Federal Court Halts HIPAA Reproductive Health Amendments — Substance Use Disorder Rule (Part 2) Stands

On June 18, 2025, the U.S. District Court for the Northern District of Texas issued a nationwide preliminary injunction in Purl v. HHS halting enforcement of the U.S. Department of Health and Human Services’ (HHS) April 2024 Final Rule amending the HIPAA Privacy Rule to strengthen privacy protections for reproductive health care information (the “Reproductive Health Care Rule”). The court held HHS exceeded its statutory authority and violated the Administrative Procedure Act (APA).

While this ruling suspends the Reproductive Health Care Rule amendments, the court’s decision does not affect the March 2024 HHS Final Rule revising the 42 C.F.R. Part 2 SUD patient records confidentiality rules to align with certain aspects of HIPAA. The revised Part 2 SUD confidentiality requirements restrict the use or disclosure of patient information related to substance use disorder to ensure that such records are not used to initiate criminal charges against patients. Covered entities and business associates must continue preparing for compliance with the revised Part 2 requirements taking effect in February 2026.

What’s Covered by the Injunction?

The injunction immediately blocks all provisions of the Reproductive Health Care Rule, including:

• Restrictions on disclosing protected health information (PHI) to investigate or impose liability for seeking, obtaining, providing, or facilitating lawful reproductive health care, or to identify any person as conducting in such activities related to lawful reproductive health care provided out of state
• Requirements for signed attestations before certain law enforcement or regulatory disclosures
• Mandated updates to business associate agreements (BAAs)
• Revisions to Notices of Privacy Practices (NPPs) are due by February 16, 2026

The court’s decision applies nationwide and is effective pending further judicial review.

Considerations for Covered Entities and Business Associates

• Reproductive Health Care Rule Paused: Organizations are not required to implement attestation procedures, revise BAAs, or update NPPs in connection with the enjoined rule. Disclosures of reproductive-related PHI may resume under the existing HIPAA Privacy Rule and applicable state laws.
• HIPAA Still Applies: The core HIPAA Privacy, Security, and Breach Notification Rules remain fully enforceable. This ruling affects only the April 2024 Final Rule related to reproductive health care privacy.
• Part 2 Rule Remains in Force: The March 2024 Final Rule aligning SUD confidentiality rules with HIPAA—including updates to NPPs and broader consents for treatment, payment, and healthcare operations—remains unchanged. Compliance with the revised Part 2 requirements remains required by February 2026.

Looking Ahead

Organizations may consider pausing implementation efforts related to the enjoined Reproductive Health Care Rule, including updates to BAAs and NPPs. At the same time, preparation for the 2026 effective date of the revised Part 2 rule for SUD information should continue uninterrupted and will be the subject of a future Fenwick client alert. It is also important to monitor the Fifth Circuit appeal for any developments that could alter the current injunction. Entities may want to reassess existing policies and agreements to determine whether planned changes tied to the reproductive health amendments should be rolled back or deferred. Finally, documenting compliance decisions now may help ensure a smoother response in the event the rule is reinstated on appeal.