HIPAA Privacy Rule Update Strengthening Reproductive Health Care Privacy Faces Another Legal Challenge
The final rule issued by the HHS’ Office for Civil Rights in 2024 that updated the HIPAA Privacy Rule to strengthen reproductive health information privacy is facing several legal challenges. The first lawsuit against the HHS over the final rule was filed in the US District Court for the Northern District of Texas in September 2024 by Texas Attorney General Ken Paxton, who alleges the new rule is unlawful as it violates the Administrative Procedure Act (APA) of 1946, a law that regulates how federal agencies promulgate and enforce rules. The lawsuit alleges the new rule is arbitrary, capricious, and without statutory authority, and is preventing the state of Texas from enforcing state rules on abortion and gender dysphoria treatment.
Another lawsuit was filed in the same Texas court in October 2024 on behalf of Texas healthcare providers that operate walk-in clinics. The lawsuit alleges the final rule interferes with doctors’ legal obligations under state law and limits when they can share reproductive health information, including to state welfare agencies and law enforcement, such as when reporting suspected abuse. The lawsuit makes similar arguments to the lawsuit filed by the Texas Attorney General.
Another lawsuit has now been filed in the District Court for the Eastern District Of Tennessee, Knoxville Division, against the HHS and HHS Secretary Xavier Becerra by Tennessee Attorney General Jonathan Skrmetti challenging the legality of the final fule. The lawsuit names a further 14 states as plaintiffs – Alabama, Arkansas, Georgia, Idaho, Iowa, Indiana, Louisiana, Montana, Nebraska, North Dakota, Ohio, South Carolina, South Dakota and West Virginia. The latest lawsuit similarly claims that the final rule is unlawful and is hampering states’ ability to gather information critical to investigating cases of serious misconduct such as child abuse, elder abuse, Medicaid billing fraud, and insurance-related malfeasance, as healthcare providers have been refusing to provide documents, in some cases even when subpoenas have been issued.
OCR published the HIPAA Privacy Rule to Support Reproductive Health Care Privacy final rule in April 2024, which took effect in June 2024. HIPAA-regulated entities have been required to comply with the final rule since December 23, 2024. The final rule prohibits disclosures of reproductive health information when that information is sought to investigate or impose liability on individuals, healthcare providers, or others who seek, obtain, provide, or facilitate reproductive healthcare that is lawful under the circumstances in which such healthcare is provided.
Before HIPAA-regulated entities can hand over reproductive health information, they must obtain a signed attestation that the information is not being requested for a restricted purpose. The lawsuit claims that healthcare providers are refusing to provide that information, although in some cases it appears that the states have been unwilling to provide a signed attestation. The lawsuit claims that even if an attestation is provided, HIPAA-regulated entities could still refuse to provide the requested documents. The lawsuit claims that multiple health-related and health-fraud investigations have come to a halt due to the final rule.
Under the Biden Investigation, the Department of Justice was instructed to fight these lawsuits but now there has been an administration change, that may no longer be the case. Should that happen, others may step in to fight the legal challenges. The Trump administration could take action in other ways, such as issuing an Executive Order preventing the HHS from enforcing the final rule, but it would require further rulemaking to overturn the final rule, which is a slow process. In the meantime, healthcare providers have been put ion a difficult position as they are required to comply with state laws and the HIPAA final rule.
