Texas Sues HHS to Vacate HIPAA Privacy Rule and Reproductive Healthcare Privacy Rule
The state of Texas is suing the U.S. Department of Health and Human Services (HHS), HHS Secretary Xavier Becerra, and HHSโ Office for Civil Rights (OCR) Director Melanie Fontes Rainer and is seeking declaratory and injunctive relief against the enforcement of two final rules, which the lawsuit claims are hampering the stateโs investigations of reproductive healthcare and other cases.
The lawsuit takes aim at portions of the Standards for Privacy of Individually Identifiable Health Information, better known as the HIPAA Privacy Rule of 2000, and the more recent HIPAA Privacy Rule to Support Reproductive Health Care Privacy final rule, which took effect on June 23, 2024, and has a compliance date of December 23, 2024.ย Both final rules limit the circumstances when a HIPAA-covered entity may share information with state officials and law enforcement, and should any HIPAA-regulated entities share information in violation of the final rules, they can incur criminal liability.
The HIPAA Privacy Rule has been in effect for more than two decades and introduced standards covering uses and disclosures of protected health information (PHI) and gave individuals rights over their healthcare information. The specific issue that the lawsuit aims at is the inclusion of conditions for disclosures of PHI to state law enforcement and state officials.
The 2020 HIPAA Privacy Rule states that disclosures of PHI to state law enforcement and state officials are only permitted when:
- The information sought is relevant and material to a legitimate law enforcement inquiry;
- The request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and
- De-identified information could not reasonably be used.
The lawsuit alleges the HHS did not have the authority to implement those conditions on disclosures of PHI to state governments, as the HIPAA statute sought to preserve the authority of states to obtain PHI to allow them to investigate and enforce state laws.
The 2024 final rule was introduced to strengthen the protections for reproductive health information in response to the Supreme Court decision that overturned Roe v. Wade, which for the past 50 years has provided individuals with the federal right to an abortion. The decision left it to individual states to decide whether abortions are legal.
Specifically, the 2024 final rule โProhibits the use or disclosure of PHI when it is sought to investigate or impose liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate reproductive health care that is lawful under the circumstances in which such health care is provided, or to identify persons for such activities.โ The final rule was introduced to protect the privacy of individuals who travel over state lines to obtain legal reproductive healthcare that is no longer legal in their home state.
The crux of the lawsuit is that HIPAA explicitly preserves state investigative authority, yet both of the final rules are contrary to the HIPAA statute. The lawsuit alleges the HIPAA statute does not give the HHS the authority to promulgate rules that limit the information that HIPAA-regulated entities may share with state governments.
The lawsuit states that the HHS is subject to the Administrative Procedure Act (APA) of 1946, and the final rules violate the APA as the HHS has no authority to impose requirements in excess of HIPAA. As such, the lawsuit is seeking to have both final rules vacated and set aside as they are arbitrary and capricious.
โThis new rule actively undermines Congressโs clear statutory meaning when HIPAA was passed, and it reflects the Biden Administrationโs disrespect for the law,โ said Texas Attorney General Ken Paxton. โThe federal government is attempting to undermine Texasโs law enforcement capabilities, and I will not allow this to happen.โ
While the lawsuit is concerned with removing restrictions on the PHI that can be disclosed to states, if the lawsuit succeeds, then it is not only reproductive health information privacy that will be at risk as states will be permitted to request access to PHI and those requests will no longer need to be limited to legitimate law enforcement inquiries.
While a judge may choose to vacate the portions of the HIPAA Privacy Rule regarding disclosures of PHI to states, the lawsuit is seeking to have the HIPAA Privacy Rule vacated. If the HIPAA Privacy Rule is overturned, then potentially so too would be the restrictions on the uses and disclosures of PHI by HIPAA-regulated entities as well as patient rights that have stood for two decades.