HIPAA Abortion Privacy Protections Vacated by Texas Judge
A Texas District Court Judge has vacated a 2024 HIPAA Privacy Rule update that was issued by the Department of Health and Human Services (HHS) under the Biden administration to strengthen protections for reproductive healthcare information. The HIPAA Privacy Rule to Support Reproductive Health Care Privacy increased protections for reproductive health information in response to the Supreme Court’s 2022 decision in Dobbs v. Jackson Women’s Health Organization, which removed the federal right to an abortion and allowed individual states to introduce their own laws on abortion care. Since the Supreme Court’s decision, at least 19 U.S. states have introduced laws banning or restricting abortions.
Prior to the final rule being issued, HIPAA allowed but did not require disclosures of PHI to law enforcement; however, the HHS believed that the HIPAA Privacy Rule required an update to prohibit disclosures of protected health information (PHI) in response to subpoenas and requests from law enforcement to investigate legally provided abortions. There were concerns that some states would seek to hold women and healthcare providers liable for abortions performed legally, but on an individual who resided in a state with an abortion ban.
The HIPAA Privacy Rule to Support Reproductive Health Care Privacy was published in the Federal Register in April 2024, and compliance was required by December 23, 2024. In April, then-HHS Secretary Xavier Becerra said the Rule was issued to ensure the privacy of individuals seeking legal reproductive care would be protected, regardless of whether the care was provided in their home state or if they needed to cross state lines to receive the care.
Soon after the final rule was published, a lawsuit was filed in the U.S. District Court for the Northern District of Texas against the HHS challenging the legality of the final rule. The lawsuit, Purl v. United States Department of Health and Human Services, was filed by Dr. Carmen Purl, who owns a Texas clinic. At the practice, Dr. Purl had treated hundreds of child abuse victims and claimed that the HHS guidance impaired her clinic’s state-mandated obligation to report child abuse and to participate in public health investigations. She claimed in the lawsuit that the guidance was unlawful, in excess of the HHS’s statutory authority, and the restrictions placed on disclosures of PHI were arbitrary and capricious.
U.S. District Judge Matthew Kacsmaryk agreed with the plaintiff, and while various remedies were considered, he decided to vacate the final rule, which means his decision applies not just in the state of Texas but nationwide. “In sum, HIPAA confers authority to promulgate regulations protecting ‘individually identifiable health information.’ But it confers no authority to distinguish between types of health information to accomplish political ends like protecting access to abortion and gender-transition procedures,” Judge Kacsmaryk wrote.
The decision means that the HIPAA Privacy Rule reverts to its prior form, which means that HIPAA-regulated entities are no longer prohibited from disclosing PHI in relation to an investigation of legal abortion care, and they do not need to obtain an attestation from the requestor of PHI that the disclosure not sought for the purpose of investigating legally-provided reproductive healthcare.
That does not mean that HIPAA-regulated entities must disclose PHI to law enforcement to support an investigation of a legally-provided abortion or other reproductive healthcare, as the HIPAA Privacy Rule does not require such disclosures. HIPAA-regulated entities must ensure that they comply with state laws regarding disclosures of protected health information or reproductive healthcare information, and should consider litigation risks before making such a disclosure.
This is not the only legal challenge to the HHS final rule. Other legal challenges are still pending, including a challenge in federal court in Tennessee filed by 15 state attorneys general seeking to overturn the final rule. Those lawsuits may be dropped now that the final rule has been vacated. The HHS has yet to respond to the Texas Court’s decision, and may choose to appeal the decision.
