HIPAA Privacy Rule Challenge Dropped by Texas Attorney General
Last year, Texas Attorney General Ken Paxton challenged the HHS’ Office for Civil Rights (OCR) HIPAA Privacy Rule update to strengthen reproductive healthcare privacy and also sought to vacate the HIPAA Privacy Rule, which has been in effect for a quarter of a century. Those legal challenges have now been withdrawn, after the Texas Attorney General moved for and was granted a joint stipulation of dismissal without prejudice.
2024’s 291-page HIPAA Privacy Rule to Support Reproductive Health Care Privacy updated the 25-year-old HIPAA Privacy Rule in response to the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization in 2022, which overturned Roe v. Wade, removing the federal right to abortion. The legality of abortion became a state matter, and almost half of U.S. states introduced legislation limiting or banning abortion for state residents.
The update to the Privacy Rule was signed into law under the Biden administration, strengthening protections for reproductive health information by prohibiting disclosures of reproductive health information to government authorities and law enforcement related to individuals who sought, received, aided, or provided legal reproductive health care. The update shielded both patients and healthcare providers from prosecution for providing or receiving legally-provided abortion care and other reproductive healthcare.
AG Paxton believed the HIPAA Privacy Rule update to be unlawful and claimed the HHS had overstepped its authority by issuing the update, which prevented states from enforcing their own laws. A separate legal challenge was filed by Dr. Carmen Purl, who operated Dr. Purl’s Fast Care Walk-In Clinic in Texas, which also sought to have the HIPAA Privacy Rule update vacated. Dr. Purl claimed the restrictions on disclosures of reproductive health information were arbitrary and capricious, in excess of the HHS’s statutory authority, and impaired the ability of her clinic to comply with state laws that required disclosures of reproductive health information to state authorities related to potential child abuse.
Dr. Purl’s lawsuit was successful, resulting in the HIPAA Privacy Rule update being vacated nationwide. The HHS did not challenge the Texas court’s decision. With the HIPAA Privacy Rule update vacated, the main objectives of AG Paxton’s lawsuit were achieved. AG Paxton also sought to have the HIPAA Privacy Rule of 2000 vacated, which would have caused considerable disruption to healthcare operations had it been successful. That challenge was also withdrawn.
While the HIPAA Privacy Rule update was vacated, the modifications related to substance use disorder – the Part 2 regulations – concerning notice of privacy practices were not vacated. The compliance date for updating notice of privacy practices remains, compliance with which is required by February 16, 2026.
