Court Ditches HIPAA Reproductive Health Info Privacy Rule

A Texas federal court has vacated 2024 changes to the HIPAA Privacy Rule made by the Biden administration to shield reproductive healthcare information from law enforcement. The court’s ruling could potentially make it easier for state investigators to obtain information about abortions and gender treatments.

See Also: Using the Netskope HIPAA Mapping Guide

The Texas court’s decision effectively vacates the 2024 HIPAA privacy rule modifications pertaining to reproductive healthcare that went into effect in June 2024, meaning that covered entities and business associates will need to revert to their HIPAA compliance programs from before the 2024 rule.

In one major exception, the Texas ruling does not vacate modifications contained in the 2024 HIPAA privacy rule related to substance disorder treatment information covered by another related confidentiality rule – 42 C.F.R. Part 2. Covered organizations must update their notices of privacy practice by February 2026, under the rule.

The U.S. Department of Health and Human Services’ 2024 “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” aimed to strengthen privacy protections “to people seeking lawful reproductive healthcare regardless of whether the care is in their home state or if they must cross state lines to get it,” said Xavier Becerra – Biden’s HHS secretary -in a statement when the 291-page final rule was published in April 2024.

HHS’ HIPAA privacy rule change was fueled by the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization in 2022 that overturned the nationwide right to abortion.

At least 19 states have put abortion restrictions or bans in place since the Dobbs ruling, prompting fears that women and healthcare providers could be held liable for abortions performed in other states, HHS contended when it issued the privacy rule update.

But late Wednesday, Texas U.S. District Judge Matthew Kacsmaryk – who was appointed by President Trump during his first administration – vacated HHS’ 2024 privacy rule modifications related to reproductive health information, saying, among other reasons, that HHS “used HIPAA to shield against abortion-restrictive states.”

“In sum, HIPAA confers authority to promulgate regulations protecting ‘individually identifiable health information.’ But it confers no authority to distinguish between types of health information to accomplish political ends like protecting access to abortion and gender-transition procedures,” the judge wrote.

The Texas ruling came as the result of a lawsuit filed last year by Dr. Carmen Purl, owner of Dr. Purl’s Fast Care Walk-In Clinic, which employs three nurse practitioners and about 15 others who provide common medical services, often to children, young women and pregnant women, court documents said. That includes treating “hundreds” of child abuse victims.

Purl alleged in court documents that the 2024 HIPAA rule’s restrictions for reproductive health information use and disclosures were “arbitrary and capricious” and “in excess of statutory authority,” impairing her clinic’s “state-mandated obligation to report child abuse” or to participate in public health investigations.

Ruling’s Significance

Some experts said the Texas ruling is potentially significant. “The 2024 final rule represented the biggest change to HIPAA since the HITECH Act modifications, and this decision vacates the rule nationally,” said privacy attorney Adam Greene of the law firm Davis Wright Tremaine.

“The impact is that regulated entities no longer need to seek attestations from requestors with respect to protected health information related to reproductive healthcare, no longer need to revise their notices of privacy practices with respect to reproductive healthcare, and no longer need to navigate the prohibition on disclosing PHI if the purpose is to investigate or impose liability on lawful reproductive healthcare,” he said.

Regulated entities still must comply with state laws that place restrictions on disclosures of reproductive healthcare and still may seek to challenge requests for reproductive healthcare on grounds other than HIPAA, he said.

The primary focus of the 2024 HIPAA privacy rule change “was to prohibit the disclosure of PHI related to lawful reproductive healthcare to government officials that were attempting to investigate the mere act of receiving, seeking, obtaining, or facilitating that lawful care,” said regulatory attorney Aleksandra Vold of the law firm BakerHostetler.

“Rolling it back doesn’t mean that it is open season on this type of PHI – HIPAA still contains certain limitations and requirements that must be adhered to and met before any PHI can be disclosed without a patient’s authorization,” she said.

And HIPAA itself never requires disclosure of PHI, she adds. “It only describes the situations where it is permissible. So, HIPAA-regulated entities continue to have a choice in providing PHI. Where the 2024 rule gave them the cover of ‘sorry – it’s prohibited,’ now they will have to find other ways to navigate unsavory – but potentially HIPAA-compliant – requests for PHI,” she said.

“Those ways may be more expensive and risky – motions to quash subpoenas, for instance, based on doctor-patient privilege, or concern for patient safety. Those theories may start to be tested more and could sour relationships with local law enforcement if pursued,” she said.

Regulatory attorney Iliana Peters of the law firm Posinelli said potential civil lawsuit risks could emerge for covered organizations involving the disclosure of sensitive information such as reproductive healthcare information, regardless of HIPAA.

“I would suggest that HIPAA-covered entities will still need to carefully consider whether they must provide such information under some other law, when requested by third parties, given the litigation risk,” she said.

“In other words, simply because a disclosure is permitted under HIPAA does not mean it is required, and I believe many more HIPAA-covered entities will likely push back on such permitted disclosures for public health, healthcare oversight and law enforcement, given the privacy interests of their patients and the litigation risk associated with such disclosures.”

HHS did not immediately respond to Information Security Media Group’s request for comment on the Texas ruling.

Other Legal Challenges

Meanwhile, HHS still faces other pending litigation involving the HIPAA Privacy Rule modifications.

That includes a lawsuit filed in a Tennessee federal court in January by 15 state attorneys general seeking to overturn the 2024 rule, and a lawsuit by Texas’ attorney general that not only seeks vacating the updated HIPAA Privacy Rule, but also alleges that HHS exceeded its statutory authority in the original 2020 HIPAA Privacy Rule (see: 15 States Sue HHS to Drop HIPAA Reproductive Health Info Reg).

It was uncertain on Friday whether those litigants planned to continue or drop their lawsuits in light of the Texas ruling, and whether HHS would appeal this week’s Texas federal court decision.