States Challenge HIPAA Privacy Rule Update Strengthening Reproductive Health Information Privacy
A complaint has been filed in the U.S. District Court for the Eastern District of Tennessee in Knoxville led by Tennessee Attorney General Jonathan Skrmetti challenging the legality of the update to the HIPAA Privacy Rule enacted by the Department of Health and Human Services to strengthen reproductive health information privacy. The lawsuit names 14 other states as plaintiffs – Alabama, Arkansas, Georgia, Idaho, Indiana, Iowa, Louisiana, Montana, Nebraska, North Dakota, Ohio, South Carolina, South Dakota, and West Virginia. Texas is pursuing its own legal challenge against the update to the HIPAA Privacy Rule.
States challenging the HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy
The HHS issued the HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy (Final Rule) in response to the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization that led to state abortion bans and other restrictions on reproductive freedom in 21 states. There were legitimate concerns that states with bans on abortions may attempt to take legal action against individuals who travel out of state to obtain lawful abortions in states with more permissive rules, as well as against healthcare professionals who provide or facilitate legal reproductive care.
The Final Rule took effect on June 25, 2024, and compliance has been mandatory since December 23, 2024. The Final Rule requires HIPAA-regulated entities to obtain a signed attestation when a request is received for protected health information (PHI) potentially related to reproductive health care that the use or disclosure is not for a prohibited purpose. The rule applies to requests for PHI for health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners.
Similar to the complaint filed by the Texas Attorney General, the plaintiffs allege that “The Final Rule will hamper States’ ability to gather information critical to policing serious misconduct like Medicaid billing fraud, child and elder abuse, and insurance-related malfeasance.” The lawsuit also alleges the Final Rule flouts HIPAA, which specifically preserves States’ authority to investigate healthcare-related issues. “The slapdash HIPAA rule rushed out the door by the administration for political purposes is both unlawful and impractical,” said Attorney General Skrmetti on X. “The admin’s efforts to hamstring enforcement of conservative state laws have created significant obstacles for everyday investigations of misbehaving health care providers, including our ongoing investigation of a Nashville IVF clinic.”
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The Texas Attorney General is seeking discovery in consumer protection litigation against a physician in a Nashville IVF clinic concerning business practices alleged to have harmed the clinic’s patients. An attestation is required under the Final Rule to obtain reproductive health information, “which a state employee must sign under pain of criminal liability.” Without that attestation, the records will not be provided since they fall under the Final Rule’s broad definition of reproductive health information. The lawsuit claims, “Even if the State provides that attestation, the discovery could be denied if the covered entity determines that the relevant information would be used to impose liability for the “mere act” of providing or facilitating reproductive health care.”
The lawsuit explains that other States’ efforts to obtain reproductive health information have been thwarted as, per the Final Rule, HIPAA-regulated entities have refused to provide the records without a signed attestation, even when presented with a subpoena for those records. The lawsuit states that as a result of the Final Rule, States’ investigations have ground to a halt, including investigations related to fraud, abuse, neglect, and other health-related violations, suggesting States have been unwilling to provide signed attestations.
The lawsuit names the HHS and HHS Secretary Xavier Becerra (in his capacity as HHS Secretary) as defendants and asserts claims of violations of the Administrative Procedure Act (APA) of 1946 – agency action in excess of statutory authority and arbitrary and capricious agency action – and asks the court to enjoin, declare unlawful, and set aside the Final Rule. If the lawsuit is successful, it would mean that any individual traveling out of state to have a legal abortion in another state could be prosecuted along with any medical professional who provided or facilitated that care. Some states have implemented shield laws to protect healthcare professionals who provide legal reproductive healthcare. One such shield law is currently being tested, as the Texas Attorney General is suing a New York doctor for providing abortion pills to a Texas resident.
While these challenges are set to play out in the courts, the new administration could choose not to fight the legal challenges in court or an executive order could be issued preventing the HHS from enforcing the rule. Former HHS’ Office for Civil Rights Director Roger Severino, who served for four years under the previous Trump Administration, has voiced his support for scrapping the new rule, although that would require further rulemaking.
