All Is Not Lost as the Sun Sets on the HIPAA Reproductive Health Rule

In a June 2025 decision in Purl v. United States Department of Health and Human Services, the United States District Court for the Northern District of Texas vacated the 2024 HIPAA reproductive health rule (the “Rule”), which the US Department of Health and Human Services (HHS) issued to limit how reproductive health care information could be disclosed by HIPAA regulated entities (e.g., Covered Entities and business associates), as we wrote about here and here.

Now, HHS has let the August 18, 2025 appeal deadline pass without challenging the Purl decision.

HHS’s decision not to appeal Purl, however, does not relieve HIPAA regulated entities from their obligations to protect reproductive health care information. HIPAA regulated entities must still ensure that their existing HIPAA policies and procedures adequately protect PHI, including reproductive health care information, even though the protections that were in the Rule are now defunct. 

Privacy Obligations for Reproductive Health Information Live On, Even after Purl.

In the wake of the U.S. Supreme Court's decision in Dobbs v. Jackson Women's Health Organization, many employers enhanced the health benefits they were offering and expanded the benefits related to reproductive health care, even offering other benefits (e.g., travel benefits). The more robust the benefits became, the more employees used those benefits. This led to increased generation and gathering of information about reproductive health care for which employer group health plans were responsible, prompting many employers to realize that there could be a “treasure trove” of sensitive information that needed protection.

Many employers took steps to update their HIPAA policies and procedures by revising plan documents, adopting attestation forms, modifying business associate agreements, adding a “protecting reproductive health care information” slide to training materials, updating privacy notices and/or working with insurers and third-party administrators to develop procedures for determining when disclosures could or should be made and how to obtain attestations for disclosures.  The Rule prohibited entities from using or disclosing “reproductive health care” information if that information would be used for investigating the provision of lawful reproductive health care.  As such, the Rule required that HIPAA regulated entities obtain pre-disclosure attestations in certain cases to confirm that the information would not be used or disclosed for a prohibited purpose.

Takeaways & Next Steps

Employers who have taken some or all of these steps should not consider them to have been made in vain. Individually identifiable reproductive health information is PHI within the meaning of HIPAA, and protecting it continues to be required, notwithstanding the Purl decision. It is true that some of the work will likely need to be revised, such as privacy notice updates that refer to the Rule, changes to business associate agreements referring to the Rule’s requirements, and processes developed specifically for implementing the Rule’s attestation requirements. 

Nonetheless, the Purl case can be credited with shining a bright light on the flexibility of HIPAA. Even without the Rule, HIPAA allows regulated entities to adapt its policies and procedures based on its unique circumstances, and to define the level of protection that is necessary depending on the various types of health information within its environment and under its control. In particular, regulated entities can and should conduct and keep a careful inventory of PHI, define categories of sensitive health information, work with third party administrators to ensure they are developing processes and procedures for maintaining confidentiality of PHI, and only permit disclosures, in a matter compliant with HIPAA and the Plan’s notice of privacy practices and in accordance with the Plan’s policies and procedures.

You can contact the authors or your EBG attorney to explore this subject or to ask any questions.

Read Our Full Series:
ERISA – You’ll Need a Lawyer for That.