HIPAA Protections in a Post Dobbs World
TL;DR
In 2024, the U.S. government put in place some much needed protections, under HIPAA, to try and salvage some of the reproductive rights that were curtailed by the Supreme Court after they overturned Roe v. Wade. These protections include new requirements for providers, (including therapists). The good news is, that as of this publication, these requirements are still in place (unless you are Dr. Carmen Purl of Texas), and therefore the protections are in place for clients. Unfortunately, the current administration and several states Attorney’s General are working hard to eliminate them.
In response to growing concerns following Dobbs v. Jackson Women’s Health (the Supreme Court case that overturned the landmark Roe v. Wade case in the United States) and increased scrutiny of reproductive health care privacy, the U.S. The Department of Health and Human Services, via the Office for Civil Rights, introduced the HIPAA Privacy Rule to Support Reproductive Health Care Privacy.
Announced April 22, 2024, and published April 26, 2024, the rule took effect on December 23, 2024, with certain revisions to Notices of Privacy Practices required by February 16, 2026
What does this mean?
“Covered entities” (like a therapist, whether in private practice or working for an agency) and business associates (anyone with access to PHI, like biller or administrative assistant), are prohibited from using or disclosing protected health information (PHI) in order to:
Investigate or penalize individuals simply for seeking, obtaining, providing, or facilitating lawful reproductive health care.
Identify individuals for purposes of initiating criminal, civil, or administrative proceedings related to such activity.
PHI is protected under this rule if the care is:
Lawful under the state’s laws where provided, (e.g. abortion is legal in some states, while significantly restricted in others)
Authorized by federal or constitutional law (e.g., contraception),
Or presumed lawful if provided by another covered entity and without evidence to the contrary
If PHI related (or potentially related) to reproductive health care is requested (for example by other service provider) under HIPAA exceptions—such as health oversight, judicial/admin proceedings, certain law enforcement requests, or coroner/medical examiner disclosures—the requester must supply a signed attestation affirming the request is not for a prohibited purpose.
In other words… a judge (or law enforcement, or coroner) has long been able to request PHI related to reproductive healthcare under existing HIPAA exceptions. Under the new rule, they must also sign something swearing that the information will not be used to investigate or punish someone for the related reproductive care they are/were receiving.
Legal Challenges and Political Considerations:
Since its enactment, the final rule has been contested in multiple lawsuits:
In October 2024, Texas physician Dr. Carmen Purl sued HHS challenging the reproductive health PHI privacy rule, arguing it would prevent her from fulfilling state law obligations—particularly reporting child abuse. On December 22, 2024, Judge Matthew Kacsmaryk (Northern District of Texas) granted Purl a preliminary injunction, blocking enforcement of the rule only against her and her clinic. The court found she likely prevailed on key points: that the rule exceeds HHS’s authority under HIPAA, conflicts with mandatory child-abuse reporting requirements, and imposes irreparable burdens such as compliance costs and legal uncertainty The injunction applies solely to Purl, so the rule remains in force for all other healthcare entities as of the December 23, 2024 compliance deadline
Meanwhile, Texas v. HHS, filed in September 2024 by the State of Texas, challenges both the 2024 and parts of the 2000 HIPAA privacy rule on similar grounds—exceeding federal authority and infringing on state powers. That case is still pending before a different judge in the same court, and no injunction has been issued that affects nationwide enforcement. Additional lawsuits have been filed by Missouri, Tennessee, and other states, but none have yet produced court orders altering enforcement. As of this writing, the Purl injunction remains in place for the individual plaintiff, and broader legal challenges continue to work their way through the courts. Expect further filings on permanent injunctions, motions to expand relief, or appeals in the near term.
To throw another wrench in the mix, the second Trump administration, having taken office in January 2025, signaled a clear intent to roll back the 2024 HIPAA reproductive health privacy rule. Legal observers anticipate that the administration will either narrow its scope or repeal it outright in 2025. In practice, this could mean HHS would choose not to enforce critical provisions of the rule—like the added requirement that requesters provide a signed attestation affirming their purpose is not to investigate or penalize individuals for lawful reproductive care.
This blog is intended for educational purposes only and does not constitute specific legal advice for any individual. Reading this material does not establish an attorney-client relationship between the reader and our firm. For personalized legal guidance, please consult a licensed attorney in your jurisdiction.