Reproductive health privacy is once again in the legal spotlight with a recent federal district court decision that struck down nearly all of a recent rule under the Health Insurance Portability and Accountability Act (HIPAA) that protected reproductive healthcare-related information privacy.
In a ruling issued on June 18, 2025, in Purl v. Department of Health and Human Services, the District Court for the Northern District of Texas largely vacated the privacy rule adopted in April 2024 to support reproductive health care privacy (the 2024 Rule). This abrogation is effective nationwide, meaning that many HIPAA-regulated entities who had made changes to their privacy policies and procedures as a result of the 2024 Rule are no longer required to adhere to those regulations under HIPAA. The decision raises several considerations, including whether the Department of Health & Human Services (HHS) can ever regulate reproductive health information and how the patchwork of state laws may fill this federal gap.
HIPAA Privacy Rule Background
HIPAA was passed in 1996 to improve the portability and continuity of health insurance coverage and to simplify the administration of health insurance. Congress gave HHS the authority to enforce HIPAA and its regulations.
In 2000, HHS promulgated the HIPAA Standards for Privacy of Individually Identifiable Health Information (the Privacy Rule) to enforce standards that protect the privacy of protected health information (PHI). Generally, the Privacy Rule prohibits HIPAA-regulated entities from disclosing an individual’s PHI without authorization unless that disclosure is for a specific permissible purpose.
HIPAA-regulated entities include health care providers, health plans, health care clearinghouses, and business associates. We will refer to organizations affected by the Purl decision as “health care providers” in this post for simplicity’s sake, but keep in mind that the decision affects all HIPAA-regulated entities.
The HIPAA Reproductive Health Privacy Rule
In 2024, HIPAA amended the Privacy Rule to prohibit health care providers from using or disclosing an individual’s PHI related to reproductive health care for certain non-health care purposes. We previously covered the 2024 Rule here.
Under the Rule, these prohibited uses included:
- Conducting a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, or facilitating reproductive health care;
- Imposing criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care; and/or
- Identifying any person for the above purposes.
The 2024 Rule’s prohibition applied where “the relevant activity [was] in connection with any person seeking, obtaining, providing, or facilitating” reproductive health care and the healthcare provider had reasonably determined that:
- The care was lawful under the law of the state in which such health care was provided under the circumstances in which it was provided; or
- The care is protected, required, or authorized by federal law, including the United States Constitution, under the...
