/>iIn a ruling issued on June 18, 2025, in Purl v. Department of Health and Human Services, Docket No. 2:24-cv-00228-Z, Doc. 110 (N.D. Tex. 2025), the District Court for the Northern District of Texas largely vacated the privacy rule adopted in April 2024 to support reproductive health care privacy (the 2024 Rule). This abrogation is effective nationwide, meaning that many entities regulated under the Health Insurance Portability and Accountability Act (HIPAA) who had made changes to their privacy policies and procedures as a result of the 2024 Rule are no longer required to adhere to those regulations under HIPAA. The decision raises several considerations, including whether the Department of Health & Human Services (HHS) can ever regulate reproductive health information and how the patchwork of state laws may fill this federal gap.
The 2024 Rule prohibited HIPAA-regulated entities from using or disclosing protected health information to investigate, identify, or impose liability on individuals who sought or provided reproductive health care. Among other requirements, the 2024 Rule required a signed attestation from any party requesting reproductive health information affirming that the request was not for any prohibited purpose, such as to impose criminal liability on an individual for receiving or performing abortion-related services. The 2024 Rule came on the heels of the U.S. Supreme Court decision in Dobbs v. Jackson Women’s Health Organization, 142 S. Ct. 2228 (2022), which effectively overruled Roe v. Wade, 410 U.S. 113 (1973) and held that the U.S. Constitution does not confer a constitutional right to abortion, instead returning the power to regulate abortion to each individual state.
The Purl lawsuit was brought by a Texas health care provider, Dr. Purl, who argued that the 2024 Rule unlawfully restricted her healthcare clinic’s ability to respond to Texas Child Protective Services requests for unredacted medical records in child abuse investigations. The lawsuit focused on the 2024 Rule’s definitions for terms like “person,” which excluded unborn children, and “public health,” which excluded legal investigations tied to lawful reproductive care.
The district court agreed with Dr. Purl that HHS used its definition of “person” to deny legal status and rights to unborn humans because this definition did not allow for a child abuse report for suspected abuse of an unborn child. The court also held that the 2024 Rule’s definition of “public health” conflicted with HIPAA’s preemption clause that protects state reporting laws.
The court held that HHS exceeded its authority by limiting healthcare providers’ ability to comply with state child abuse reporting laws and vacated most of the 2024 Rule, except a section on substance use disorder protections.
Compliance Insights
Although Purl has significant implications for HIPAA compliance, HIPAA-regulated entities should not hasten to remove all reproductive health-related policies in place to respond to the 2024 Rule. In many cases, state laws regarding reproductive health disclosure still apply. For example, California, Connecticut, and Rhode Island have state laws in effect that cover the disclosure of reproductive health care information. The focus of many such state laws is protecting reproductive health information in response to out-of-state legal requests.
Whether HIPAA will ever again create enhanced protections for reproductive health information remains in question. What is certain is that states will continue to regulate reproductive health care privacy. Organizations may wish to assess how they handle requests related to reproductive health information and prepare for further individual state regulatory and judicial developments in this space.
