Getty Images

News

Texas sues HHS over HIPAA rule on reproductive health data

The Texas attorney general alleged that an HHS rule that protects reproductive health data unlawfully prevents states from using their investigative authority.

Jill McKeon
By
Published: 12 Sep 2024

Texas Attorney General Ken Paxton sued HHS over a final rule under HIPAA that aims to protect reproductive health data from law enforcement investigations. The rule, entitled "HIPAA Privacy Rule to Support Reproductive Health Care Privacy," prohibits the disclosure of protected health information when it is sought to investigate or impose liability on patients, providers or others who facilitate lawful reproductive care.

In the lawsuit, Paxton alleged that the 2024 rule, along with a 2000 rule issued under HIPAA called the "Standards for Privacy of Individually Identifiable Health Information," unlawfully prevents states from using their investigative authority and goes against existing provisions within HIPAA that are designed to preserve that authority.

Background

After the fall of Roe v. Wade in 2022, HHS issued a Notice of Proposed Rulemaking concerning the safeguarding of reproductive health data in April 2023 and received nearly 30,000 comments in response. The final rule took those comments into account and placed emphasis on a patient's right to privacy under HIPAA when seeking lawful reproductive care.

Along with preventing the use or disclosure of protected health information when it is sought to impose liability on those seeking or providing reproductive care, the rule requires covered entities to obtain a signed attestation that certain requests for PHI are not for the aforementioned purposes.

What's more, covered providers, health plans and clearinghouses must modify their Notice of Privacy Practices to further support reproductive healthcare data privacy.

"Many Americans are scared their private medical information will be being shared, misused, and disclosed without permission. This has a chilling effect on women visiting a doctor, picking up a prescription from a pharmacy, or taking other necessary actions to support their health," HHS Secretary Xavier Becerra said when the rule was issued.

"The Biden-Harris Administration is providing stronger protections to people seeking lawful reproductive health care regardless of whether the care is in their home state or if they must cross state lines to get it. With reproductive health under attack by some lawmakers, these protections are more important than ever."

The lawsuit's claims

Now Becerra, his department and his colleague Melanie Fontes Ranier, director of the HHS Office for Civil Rights, are on the receiving end of Paxton's lawsuit.

"This new rule actively undermines Congress's clear statutory meaning when HIPAA was passed, and it reflects the Biden Administration's disrespect for the law," Paxton stated in a press release. "The federal government is attempting to undermine Texas's law enforcement capabilities, and I will not allow this to happen."

The lawsuit targeted the 2000 rule, stating that it "purports to limit the circumstances when a HIPAA-covered entity can share information with state law enforcement and state officials."

Essentially, the lawsuit claimed that HHS overreached its authority by using HIPAA to limit state investigative authority, despite Congress "going out of its way to preserve state investigative authority" in the original statute.

The lawsuit alleged that the two rules violate the Administrative Procedure Act, which dictates the process by which federal entities develop regulations, because they are contrary to statute and exceed the authority granted by Congress.

Reactions to the lawsuit

Kwame Raoul, the Illinois attorney general, issued a statement following the filing of the lawsuit, calling it a "cruel attack that only serves to instill fear and punish people across the country for accessing medical care."

"This action is a move to reach outside of Texas' own borders and impose its abortion restrictions on states like Illinois where we respect bodily autonomy and a woman's right to choose," Raoul stated.

"No matter where you live, every person deserves to have their personal medical information remain private and confidential -- and that unequivocally includes any medical records related to reproductive and gender-affirming health care."

Raoul reaffirmed his commitment to protecting patients and providers in Illinois from out-of-state probes into lawful healthcare procedures.

Jill McKeon has covered healthcare cybersecurity and privacy news since 2021.

Dig Deeper on HIPAA compliance and regulation