Workforce Bulletin

In a June 2025 decision in Purl v. United States Department of Health and Human Services, the United States District Court for the Northern District of Texas vacated the 2024 HIPAA reproductive health rule (the “Rule”), which the US Department of Health and Human Services (HHS) issued to limit how reproductive health care information could be disclosed by HIPAA regulated entities (e.g., Covered Entities and business associates), as we wrote about here and here. Now, HHS has let the August 18, 2025 appeal deadline pass without challenging the Purl decision.

HHS’s decision not to appeal Purl, however, does not relieve HIPAA regulated entities from their obligations to protect reproductive health care information. HIPAA regulated entities must still ensure that their existing HIPAA policies and procedures adequately protect PHI, including reproductive health care information, even though the protections that were in the Rule are now defunct. 

“ERISA – you’ll need a lawyer for that.” Our practice group’s tagline is meant to be a shorthand for the alphabet soup of laws that apply to employee benefits, including the Employee Retirement Income Security Act (ERISA). Employee benefits compliance has many traps for the unwary and is ever evolving. Below, we have provided a primer on current issues of importance in the employee benefits area to help in-house attorneys identify potential risks, mitigate them, and know when to call an outside ERISA lawyer.

1. What Is Old Is New: Get Your Health Plan Governance in Order

Employers that sponsor self-funded health plans have a host of complicated obligations. There are greater potential legal, regulatory, and fiduciary risks than in years past with managing health plans because of increased congressional legislation, increased Department of Labor (DOL) focus on group health plan compliance, and increased group health plan litigation, often by the same plaintiffs’ firms that have been suing 401(k) plans in fee litigation the past 20 years or more.

A recently discovered security vulnerability potentially affecting at least 100 million Internet of Things (“IoT”) devices[1] highlights the importance of the newly enacted IoT Cybersecurity Improvement Act of 2020 (the “IoT Act”). Researchers at the security firms Forescout Research Labs and JSOF Research Labs have jointly published a report detailing a security vulnerability known as “NAME:WRECK.” This is exactly the type of issue that the new IoT Act was and is designed to address at the governmental level, because the vulnerability can detrimentally affect ...

Enacted on December 4, 2020, the Internet of Things Cybersecurity Improvement Act of 2020 (the “IoT Act”) is expected to dramatically improve the cybersecurity of the ubiquitous IoT devices.[1] With IoT devices on track to exceed 21.5 billion by 2025, the IoT Act mandates cybersecurity standards and guidelines for the acquisition and use by the federal government of IoT devices capable of connecting to the Internet. The IoT Act, and the accompanying standards and guidance being developed by the National Institute of Standards and Technology (NIST) will directly affect ...