Reproductive Healthcare Privacy Rule Struck Down Nationwide by Texas Judge: What Providers and Employer-Sponsored Health Plans Must Know

A federal judge in Texas just tossed out Biden-era reproductive healthcare privacy protections, halting a 2024 final rule with nationwide effect. The rule, which largely took effect in December and created new HIPAA privacy requirements for healthcare providers, employer-sponsored group health plans, and other regulated entities, has been challenged in lawsuits brought by at least 17 states, as well as a private family medical practice in Texas that just won the June 18 nationwide injunction. We’ll explain everything you need to know and provide steps you should consider taking next.

Quick Background on the Reproductive Healthcare Privacy Rule

The US Department of Health and Human Services (HHS) issued a final rule last year that, among other things, prohibited the use or disclosure of protected health information for certain activities such as criminal investigations against individuals for seeking, obtaining, providing, or facilitating lawful reproductive healthcare.

The rule was issued over concerns that the Supreme Court’s 2022 Dobbs decision, which overturned Roe v. Wade and gave states much broader power to criminalize and regulate reproductive choices, would erode individuals’ trust in the healthcare system, particularly for patients who must travel across state lines to receive reproductive healthcare, such as contraception, prenatal care, or abortion.

A Closer Look at the 2024 HHS Rule

The 2024 HHS rule:

• became part of HIPAA’s “Privacy Rule,” which sets national standards for safeguarding individuals’ “protected health information” (PHI), such as their medical records and other individually identifiable health information;
• applies to covered entities under HIPAA, including healthcare providers, healthcare clearinghouses, health plans, as well as business associates; and
• defines “reproductive healthcare” broadly to include all healthcare matters related to the reproductive system or to its functions and processes.

Under the rule, covered entities (and, except for the third bullet point below, business associates) are:

• prohibited from using or disclosing PHI for certain activities, including to conduct investigations or impose liability on any person for the mere act of seeking, obtaining, or facilitating reproductive healthcare that is lawful under the circumstances, or to identify any person for such purpose (compliance deadline: December 23, 2024);
• required to obtain a signed attestation before using or disclosing any PHI potentially related to reproductive healthcare (compliance deadline: December 23, 2024); and
• required to update their Notices of Privacy Practices to incorporate the new reproductive healthcare privacy protections (compliance deadline: February 16, 2026).
  
  

Dive Deeper. We previously covered the 2024 HHS rule more in depth here: New HIPAA Privacy Protections for Reproductive Healthcare: What You Need to Know and 5 Steps You Can Take Now.

Rule Faced Many Lawsuits – But Trump’s HHS Kept Them in Play

The fate of the 2024 reproductive healthcare privacy rule had been in question due to major policy shifts under the Trump administration as well as several ongoing federal lawsuits. While many believed Trump’s HHS would modify or revoke the rule, or otherwise stop defending it in court, the agency reported in May that it had no immediate plans to change the rule and that it did not seek to pause any of the litigation over it going forward.

Here’s a snapshot of each of the lawsuits:

