On June 18, 2025, the United States District Court for the Northern District of Texas Amarillo Division issued an opinion, Purl v. Department of Health and Human Services,1 declaring the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) 2024 Final Rule (the “Final Rule”) modifying certain provisions of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended (collectively, “HIPAA”) Privacy Rule to support the privacy of reproductive health care information unlawful and thereby vacated the Final Rule.2 As a result, HIPAA-covered health care providers, health plans, health care clearinghouses, and their business associates (collectively, “Regulated Entities”) should update their HIPAA compliance program to ensure alignment with the current requirements of the HIPAA Privacy Rule, as modified by the Purl decision. This includes revising their HIPAA policies and procedures, training materials, and their response protocols for requests involving PHI potentially related to reproductive health care, as further described below.
Background – the Final Rule
In response to the Dobbs v. Jackson Women’s Health decision overturning Roe v. Wade and subsequent state abortion bans, on April 22, 2024, HHS OCR issued the Final Rule, which modified certain provisions of the HIPAA Privacy Rule to support reproductive health care privacy.3 The Final Rule, which took effect on June 25, 2024, sought to provide enhanced protections concerning the use and disclosure of reproductive health care information by (i) limiting the circumstances in which an individual’s protected health information (“PHI”) potentially related to reproductive health care may be used or disclosed for non-health care purposes,4 (ii) requiring that Regulated Entities obtain a signed and dated attestation from the person or entity requesting PHI potentially related to reproductive health care for health care oversight activities, judicial and administrative proceedings, law enforcement purposes and disclosures to coroners and medical examiners,5 and (iii) requiring Regulated Entities that are health care providers, health plans, or health care clearinghouses to revise their Notice of Privacy Practice (“NPP”) in a number of ways to strengthen reproductive health care privacy.6
For a more fulsome summary of the Final Rule, see our Ropes & Gray Alert dated May 2, 2024 discussing the Final Rule and its impacts on Regulated Entities and other stakeholders in the health care industry.
Key Takeaways
In light of the Purl decision, all of the provisions of the Final Rule – except for the changes to the NPP requirements related to 42 C.F.R. Part 2 – have been vacated nationwide. As a result, Regulated Entities are no longer required to comply with the Final Rule’s attestation requirement, which has been regarded by many industry stakeholders as complex and overly burdensome. That provision had required Regulated Entities to obtain attestations from persons or entities requesting PHI potentially related to reproductive health care for health care oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners.
In the wake of this decision, Regulated Entities should:
- Update internal HIPAA policies and procedures concerning the process for responding to requests involving PHI potentially related to reproductive health care to reflect the current requirements of the HIPAA Privacy Rule, as modified by the Purl.
- Remove any reference to the attestation process and related requirements under the Final Rule from HIPAA policies, procedures, and training materials to ensure alignment with current legal obligations.
- If a Regulated Entity updated its BAA form to include references to the attestation requirement, those references should be removed.
- Evaluate whether and when to update their NPPs, taking into account that only the revisions related to 42 C.F.R. Part 2 (substance use disorder records) remain in effect following the Purl.
The Purl Decision
Purl was brought by a Texas physician and her practice who alleged that the Final Rule unlawfully interfered with her ability (both in an individual capacity and on behalf of her practice) to report child abuse concerns and respond to requests for information from child protective services. The District Court ultimately found the Final Rule unlawful for three primary reasons. First, the court reasoned that the Final Rule unlawfully restricted state child abuse reporting laws through its prohibition of reports based solely on the provision regarding lawful reproductive health care and imposition of burdensome attestation requirements for nearly all disclosures of PHI related to reproductive health care. Second, the court reasoned that HHS exceeded its statutory authority by impermissibly redefining the statutory terms “person” and “public health,” and third, the court held that HHS lacked clear congressional authorization to regulate politically sensitive areas like abortion and gender-affirming care.
HHS has 60 days to appeal the Purl decision and has recently engaged in efforts to have other pending challenges to the Final Rule dismissed.7 In the pending case the State of Texas v. HHS, filed by Texas Attorney General Ken Paxton in September 2024, Texas contends that the Final Rule unlawfully interferes with the state’s authority to investigate violations of state law related to child abuse reporting.8 Similarly, the Tennessee et al. v. HHS lawsuit, filed in January 2025 by Tennessee and 14 other states, argues that the Final Rule unlawfully restricts states’ enforcement powers, and the State of Missouri v. HHS case, also filed in early 2025, raises similar claims regarding statutory overreach.9 These cases reflect ongoing legal disputes over the Final Rule’s impact on state regulatory authority and HHS’s statutory limits under HIPAA.
