Texas Drops Challenge to 25-Year-Old HIPAA Privacy Rule

The state of Texas has dropped a federal lawsuit filed against the U.S. Department of Health and Human Services that sought to vacate the 25-year-old HIPAA privacy rule, as well as 2024 rule changes under the Biden administration that prohibit the disclosure of reproductive health information.

See Also: Securing Deal Velocity for Healthcare M&A/D

The move by Texas Attorney General Ken Paxton for “joint stipulation of dismissal” of the lawsuit without prejudice came after a Texas court in a separate case in June ruled to essentially vacate HIPAA privacy rule modifications made by the Biden administration in 2024 that sought to shield disclosures and the use of patient reproductive healthcare information for law enforcement means (see: Court Ditched HIPAA Reproductive Health Info Privacy Rule).

That civil case was filed last year by Dr. Carmen Purl, owner of Dr. Purl’s Fast Care Walk-In Clinic, which employs three nurse practitioners and about 15 others who provide common medical services, often to children, young women and pregnant women, court documents said. That includes treating “hundreds” of child abuse victims.

HHS’ HIPAA privacy rule change in 2024 was fueled by the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization in 2022 that overturned the nationwide right to abortion. The 291-page HIPAA privacy rule change in 2024 greatly restricted disclosures to law enforcement and other government authorities of protected health information involving patients seeking or obtaining lawful reproductive healthcare.

At least 21 states have put abortion bans or restrictions in place since the Dobbs ruling, prompting fears that women and healthcare providers could be held liable for abortions performed in other states where the procedure is legal, HHS contended when it issued the privacy rule update.

Purl alleged in court documents that the 2024 HIPAA rule’s restrictions for reproductive health information use and disclosures were “arbitrary and capricious” and “in excess of statutory authority,” impairing her clinic’s “state-mandated obligation to report child abuse” or to participate in public health investigations.

HHS, under the Trump administration, did not appeal the court’s June ruling in the Purl case, which said HHS had overstepped its authority in “distinguishing between types of health information to accomplish political ends like protecting access to abortion and gender-transition procedures,” the judge wrote.

A Texas federal court on Nov. 24 granted Paxton’s request to dismiss the state of Texas’ separate case filed in September 2024 to vacate the 2024 HIPAA privacy rule update – and also the much broader HIPAA privacy rule of 2000, arguing that HHS overstepped its authority with both (see: Texas AG Hopes to Upend HIPAA Rules to Investigate Abortions).

But some experts said that the Texas federal court ruling in the Purl case – which HHS did not appeal – overwhelmingly achieved what Texas’ attorney general was seeking in its lawsuit against HHS.

“The focus for Texas was reproductive healthcare,” said regulatory attorney Rachel Rose. “The 2024 HIPAA privacy final rule required a specific attestation by law enforcement, which Texas opposed,” she said. “With that off the table and the ability for records to be obtained, so long as the law enforcement exception is followed to protect due process, then there is no change to what was done in the past,” she said.

“The withdrawal of the lawsuit was prudent and won’t be disruptive to longstanding healthcare operations,” Rose said. Also, it is worth noting that the court opinion in the Purl ruling mentioned that Congress expressly authorized the 2000 HIPAA Privacy Rule, she said, underscoring how unlikely that a court would also deem the earlier 2000 rule to be unlawful.

“Achieving a vacatur of the 2000 privacy rule would be wildly unpopular with Americans who have grown to expect that their health information cannot be shared outside of specific scenarios,” said regulatory attorney Aleksandra Vold, a partner at law firm BakerHostetler.

In one major exception in the Purl case ruling in June, the Texas court did not vacate modifications contained in the 2024 HIPAA privacy rule related to substance disorder treatment information covered by another related confidentiality rule – 42 C.F.R. Part 2. Covered organizations still must update their notices of privacy practice by February 2026 under the rule.