Report on the Vacatur of the HIPAA Reproductive Health Rule and Its Implications for Sustainable Development Goals (SDGs)

Overview of the Vacatur of the HIPAA Reproductive Health Rule

On June 18, 2025, U.S. District Judge Matthew Kacsmaryk issued a nationwide injunction in Purl v. HHS, vacating most provisions of the HIPAA Privacy Rule designed to support reproductive health care privacy (the “Reproductive Health Rule”). Key changes include:

1. The broad prohibitions on disclosing protected health information (PHI) related to reproductive health for law enforcement or investigatory purposes have been vacated nationally.
2. The attestation requirement previously mandated under the Reproductive Health Rule no longer applies to requests for such information.

It is important to note that the U.S. Supreme Court decision in Trump v. CASA, Inc. (2025) may limit the scope of this district court ruling.

Implications for HIPAA-Covered Entities

Healthcare providers and health plans, as HIPAA-covered entities, must take the following actions to ensure compliance and alignment with the vacatur while supporting the Sustainable Development Goals, particularly SDG 3 (Good Health and Well-being) and SDG 16 (Peace, Justice, and Strong Institutions):

• Policy Review and Updates:
  • Reassess policies, notices, and related materials to identify necessary changes.
  • Evaluate activities of business associates and update business associate agreements accordingly.
• Audit and Compliance:
  • Audit previous attestation workflows, disclosures, and programming related to reproductive health PHI.
• Communication and Training:
  • Communicate any policy or procedural changes to relevant stakeholders.
  • Retrain staff handling PHI or subpoenas to ensure workflows comply with updated policies.
• Continued Compliance:
  • Maintain adherence to HIPAA’s core Privacy Rule for protected uses and disclosures such as treatment, payment, health oversight, and law enforcement under standard conditions.
  • Continue compliance with substance use disorder (SUD)-related Notice of Privacy Practices updates as mandated by the CARES Act.

State Law Considerations

In alignment with SDG 16, which promotes strong institutions and justice, healthcare providers and plans must also consider state law dynamics:

• State laws offering more stringent protections for health information are not preempted by HIPAA and must be observed.
• Many states have enacted enhanced protections, including restrictions on geofencing and disclosure of reproductive health data.
• Entities must ensure compliance with both HIPAA Privacy Rule and applicable state law requirements.

Background on the 2024 Reproductive Health Rule

In 2024, HIPAA-covered entities began implementing the Department of Health and Human Services (HHS) 2024 Reproductive Health Rule to enhance privacy protections for reproductive health care, supporting SDG 3 by promoting health and well-being through privacy safeguards. Relevant resources include:

• New HIPAA Final Rule Imposes Added Protections for Reproductive Health Care Privacy
• HIPAA Final Rule For Reproductive Health Care Privacy with December 23, 2024, Compliance Deadline

Legal Findings and Supreme Court Review

The district court found that HHS:

• Exceeded its statutory authority and violated the “major-questions doctrine” by unlawfully redefining terms such as “person” and “public health.”
• Intruded impermissibly on state authority to enforce laws, including child abuse reporting.

This ruling effectively blocks most protections under the Reproductive Health Rule, including the attestation requirement, while leaving unrelated SUD-related privacy provisions intact.

On June 27, 2025, the U.S. Supreme Court in Trump v. CASA, Inc. addressed the use of universal injunctions, holding that such injunctions likely exceed the equitable authority granted to federal courts. The Court granted a partial stay of the injunctions to limit their scope to relief necessary for plaintiffs with standing, potentially impacting the nationwide vacatur.

Conclusion: Alignment with Sustainable Development Goals

The vacatur of the Reproductive Health Rule presents complex challenges for healthcare entities in maintaining privacy protections critical to SDG 3 (Good Health and Well-being) and SDG 16 (Peace, Justice, and Strong Institutions). Entities must carefully navigate federal and state law requirements, update policies, and train personnel to uphold patient privacy and trust while complying with evolving legal standards.

1. Sustainable Development Goals (SDGs) Addressed or Connected to the Issues Highlighted in the Article

1. SDG 3: Good Health and Well-being
   • The article discusses privacy protections related to reproductive health care and substance use disorder (SUD) treatment, which are critical components of ensuring good health and well-being.
   • It addresses healthcare providers’ responsibilities to protect patient health information, which supports access to quality health services.
2. SDG 16: Peace, Justice, and Strong Institutions
   • The article covers legal rulings and regulatory frameworks affecting health information privacy, reflecting the role of strong institutions and rule of law in protecting individual rights.
   • It highlights judicial decisions impacting the enforcement of privacy rules and the balance between federal and state authority.
3. SDG 10: Reduced Inequalities
   • By focusing on protections for reproductive health information and substance use disorder data, the article implicitly supports reducing inequalities in access to confidential healthcare services.
   • Ensuring privacy can help marginalized groups seek care without fear of discrimination or legal repercussions.

2. Specific Targets Under Those SDGs Identified Based on the Article’s Content

1. SDG 3: Good Health and Well-being
   • Target 3.8: Achieve universal health coverage, including access to quality essential healthcare services and access to safe, effective, quality, and affordable essential medicines and vaccines.
   • Target 3.5: Strengthen the prevention and treatment of substance abuse, including narcotic drug abuse and harmful use of alcohol.
2. SDG 16: Peace, Justice, and Strong Institutions
   • Target 16.6: Develop effective, accountable, and transparent institutions at all levels.
   • Target 16.10: Ensure public access to information and protect fundamental freedoms, in accordance with national legislation and international agreements.
3. SDG 10: Reduced Inequalities
   • Target 10.2: Empower and promote the social, economic, and political inclusion of all, irrespective of age, sex, disability, race, ethnicity, origin, religion, or economic or other status.

3. Indicators Mentioned or Implied in the Article to Measure Progress Towards the Identified Targets

1. Indicators Related to SDG 3
   • Proportion of population covered by health insurance or a public health system that includes privacy protections for sensitive health information (implied through HIPAA compliance and reproductive health rule adherence).
   • Number of healthcare providers and plans implementing updated privacy policies and staff training related to reproductive health and substance use disorder information.
2. Indicators Related to SDG 16
   • Number and scope of legal rulings and regulatory changes affecting health information privacy (e.g., vacatur of the Reproductive Health Rule, Supreme Court decisions).
   • Compliance rate of healthcare entities with updated privacy rules and state laws.
   • Frequency of audits and policy revisions by covered entities to align with privacy regulations.
3. Indicators Related to SDG 10
   • Extent of protections for marginalized groups in healthcare privacy policies, measured by the adoption of enhanced state-level protections (e.g., limits on geofencing, reproductive health data disclosure).
   • Access to confidential reproductive health and substance use disorder services without discrimination or fear of data breaches.

4. Table: SDGs, Targets and Indicators

Source: natlawreview.com