Benefits Brief: Key Developments for Employers’ Disclosure of Reproductive Health Care Under HIPAA

In 2024, the Department of Health and Human Services (HHS) modified the HIPAA privacy rules to add disclosure limitations for protected health information (PHI) related to reproductive health care for certain non-health care purposes (collectively, the Reproductive Health Care Privacy Protections). Here is a link to our previous client alert explaining those changes.

On June 18, 2025, the U.S. District Court for the Northern District of Texas, Amarillo Division, vacated nearly all of those disclosure limitations in the case of Purl v. Department of Health and Human Services. HHS did not appeal the decision.

Key Takeaways

• The federal Reproductive Health Care Privacy Protections are no longer in effect. Covered entities are no longer required to include them in their HIPAA policies and procedures. Covered entities and business associates are no longer required to comply with the related attestation requirements.
• Covered entities had been required to update their HIPAA Notice of Privacy Practices (NPP) to include the Reproductive Health Care Privacy Protections by February 16, 2026. The Purl decision eliminates the need to update NPPs for the Reproductive Health Care Privacy Protections.
• The Purl decision does not eliminate the need to update NPPs related to mental health and substance use disorder treatment records covered by 42 C.F.R. Part 2. Specifically, the NPP requirements regarding the use and disclosure of Part 2 records remain in effect.

Next Steps for Employers and Covered Entities

• Consider whether to remove the federal Reproductive Health Care Privacy Protections from HIPAA policies and procedures. The law no longer requires that these protections be included in HIPAA policies and procedures. If a covered entity chooses to keep stronger protections than the law requires, the covered entity will need to confirm that all business associates are still able and willing to follow those standards. Further, retaining the Reproductive Health Care Privacy Protections may create legal risks. For example, if reproductive health information is requested as part of a court order, refusing to provide it could potentially lead to court imposed sanctions.
• Review applicable state laws on reproductive health care disclosures. Some state laws provide for protections related to reproductive health care disclosures. If a covered entity’s state provides disclosure protections that are more stringent than HIPAA, the covered entity’s HIPAA policies and procedures should be modified accordingly.
• Covered entities that receive or maintain Part 2 records should update their NPPs to describe how Part 2 records are used or disclosed. Changes to the NPPs related to Part 2 records should be completed by February 16, 2026.

We recommend reviewing your current HIPAA policies and procedures and consulting with legal counsel to determine the best approach for your organization.