The Fifth Circuit recently dismissed the appeal in Purl v. HHS, leaving the 2024 HIPAA Privacy Rule’s reproductive health provisions vacated nationwide, while still requiring updates to privacy notices for substance use disorder records by Feb. 16, 2026. Haynes Boone Partner Jennifer Kreick and Associate Thomas Tanabe discuss the appeal’s dismissal in an article authored for AHLA.
Read an excerpt below.
On Sept. 10, 2025, the Fifth Circuit dismissed the appeal of the Purl v. United States Department of Health and Human Services decision. This means that the Purl decision to vacate the 2024 amendments to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule (2024 Privacy Rule) to support reproductive healthcare privacy remains vacated nationwide. Covered entities and business associates (Regulated Entities) are therefore not required to implement the 2024 Privacy Rule’s reproductive health privacy provisions, including provisions prohibiting certain uses and disclosures of protected health information (PHI) related to reproductive healthcare and requiring attestations for certain uses and disclosures of PHI. Covered entities still must update their notices of privacy practices by Feb. 16, 2026, with respect to substance use disorder records governed by 42 C.F.R. Part 2 (Part 2), however, as the Purl decision did not vacate this portion of the 2024 Privacy Rule.
Background
On April 26, 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued the 2024 Privacy Rule pursuant to HIPAA. The 2024 Privacy Rule generally prohibited Regulated Entities from using or disclosing PHI for certain purposes related to reproductive health care and required Regulated Entities to obtain attestations for certain uses and disclosures of PHI related to reproductive healthcare.
Read the full article from AHLA here.
