A federal court has vacated the HIPAA rule that kept reproductive health records out of out-of-state prosecutors’ subpoenas — the decision is called Purl v. HHS, and most Americans have never heard of it. Your prenatal chart, your miscarriage record, and your pharmacy log are now exposed.
The Rule
In April 2024, the Department of Health and Human Services finalized the HIPAA Privacy Rule to Support Reproductive Health Care Privacy. The rule prohibited covered entities — hospitals, clinics, insurers, and health care clearinghouses — from disclosing protected health information when the requesting party intended to use it to investigate or impose liability on a person for legally obtained reproductive care. It was specifically designed to prevent a Texas grand jury, or a Louisiana prosecutor, from subpoenaing a New York or California chart.
It was the federal safety net under interstate telemedicine. It functioned for roughly six months — finalized in April 2024, in force at its December 2024 compliance deadline, and vacated the following June.
The Case
A Texas physician, Dr. Carmen Purl, and her clinic sued HHS in the Northern District of Texas — the same district that has handled most of the country’s major recent challenges to federal health regulation. The case landed before Judge Matthew Kacsmaryk in the Amarillo Division — the same judge who took up the mifepristone case that became FDA v. Alliance for Hippocratic Medicine. (A neighboring judge in the same district, Reed O’Connor in Fort Worth, is the one who handled Braidwood v. Becerra, the preventive-care-mandate case.) The plaintiffs argued that HHS lacked statutory authority to issue the rule, that the rule conflicted with state law-enforcement interests, and that the agency had exceeded its delegated authority under HIPAA’s underlying statute.
Judge Kacsmaryk agreed and vacated the rule nationwide on June 18, 2025. He did not enjoin it. He erased it. The vacatur applied to nearly every covered entity in the country.
In the months after, the appeal was dismissed by the Fifth Circuit in September 2025 — after the appellants dropped it — leaving the vacatur in place nationwide. The rule is gone. The default HIPAA framework — which permits disclosure for "law enforcement purposes" with a subpoena — is back in force.
The Body It Lands On
Every patient in the United States who has crossed a state line for reproductive care. Every patient whose miscarriage was logged in an EHR connected to an interstate record-sharing network (almost all of them). Every patient who has filled a prescription at a chain pharmacy that operates in multiple states (almost all of them). Every patient whose body has produced a clinical record that could be requested by a prosecutor in a hostile jurisdiction.
The mechanism is not theoretical. Prosecutors in several states have already sought out-of-state records tied to reproductive care, and with the vacatur in place there is no federal privacy carve-out standing in the way. None of it requires Supreme Court review. None of it requires a Dobbs-style ruling. Once the records are requested, the holding entity — under the default HIPAA framework — simply weighs whether to comply.
The Parallel
In every other jurisdictional dispute about medical records in American history, the federal government has been the floor. State laws could go further than HIPAA in protecting privacy. State laws could not go less far. The federal regulation was the minimum. Purl v. HHS removed the floor. What state shield laws can protect, they will protect. What they cannot reach — records held by national pharmacy chains, multi-state hospital networks, federally administered insurance programs — is now exposed.
The same court that vacated the rule will, in the coming terms, be asked to rule on whether state shield laws themselves are preempted. There is no reason to believe Judge Kacsmaryk will not vacate them too.
The Diagnosis
Strategic destruction of privacy infrastructure to enable downstream prosecution. The men who designed this know that mass criminalization requires mass surveillance. They cannot pass a federal abortion ban yet. They can dismantle the records-privacy regime that makes abortion bans politically tolerable. Without privacy, every patient is a potential defendant. Without privacy, every physician is a potential witness for the prosecution. The chilling effect is the policy.
The Ask
Demand your senator support the My Body, My Data Act (Sen. Mazie Hirono’s bill, reintroduced in 2025) — federal floor for reproductive health data privacy. Demand HHS reissue privacy protections under a different statutory authority. If you are a physician or hospital administrator, audit your EHR vendor’s default disclosure response to out-of-state law-enforcement subpoenas. If you are a patient: ask, in writing, what your provider’s policy is.
The Roberts Court tied us to the tracks. They forgot we brought bolt cutters. Receipt #6 lands next Friday.