Complaint Against HHS Seeking Vacatur of HHS Final Rules Dismissed
On November 24, 2025, the court granted the joint stipulation of dismissal without prejudice submitted by Texas Attorney General Ken Paxton. The dismissal involves claims stated in a September 2024 complaint filed against the U.S. Department of Health and Human Services (HHS), the former Office for Civil Rights (OCR) Director Melanie Fontes Rainer, and the former HHS Secretary Xavier Becerra.
The complaint was a response to the HIPAA Privacy Law supporting Reproductive Healthcare Privacy Final Rule approved by the Biden administration and included in the Federal Register in April 2024. The complaint wanted declaratory and injunctive relief against HHS’ enforcement of the rule, and to dismiss one more final rule, the HIPAA Privacy Rule of 2000. AG Paxton stated that HHS went over its authority when approving the two final rules.
The ruling to drop the lawsuit was probably prompted by a decision in a lawsuit filed by Dr. Carmen Purl of Fast Care Walk-in Clinic in Texas a year ago. The Carmen Purl, et al., v. United States Department of Health and Human Services et al lawsuit also concerns the HIPAA Privacy Rule to Support Reproductive Healthcare Privacy Final Rule.
The Biden administration issued the reproductive healthcare final rule together with its response to the Supreme Court’s ruling in Dobbs v. Jackson Women’s Health Organization in 2022 that revoked Roe v. Wade, which for many years safeguarded the right to abortion before the stage of fetal viability. When Roe v. Wade was revoked, the lawfulness of abortion became a state’s concern instead of the national government, and about 50% of U.S. states eventually approved legislation banning or limiting abortions.
The final rule created a subclass of protected health information (PHI), reproductive health data, and limited its disclosure to governing bodies and police authorities. The final rule successfully stopped states from acquiring reproductive health data to keep individuals and healthcare companies responsible under state legislation for abortions provided lawfully out of state.
Dr. Purl claimed that the final rule went over the HHS’s statutory authority, saying the final rule weakened the clinic’s capability to take part in public health investigations and adhere to state legislation that demands the reporting of suspected child abuse. The lawsuit was a success. The court rejected the defendants’ motion to dismiss and vacated the majority of the changes to the HIPAA Privacy Rule, which were considered illegal for differentiating between various types of health data to achieve political intent. The Notice of Privacy Practices specifications for healthcare companies included in the Part 2 rules associated with substance use disorder were not rejected. Although the lawsuit started in the state of Texas, the decision had a countrywide impact. The HHS opted not to challenge the decision.
The court’s judgment to leave the Reproductive Healthcare Privacy Final Rule accomplished a few of the main objectives of AG Paxton’s complaint, which possibly had a vital part in the decision to dismiss the complaint. Because of the dismissal without prejudice, AG Paxton keeps the right to file the same complaint later on, should he so wish.
The ruling to drop the complaint would mean that the HIPAA Privacy Rule will protect every American’s personally identifiable health information, which can solely be disclosed for purposes associated with treatment, financial transactions for healthcare, and healthcare procedures. The HIPAA Privacy Rule additionally protected patients’ rights over their health data, allowing them to get a copy of their health information, request the correction of errors, request prohibitions on disclosures, and be given information regarding disclosures of their PHI to know who gets access to their health information.