Mid-Atlantic Health Law TOPICS
Court Rolls Back HIPAA Protections on Reproductive Health Care
On June 18, 2025, the U.S. District Court for the Northern District of Texas declared parts of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy unlawful, in Carmen Purl v. HHS. This decision is the latest in a long series of legal battles over access to reproductive health care in America, and providers will now need to review and update their privacy policies again.
In 2022, the Supreme Court in Dobbs v. Jackson Women’s Health, upheld Mississippi’s ban on abortions after 15 weeks. The Court found there was no constitutional right to abortion. After Dobbs, almost half of the states enacted or strengthened restrictive abortion bans. In response, the Biden-era Department of Health and Human Services (HHS) took steps to protect access to care, including strengthening the HIPAA Privacy Rule.
HIPAA Privacy Rule
Among other changes, the 2024 HIPAA update prohibited the use or disclosure of protected health information (PHI) when such information was sought to investigate or impose liability on individuals, providers, or others who sought, provided, or facilitated care that was legal where it was provided. This measure was intended to address threats from states with restrictive abortion laws, including threats to investigate or punish residents who traveled to less restrictive states for abortion care.
Providers were also required to obtain a signed attestation from those requesting information that certain requests for PHI related to reproductive health care would not be used for prohibited purposes. Practices also had to update their Notice of Privacy Practices (NPP) to inform patients about these new protections.
Purl
Before these updates could take effect, the rule was challenged. Opponents argued that the rule impeded public health investigations, limited reporting obligations related to child abuse, and exceeded HHS’s statutory authority on a politically sensitive issue such as abortion. The trial court in Purl agreed, and struck down the HIPAA provisions related to reproductive care via a nationwide injunction.
Just a few days later, the U.S. Supreme Court curtailed the use of nationwide injunctions in an unrelated case, but that ruling did not impact the decisions already in effect, such as Purl. Further, President Trump’s election led to a new policy direction for HHS, and the Trump Administration chose not to appeal the Purl decision, ending the short-lived HIPAA rules related to reproductive care.
Notice of Privacy Practices
Practices that had already changed their Notice of Privacy Practices (NPP) to comply with the 2024 rule about reproductive health care must now delete those changes. However, the 2024 rule also included new privacy requirements for substance use disorder (SUD) treatment. The Purl decision did not affect those SUD provisions. Providers have until February 16, 2026, to ensure their policies and NPP comply with the new SUD requirements.
Alexandria K. Montanio
410-576-4278 • E-mail amontanio@gfrlaw.com