On June 18, 2025, the U.S. District Court for the Northern District of Texas issued a ruling in Purl v. United States Department of Health and Human Services,1 vacating most of the Health and Human Services (HHS) Office for Civil Rights’ (OCR) 2024 Final Rule (the Final Rule), which modified provisions of HIPAA’s Privacy Rule to strengthen requirements surrounding the privacy of reproductive healthcare.
The now-vacated Final Rule took effect in June 2024 and was drafted in response to the Supreme Court’s decision in Dobbs v. Jackson Women’s Health, which overturned Roe v. Wade. The Final Rule aimed to enhance privacy protections for reproductive health information by limiting disclosures of related Protected Health Information (PHI) and requiring attestations for certain types of disclosures. However, the Texas federal court determined that these requirements placed undue burdens on regulated entities and conflicted with existing state laws and responsibilities, such as those related to reporting suspected child abuse.
The court also determined that HHS had impermissibly redefined statutory terms and lacked clear congressional authorization to regulate politically charged issues such as abortion, gender-affirming care, and refined statutory terms such as “person” and “public health.” The case was initiated by a Texas physician who argued that the rule impaired her legal obligations and professional judgment to report suspected child abuse. The court concluded that the Final Rule’s scope infringed upon states’ rights to enforce their own laws and imposed operational complexities on healthcare providers.
As a result of the Purl decision, all the provisions of the Final Rule (except for changes to the Notice of Privacy Practice (NPP) requirements related to 42 CFR Part 2) have been vacated nationwide. Accordingly, HIPAA regulated entities — healthcare providers, health plans, clearinghouses, and business associates — (HIPAA regulated entities) are no longer required to comply with the Final Rule’s attestation requirements. This provision of the Final Rule, viewed as overly burdensome and complex by many industry stakeholders, required HIPAA regulated entities to obtain attestations from persons or entities requesting PHI potentially related to reproductive healthcare for healthcare oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners.
With the Final Rule largely invalidated, HIPAA regulated entities should consider reviewing and updating their HIPAA compliance policies and procedures. Specifically, HIPAA regulated entities should consider revising internal policies and procedures regarding the entity’s process for responding to requests for PHI potentially related to reproductive healthcare to reflect the current requirements of the HIPAA Privacy Rule. HIPAA regulated entities should likewise consider removing references to the attestation process and related requirements. These entities may also consider amending any business associate agreements that incorporated the attestation provisions. HIPAA regulated entities should also evaluate whether and when to update their NPPs, considering that the only revisions related to 42 CFR Part 2 remain in effect following the Purl decision.
Looking ahead, HHS has 60 days to appeal the decision. HHS has stated it is reviewing its legal options. Meanwhile, several other states have filed lawsuits challenging the Final Rule on similar grounds, arguing that it unlawfully restricts their enforcement authority. These developments continue to shape how reproductive healthcare privacy is governed under both HIPAA and state law. Until further guidance is issued, HIPAA regulated entities should be mindful to update their HIPAA compliance practices to reflect the status quo as defined by the Purl decision.
Footnotes
-
Mem. Opinions, 2:24-CV-228-Z (N.D. Tex. June 18, 2025).
