15 States Sue HHS to Drop HIPAA Reproductive Health Info Reg

A Biden administration HIPAA Privacy Rule that went into effect last June to restrict the disclosure of reproductive health information is being challenged in federal court by the attorneys general of 15 states. The AGs are asking a Tennessee federal court to overturn the rule.

See Also: Using the Netskope HIPAA Mapping Guide

Among its claims, the lawsuit filed by Tennessee and the other 14 states on Jan. 17 against HHS and Xavier Beccera in his capacity as HHS secretary under the Biden administration, alleges that the 2024 HIPAA privacy final rule is unlawful.

The complaint alleges the rule is hampering states’ ability to gather information “critical to policing serious misconduct like Medicaid billing fraud, child and elder abuse, and insurance-related malfeasance” because healthcare providers – citing the HIPAA regulations – are refusing to turn over documents subpoenaed for investigations.

“As of this filing, multiple health-related and health-fraud investigations have come to a halt while investigators await clarification on their obligations under the Final Rule,” the lawsuit said, citing an example from Iowa, which is among the states pressing the litigation.

HHS’ Office for Civil Rights issued the 291-page HIPAA Privacy Rule to Support Reproductive Health Care Privacy final rule in April 2024, and the regulations went into effect in June 2024.

The rule prohibits the use or disclosure of reproductive health information when it is sought to investigate or impose liability on individuals, healthcare providers, or others who seek, obtain, provide or facilitate reproductive healthcare that is lawful under the circumstances in which such healthcare is provided.

HHS’ update to the Privacy Rule came in the wake of the 2022 Supreme Court decision in Dobbs v. Jackson Women’s Health Organization in 2022 that overturned the nationwide right to abortion (see: HHS Beefs Up Privacy Protections for Reproductive Health).

HHS said the Supreme Court decision “altered the legal and healthcare landscape, increasing the likelihood that an individual’s protected health information may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect, including the trust of individuals in healthcare providers and the healthcare system.”

More than a dozen states have put strict abortion bans or restrictions in place since the Dobbs ruling, prompting fears that women and healthcare providers could be held liable for abortions performed in other states, HHS said.

While the states attorneys general lawsuit alleges that the updated HIPAA privacy rule is hampering their ability to investigate potential crimes, some experts said they have seen incidents in which regulators and law enforcement are attempting to strong-arm covered organization into releasing reproductive health information protected by the rule.

“We have seen multiple state and federal regulators tell our hospital clients – even during the Biden administration – that their requests [for records] are exempt from the rule,” said attorney Aleksandra Vold, a partner of law firm BakerHostetler.

“They have provided no support for that position, and in fact the rule does not contain exemptions. They are threatening hospitals to take away their licenses, or ban them from Medicare and Medicaid programs,” she said. “Hospitals are in a terrible position … their ability to operate is being threatened on a daily basis.”

Besides Tennessee and Iowa, the other states filing the lawsuit against HHS include Alabama, Arkansas, Georgia, Idaho, Indiana, Louisiana, Montana, Nebraska, North Dakota, Ohio, South Carolina, South Dakota, and West Virginia.

The states’ lawsuit follows similar, but broader, litigation filed last September against HHS and Becerra by Texas Attorney General Ken Paxton.

The Texas lawsuit not only calls for vacating the updated HIPAA privacy rule, but also alleges that HHS exceeded its statutory authority in the original 2020 HIPAA Privacy Rule (see: Texas AG Hopes to Upend HIPAA Rules to Investigate Abortions).

What’s Next?

With the second Trump administration now in office, HHS might choose to take various options on addressing the litigation, some expert said. That includes not fighting the legal challenges to the updated HIPAA privacy rule.

“It is possible that the Trump administration will not seek to defend the various state attorneys general suits, instead allowing the courts to overturn the 2024 HIPAA amendments,” said regulatory attorney Adam Greene of the law firm Davis Wright Tremaine, who is not involved in the HIPAA litigation.

“For example, in a 2021 case, the Trump administration conceded that the prior administration had misinterpreted a statute when determining statutory caps on fines. The new administration may make similar concessions here,” he said.

Nonetheless other parties have stepped in to bolster the defense of the HIPAA privacy rule update, he said.

“In the Texas case, two cities – Columbus, Ohio and Madison, Wisconsin – and a doctor’s group – Doctors for America – have filed motions to intervene and defend the 2024 amendments, believing that the Trump administration will not do so,” he said.

“Likewise, in this Tennessee case, private parties may seek to intervene and defend the amendments. Whether such an approach will be successful remains to be seen.”

Vold said that potentially, Trump also could try to weaken the rule.

“If there is an executive order, such an order has limits. It cannot invalidate or repeal a law, but it can direct the federal government not to enforce a law,” she said.

“This would put covered entities – providers, health insurers – in a tough spot because telling HHS not to enforce the law is different than saying the covered entities do not have to comply with the law.”

“If we continue to see parties flip flopping in the White House, and Democrats are back to heading HHS in four years, HHS can look back at whether covered entities complied with the rule over the last four years and punish them for non-compliance.”

Trump could also direct HHS to do new rulemaking, but that takes significant time, she said. “The Notice of Proposed Rulemaking for the reproductive health rule was published in April 2023 and a final rule was not published until 12 months later,” she said.

“There is also an interesting positional conflict here. If Robert F. Kennedy Jr. is confirmed as secretary of HHS, his libertarian views would seemingly be aligned with this rule – ensuring no government overreach into sensitive health data where nothing unlawful happened,” she said.

A date for Kennedy’s Senate confirmation hearings has not yet been set (see: Sen. Warren Fires Off 175 Questions to RFK Jr. on HHS, HIPAA).

In the meantime, the Trump administration shortly after taking office this week appeared to have shut down an HHS website, reproductiverights.gov, that provided the public with reproductive health information.

HHS did not immediately respond to Information Security Media Group’s request for comment.