On June 18, 2025, a Federal judge in Texas struck down the April 2024 rule titled HIPAA Privacy Rule to Support Reproductive Health Care Privacy (Reproductive Health Rule) issued by the Department of Health and Human Services (HHS). (Read the decision HERE). The Reproductive Health Rule, which has only been in effect for less than one year, limited the circumstances under which covered entities (including EMS agencies) and their business associates could use or disclose protected health information (PHI) related to reproductive health care, otherwise known as “reproductive health information.”
Reproductive Health Rule
The Reproductive Health Rule was enacted by HHS in an attempt to ensure that individuals were not deterred from seeking necessary medical care in states where state laws limit access to certain types of reproductive care. The HIPAA rule sought to protect reproductive health information from being used in state enforcement actions.
The Reproductive Health Rule defined “reproductive health information” broadly to include not just abortion, but any care related to a person’s reproductive organs, including contraception, miscarriage management, and gender-affirming care. It also defined “person” under HIPAA to exclude fetuses. The Reproductive Health Rule specifically precluded HIPAA-regulated entities from using or disclosing such PHI in the following circumstances:
- To conduct a criminal, civil, or administrative investigation into, or to impose criminal, civil, or administrative liability on, an individual solely for seeking, obtaining, providing, or facilitating reproductive health care where such care is lawfully provided.
- To identify any individual for the purpose of conducting such investigation or imposing such liability.
Under the Reproductive Health Rule, covered entities were to presume that reproductive healthcare was lawful unless they had actual knowledge or a substantial factual basis to believe otherwise. Moreover, these entities were required to obtain a written attestation from persons requesting PHI related to reproductive healthcare in situations involving health oversight, judicial or administrative proceedings, law enforcement and disclosures regarding decedents such as disclosures to coroners and medical examiners.
Present Case
In October 2024, Dr. Carmen Purl, a family doctor in Amarillo, Texas, filed a civil lawsuit against HHS arguing that the Reproductive Health Rule exceeded its statutory powers and improperly limited states’ authority to investigate child abuse or public health concerns by restricting state-mandated reporting obligations.
Ultimately, the court concurred, striking down the Reproductive Health Rule in accordance with the Administrative Procedure Act (APA), which requires courts to invalidate agency rules that exceed legal limits or violate federal law. Citing recent Supreme Court precedent in Loper Bright Enterprises v. Raimondo, 603 U.S. 369, 416 (2024), the court found that HHS had overstepped its authority in issuing its Rule.
The court also relied on the statutory language found within HIPAA which explicitly provides that federal privacy rules cannot interfere with state laws on public health matters such as “for the reporting of disease or injury, child abuse, birth, death, public health surveillance, or public health investigation or intervention.” 42 U.S.C. § 1320d-7(b). The court agreed with the plaintiffs that the Reproductive Health Rule crossed that line by making it harder for providers to comply with Texas's reporting laws. Rather, as the court explained, [s]tates like Texas can have their capacious definitions of their own child abuse or public health laws,” and HIPAA “affords HHS no leeway to ‘invalidate or limit’ the ‘authority, power, or procedures’ of those laws by slicing off its favored procedures from a State’s purview.”
Therefore, the court invalidated the Reproductive Health Rule in its entirety, preserving only the requirement to revise Notice of Privacy Practices (NPPs) for Substance Use Disorder (SUD) patient records under 42 C.F.R. Part 2.
What This Means for EMS Agencies
Although the Reproductive Health Rule has been vacated, HIPAA’s baseline privacy protections remain in full force and effect. Consequently, EMS agencies must still maintain proper uses and disclosures of reproductive health-related PHI following standard HIPAA requirements, including:
- Carefully reviewing law enforcement or subpoena requests before releasing PHI
- Following the “minimum necessary” standard
- Ensuring proper documentation and authorization, where applicable
As such, key personnel should be retrained/refreshed in accordance with the original HIPAA framework, particularly regarding how reproductive health information is handled in law enforcement and public health contexts. Furthermore, agencies must conform to any state laws that may provide enhanced privacy for this specific category of health information.
Otherwise, agencies that have adopted new procedures to comply with the vacated Rule, such as requiring attestations before disclosing reproductive health PHI, can discontinue such requirements immediately.
Remember, however, agencies are still required to update their Notice of Privacy Practices (NPP) by February 16, 2026, to comply with separate Federal changes.
