In this episode of 1^st Talk Compliance, Kevin Chmura is joined by Rachel Rose, JD, MBA, as they discuss recent changes to the HIPAA Privacy Rule to Support Reproductive Health Care and Privacy in relation to recent court rulings. This rule, which went into effect in April of 2024, still has certain components which practices need to know about and adhere to heading into 2026.

Learn about how these rulings are, and will, impact this important rule, and what HIPAA regulated organizations need to know concerning these updates. In addition, hear about what might be coming in the future of not only reproductive health regulations, but also various other areas of healthcare with regards to privacy.

Kevin Chmura

Hello and welcome to today’s episode of First Talk Compliance. I’m your host, Kevin Chmura, CEO of First Healthcare Compliance and Panacea Healthcare Solutions. And I’m excited to bring you an important discussion about a major legal development that impacts all HIPAA regulated entities. By way of background, on June 18th, 2025, the U.S. District Court for the Northern District of Texas issued a nationwide order striking down the HIPAA Privacy Rule Amendments designed to strengthen reproductive health care privacy.

The amendments had been mandatory since December 2024, and this court decision has created a new compliance challenge for covered entities and business associates. To help us understand what happened, why it matters, and what organizations should do now, we’re joined by our expert guest. Rachel V. Rose, J.D. MBA, who’s a leading authority on HIPAA healthcare privacy law.

If you listen to our podcast, you’ve heard Rachel many times. In fact, we’ve discussed this particular topic, or issues around it, pretty recently. So it’s great to have her back. So, Rachel, welcome back. Thank you for coming to share your expertise with us today.

Rachel V. Rose

Kevin, it’s always my pleasure and thank you for having me back.

Kevin Chmura

Yeah, your content is always heavily consumed because it’s very important. So we thank you for being here. So, maybe probably best way to just start off is if I can ask you to just briefly explain what the U.S. District Court’s order did, why it’s significant and who it applies to?

Rachel V. Rose

Absolutely. So on June 18th of this year, the United States District Court for the Northern District of Texas, and specifically the Amarillo Division, in the case caption Carmen Purl et all v. United States Department of Health and Human Services et all. And for those who are interested, that case number is 224-CV-228-Z. And the Z, it correlates to the judge at any time you see initials or an initial after a case number, it’s the judge. And I’ll just simply refer to this case as the Purl case, P-U-R-L. Basically, what the court did was to issue an order vacating the April 16th, 2024 HIPAA Privacy Rule to Support Reproductive Health Care and Privacy.

And for simplicity’s sake, I’ll just call that the HIPAA Reproductive Privacy Rule. And basically what it did was to leave intact the requirements regarding the updates to the notice of privacy practices, which are due in early 2026. And to focus on that, there really hasn’t been any guidance yet from HHS. But every covered entity and business associate and subcontractor need to be aware that the notice of privacy practices updates, which really incorporate the HIPAA provisions along with 42 CFR part two regulations, are still in play, and the part two regulations specifically relate to the substance use disorder regulation.

So that’s something that again, covered entities, business associates and subcontractors should put on their calendar, and look for updates from First Healthcare Compliance, whenever HHS releases some more guidance related to what should be included. As many know who have been in healthcare a long time. Oftentimes HHS and SAMHSA, the Substance Abuse and Mental Health Services Administration, which oversees 42 CFR part two, will issue guidance or form types of agreements or other relevant compliance items. One great example is the Business Associate Agreement.

So that’s the part that should be calendar and people should make sure that they are staying abreast of. Now that brings us to what was vacated. And so basically, procedurally, the court granted the plaintiff’s motion for summary judgment. And for those non-lawyers, summary judgment is available when there is no issue of a material fact.

In essence, it is judgment as a matter of law, and in doing so, denied the defendants, which in this case is the United States Department of Health and Human Services motion, to dismiss for lack of jurisdiction. And the specific section that was vacated pursuant to five U.S.C. Section 7062, except for the modifications that I mentioned to C.F.R. Section 164.520 with the notice of privacy practices are the provisions associated with what were 45 C.F.R. section 1604 520b, 1, 2, F, G, and H. And so for those who were familiar with what was required under those particular items, that had to do with the reporting requirements and the attestation requirements under law, and that’s distinct from the law enforcement exception.

A couple of items that are also notable, Kevin, and other healthcare attorneys in the space have also honed in on this, is that the plaintiff indicated, and the court honed in on this, saying that under the Administrative Procedures Act that the government exceeded its rulemaking authority. However, a lot of lawyers are of the opinion that Congress merely barred rules that supersede state statutes, not those that add reasonable conditions.

And so that’s something that I want to emphasize too, as I normally do in our discussions that state laws cannot be overlooked.

Kevin Chmura

So that’s significant given that you and I not that long ago discussed some of the updates to HIPAA 2024 rules. So it’s interesting that we’re talking about it this soon thereafter, kind of thought that we were a little bit settled there. So maybe just do a quick check. Are there any other reproductive rights related lawsuits that are significant that that we should know about and be paying attention to?

Rachel V. Rose

I would say the one that is very prominent is the recent Supreme Court opinion in United States versus Skrmetti, the attorney general and reporter for the State of Tennessee. And what’s notable about that case is that it was a 6-3 opinion which upheld Tennessee’s ban on puberty blockers and hormone therapy for transgender teenagers.

Texas also actually had a similar law, and last year, in 2024, the Texas Supreme Court upheld a state law banning doctors from prescribing gender affirming care to transgender minors ,and a state policy expanding the definition of child abuse to include gender affirming care remains blocked following a state court of appeals decision last year. So notably, the court, actually, has agreed to hear a couple of other transgender related cases, including transgender, participation in female sports.

And so this is an area that should be read in conjunction with any HIPAA Privacy, any law enforcement exception, which is found under the HIPAA regulations at 164.51 Q, and just really be conscientious and cautious about what the individual states are requiring, as well as following the United States Supreme Court’s ruling. Because, this particular case, the court held that Tennessee’s law prohibiting certain medical treatments for transgender minors is not subject to heightened scrutiny under the equal protection clause of the 14th Amendment and satisfies rational basis review.

So whenever one looks at civil rights issues under a constitution analysis, we have what’s known as strict scrutiny. We have intermediate scrutiny, and then the lowest level of review is rational basis. Strict scrutiny, we typically see applied to those items that are expressly mentioned in the 1964 Civil Rights Act: race, gender, religion. And for those who read any employment agreement with the nondiscrimination provisions, those same items are included there as well.

Intermediate scrutiny is a level below, and then we have rational basis, which is the lowest level of review. I would also add that in relation to some of the 14th Amendment issues and strict scrutiny, one cannot overlook any executive order that is being issued right now. And as it relates to discrimination and the DEI initiatives, the executive orders that were published in January of 2025 that relate to this expressly upheld the Civil Rights Act of 1964.

So you still cannot run afoul of that.

Kevin Chmura

Wow. So just to clarify in question for non-attorney, because that’s amazing. So with respect to Skrmetti, or really any recent Supreme Court cases, well, any of those have or could have an impact on an appeal or the ultimate outcome of the parole case?

Rachel V. Rose

I think that’s a great question for three main reasons, Kevin. First and foremost, the Purl case. The judge used, as I mentioned earlier, the Administrative Procedures Act, and that’s very relevant because of the recent Supreme Court Trump versus Casa Inc. And what’s relevant about Casa Inc., even though that’s a completely different area of law, is that the Supreme Court case, Casa, basically held that nationwide injuncti