Understanding the now-reversed reproductive health privacy amendments

For practicing psychologists, staying abreast of regulatory changes that impact patient information is paramount. On June 18, 2025, the U.S. District Court for the Northern District of Texas issued a significant ruling in Purl v. Department of Health and Human Services effectively vacating most of the U.S. Department of Health and Human Services’ (HHS) 2024 Final Rule. This decision, effective nationwide, fundamentally alters the landscape of privacy protections for reproductive health care information under HIPAA by removing protections established by a Biden Administration rule, most of which had key compliance dates in December 2024.

Earlier this year, we shared this article, “Understanding the new HIPAA amendments: What psychologists need to know,” detailing the impending changes to the HIPAA Privacy Rule. The 2024 Final Rule had aimed to enhance privacy protections for reproductive health care information in the wake of Dobbs v. Jackson Women’s Health Organization, which returned the authority to regulate abortion to individual states.

Concerns arose that protected health information (PHI) related to lawful reproductive care could be used in investigations or legal proceedings in states with restrictive abortion laws. To address this, the 2024 Final Rule introduced new restrictions on how PHI related to reproductive health care could be used or disclosed. Specifically, the Final Rule would have:

• Prohibited the use or disclosure of PHI for investigations or imposing liability on individuals seeking, obtaining, providing, or facilitating lawful reproductive health care.
• Required an “attestation” from entities requesting PHI related to reproductive health care (e.g., law enforcement or judicial bodies) to confirm the PHI would not be used for prohibited purposes.
• Mandated updates to Notices of Privacy Practices (NPPs) to inform patients of these new, enhanced privacy protections for their reproductive health information.

The Purl decision has largely swept away these specific federal mandates. The court found that HHS overstepped its statutory authority in issuing the 2024 Final Rule, concluding that it unlawfully limited state public health laws—particularly, the court found that the Final Rule’s new restrictions and attestation requirements could hinder a provider’s ability to comply with state-mandated reporting obligations. Furthermore, the court found that HHS impermissibly redefined terms like “person” and “public health,” which the court asserted conflicted with existing federal law and exceeded HHS’s delegated authority.

The court also indicated that HHS lacked clear congressional authorization to regulate matters of “great political significance” such as abortion and gender-affirming care under HIPAA, emphasizing that agencies need explicit legislative backing for regulations that have such broad societal and economic impact.

For practicing psychologists, the Purl ruling necessitates a recalibration of your HIPAA compliance efforts regarding reproductive health information, reverting back to pre-December 2024 status. This includes your protocols for responding to requests for PHI related to reproductive health care. While HIPAA permits, but does not require, disclosures for certain nonhealth care purposes (like law enforcement or judicial proceedings), the extra layers of protection for reproductive health information imposed by the vacated rule are no longer in effect. Specifically:

Federal “enhanced” protections are gone. The new, specific federal prohibitions on disclosing reproductive health PHI for investigatory purposes, as well as the attestation requirements, are no longer mandatory under HIPAA. You do not need to implement these specific protocols for federal HIPAA compliance.

Attestation requirement is gone. The requirement to obtain a signed attestation from requesting parties before disclosing reproductive health information is no longer a federal HIPAA mandate.

NPP update requirement is gone (with an exception). The requirement to update NPPs to reflect the new privacy protections for reproductive health care (which had a compliance date of February 16, 2026) is largely vacated. However, it’s crucial to note that the Purl decision left intact NPP requirements related to 42 C.F.R. Part 2 substance use disorder (SUD) regulations. If your practice updated or planned to update your NPPs solely for the reproductive health privacy provisions, you may need to revise them again. If you were only preparing for the SUD-related updates, those largely remain.

While the federal enhancements related to reproductive health privacy under HIPAA have been struck down, there are several critical areas psychologists should continue to be aware of:

State laws remain paramount. The Purl decision emphasizes that state laws governing privacy and reporting of reproductive health information continue to be in full effect. Many states have their own specific laws that may offer more stringent privacy protections than general HIPAA provisions. When a state law provides greater privacy protection than HIPAA, the state law typically governs. Psychologists must continue to be aware of and comply with the specific laws of the state(s) in which they practice. This includes understanding state-specific requirements for mandatory reporting, particularly concerning child abuse, as the court highlighted a potential conflict with the vacated federal rule. (Notably, HIPAA carves out an exception preventing it from preempting or limiting state laws related to child abuse reporting.)

Review and adjust policies. Reviewing and revising your internal HIPAA policies and procedures to reflect these changes and ensure they align with the current legal landscape is important. If you revised your policies for the 2024 rule, any references to the vacated 2024 Final Rule, including the attestation process or specific prohibitions on reproductive health PHI disclosure, should be removed. Likewise, update any workforce training programs to ensure all staff understand the current HIPAA requirements and the impact of the Purl decision.

Possibility of appeal. While the Purl decision provides clarity for now, HHS could appeal the ruling to the Fifth Circuit Court of Appeals. If HHS does appeal and the Fifth Circuit (or U.S. Supreme Court) reverses or narrows the district court’s ruling, the regulatory obligations could change again. Still, given the current administration’s policy direction and the court’s strong language about HHS exceeding its authority, it’s unlikely that HHS will aggressively pursue an appeal or seek a stay of the ruling. Nonetheless, staying informed about any such developments is prudent.

Dynamic legal landscape. The legal landscape around reproductive health care remains dynamic. Beyond the direct impact of Purl, state legislatures and courts continue to shape laws that could affect patient privacy and reproductive rights. Continued monitoring of legal and regulatory developments at both federal and state levels is essential.

The Purl v. Department of Health and Human Services decision unwound a significant federal effort to create specialized HIPAA protections for reproductive health information. For practicing psychologists, this means a return to the general HIPAA Privacy Rule requirements for reproductive health data, without the additional, now-vacated, layers of protection introduced by the 2024 Final Rule. It underscores the critical need for ongoing awareness of regulatory changes and the continued importance of complying with applicable state laws, which may offer their own, distinct privacy safeguards for patients of reproductive age.