• Texas v. HHS (U.S. District Court for the Northern District of Texas – Lubbock). First, the State of Texas sued HHS in September, alleging that the agency’s 2024 rule unlawfully interferes with the state’s authority to investigate violations of state law and are otherwise arbitrary and capricious. Shortly after Trump took office, however, HHS asked the court to hit pause on the case so that incoming leadership personnel at the agency could have time to evaluate their position and determine how to proceed. But the agency signaled in May that it would be moving forward with the case. HHS must submit a court filing in support of its position by June 30, and Texas is required to file its reply by July 11. Stay tuned to see how this plays out.
• Purl v. HHS (U.S. District Court for the Northern District of Texas – Amarillo). In October, a private medical practice and its sole owner, a family medicine physician, brought a similar challenge in the Amarillo division of the same Texas district court, claiming that the 2024 rule is arbitrary and capricious, lacks statutory authority, and “inserts abortion, gender identity, and other topics” into the regulations under HIPAA, “which has nothing at all to do with those topics.” In December, Judge Matthew Kacsmaryk granted Dr. Carmen Purl’s request by temporarily blocking HHS from enforcing the rule against Dr. Purl and her practice while the lawsuit plays out in court. The injunction did not impact the agency’s ability to enforce the rule beyond Dr. Purl and her practice.
• Dr. Purl Wins Nationwide Injunction After HHS Declines to Pause the Case. Judge Kacsmaryk asked HHS last month to clarify where the agency stood on the 2024 rule and whether it wished to put the case on ice. In response, HHS said in a May 12 filing that “the Rule remains among a number of agency actions from the prior administration that are under consideration at HHS, but given other agency priorities, no imminent action on the Rule is expected.” The agency also said that it was not requesting a pause on the proceedings. Kacsmaryk then issued a decision on June 18 that blocked the rule nationwide – we’ll discuss this ruling more in depth below.
• Other Pending Challenges to the 2024 Reproductive Healthcare Privacy Rule. In addition to the Texas and Purl cases, the 2024 rule has been challenged in two other similar lawsuits, including one brought by the State of Missouri, and another brought by a group of 15 states including Tennessee, joined by Alabama, Arkansas, Georgia, Idaho, Indiana, Iowa, Louisiana, Montana, Nebraska, North Dakota, Ohio, South Carolina, South Dakota, and West Virginia. Both lawsuits are ongoing.

The Nationwide Injunction in Purl v. Texas

In a June 18 decision, Judge Kacsmaryk set aside the new reproductive healthcare privacy protections, blocking most of the 2024 reproductive healthcare privacy rule with nationwide effect based on three reasons. According to the Texas federal court:

1. “First, the HIPPA[sic] Privacy Rule to Support Reproductive Health Care Privacy is ‘contrary to law’ because it unlawfully ‘limits’ state public health laws.” Specifically, for example, the court agreed with Dr. Purl that the 2024 rule restricts potential child abuse reporting – a theory that HHS called “imaginary” because, the agency said, the rule does not limit the ability to report child abuse in any way.

2. “Second, the 2024 Rule impermissibly redefines ‘person’ and ‘public health,’ in contravention of Federal law and ‘in excess of statutory authority.’” In particular, the court held that HHS was not authorized to interpret “persons,” an undefined term under HIPAA, as excluding unborn children, nor was it authorized to redefine “public health”– one of the specified purposes under HIPAA that permits disclosures of PHI – as excluding efforts to conduct investigations or impose liability on individuals who seek or obtain lawful reproductive healthcare.

3. “Third, under the ‘major-questions doctrine,’ the 2024 Rule arrogates to HHS authority not expressly delegated by Congress.” The court went on to say that the agency cannot create heightened protections for information about “politically favored procedures,” and that “until the people speak through their representatives, agencies must fall silent on issues of abortion or other matters of great political significance.”

The court did, however, leave in place portions of the rule requiring modifications to the Notice of Privacy Practices (NPP) to cover HIPAA privacy protections for substance use disorder treatment records added by a different HHS rule issued last year (the 2024 “Part 2” Rule).

What Healthcare Providers and Employer-Sponsored Health Plans Should Do Now

• Stay Tuned. The latest decision in Purl v. HHS could be appealed by the agency, and other court challenges over the 2024 rule are ongoing.
• Watch Out for State Laws. A growing number of states maintain consumer health data protections, which often aim to protect data related to reproductive healthcare services post-Dobbs – creating a patchwork of duties and possible liabilities.
• Revise Your NPP (Part 2 Programs). Remember that the nationwide injunction left in place requirements to modify the Notice of Privacy Practices to address recent changes to the HIPAA protections for substance use disorder treatment records.
• Work With Counsel on All HIPAA Compliance Matters. This is especially true given the latest and ongoing HIPAA developments. And while the reproductive healthcare privacy protections are shelfed for now, the fate of other HHS initiatives – such as proposed updates to the HIPAA Security Rule that would require entities to adopt enhanced cybersecurity measures – remains an open question.

Conclusion

If you have questions, please contact your Fisher Phillips attorney, the authors of this Insight, any attorney on our Healthcare Industry Team, any attorney in our Employee Benefits and Tax Practice Group, or any attorney in our Privacy and Cyber Group. Make sure you are subscribed to Fisher Phillips’ Insight System to get the most up-to-date information on this and other employment topics directly to your inbox.