Services (HHS) under the Administrative Procedure Act. Covered entities must now reassess any steps taken to comply with the 2024 Rule.

Summary of the Court’s Ruling in Purl v. HHS

In Purl v. U.S. Department of Health and Human Services, the court ruled that the 2024 Rule:

Interferes with State Authority: The 2024 Rule improperly restricted states’ ability to conduct child abuse investigations and public health oversight, violating federal law that protects state authority in these areas.

core/list-item

Created Unauthorized Redefinitions: HHS rewrote key legal definitions (such as “person” and “public health”) without proper authority from Congress.

Exceeded Agency Powers: HHS lacked clear congressional permission to create special privacy rules for reproductive health care PHI.

core/list

The court determined these problems made the 2024 Rule unlawful, and the court vacated it entirely with nationwide effect. This means the 2024 Rule is immediately unenforceable across the U.S.

Key Provisions No Longer in Effect

The court’s ruling means the following key provisions in the 2024 Rule are no longer in effect:

Expanded Definition of Health Care: The broadened definition of reproductive health care information.

Prohibition on Disclosure: The blanket prohibition on disclosures of PHI related to reproductive health care for law enforcement, oversight or administrative purposes.

Presumption of Legality: The presumption that reproductive health care is lawful unless proven otherwise.

Attestation Requirement: The requirement covered entities must obtain attestations from requestors affirming that PHI will not be used for prohibited purposes.

Notice of Privacy Practices Updates for Reproductive Health Care: The requirement for covered entities to update their HIPAA Notices of Privacy Practices by Feb. 16, 2026, to reflect the reproductive health care protections under the 2024 Rule. However, covered entities should note separate Notice of Privacy Practices updates related to substance use disorder records, which were included in the same February 2026 deadline, remain in effect and are unaffected by this court ruling.

Recommended Compliance Tips

While the 2024 Rule has largely been vacated, covered entities should:

Pause Implementation Efforts: If you have not yet finalized policy changes, attestations or staff training based on the 2024 Rule, consider suspending those updates pending further legal or regulatory guidance.

Review Prior Updates: If your organization already implemented policy or procedural changes based on the vacated 2024 Rule, reassess whether to retain, revise or reverse those changes in light of the court’s decision.

Monitor for Appeals: The court’s ruling may be appealed, and future federal guidance or rulemaking could address the regulatory gap left by the vacatur. Stay alert for developments.

Continue General HIPAA Compliance: Covered entities should continue to maintain robust HIPAA training, documentation and access protocols.

Warner Norcross + Judd Has You Covered

This is a rapidly evolving area of law. For assistance assessing the impact of the Purl ruling on your HIPAA compliance program, please contact Stephanie Grant, De’Andre Robbins or your Warner attorney.

Health Care

Senior Counsel

Stephanie H. Grant

Associate

De’Andre L. Robbins

Cybersecurity and Privacy

Employee Benefits

Federal Court Vacates HIPAA Rule on Reproductive Health Care Privacy

Warner Norcross + Judd LLP is responsible for the contents of our advertising and this website. Please read our full <a href="/privacy-policy/" aria-label="see privacy policy">privacy policy</a> available on our website. If you have any questions or comments about our website or our Privacy Policy please contact us at <a href="mailto:info@wnj.com">info@wnj.com</a> or 616.752.2000.

Federal Court Vacates HIPAA Rule on Reproductive Health Care Privacy

professionals