Last week, Texas Attorney General Ken Paxton filed a complaint in federal district court against HHS and the Office for Civil Rights (OCR), challenging recently issued rules that strengthen protections for protected health information (PHI) related to reproductive health. As summarized in a previous post, the HIPAA Privacy Rule Supporting Reproductive Health Care Privacy (Final Rule) generally prohibits a covered entity or its business associates from disclosing or using PHI for purposes of a criminal, civil, or administrative investigation of a person who sought, obtained, provided, or facilitated reproductive health care under lawful circumstances. In its complaint, Texas argues that the Final Rule is unlawful and seeks to have it invalidated.
In the final rule, OCR broadly defines reproductive health care to include services such as abortion and gender reassignment care. Texas is one of only a few states in the U.S. that bans abortion, with limited exceptions to the life and health of the pregnant patient. Texas’ abortion law carries criminal and civil penalties for violators.
Texas Legal Claims
In its complaint, Texas challenges the validity of provisions limiting disclosure of PHI to law enforcement in both the current HIPAA Privacy Rule (dating back to 2000) and the 2024 Final Rule. Specifically, while the current Privacy Rule permits covered entities to disclose PHI to law enforcement in certain circumstances, the 2024 Final Rule, as discussed above, generally prohibits disclosure of reproductive health information for law enforcement purposes when services are provided in lawful circumstances. In its complaint, Texas makes four legal claims against the two regulations:
Congress “clearly preserved state investigative powers” within the HIPAA statute, citing provisions that limit OCR’s ability to restrict disclosure of PHI in connection with state public health and safety oversight. HIPAA does not give OCR the authority to promulgate rules that limit how covered entities can share information with states. Texas argues that it is harmed because the regulation limits the state’s investigative ability, and that in at least one instance, the regulation has blocked Texas law enforcement’s access to reproductive health information. And because HHS “failed to reasonably explain” the tests and presumptions in the regulation, including the presumption that reproductive health care was lawfully provided, the regulation is arbitrary and capricious under the Administrative Procedure Act.
summary
Based on the arguments presented by Texas, it is unclear whether this lawsuit has merit at this time. A key claim in the complaint is that the final rule gives health care providers discretion to determine whether health care was provided lawfully, a decision that law enforcement should make. Leaving this determination in the hands of law enforcement agencies requesting information renders the rule and its protections meaningless.
Moreover, Texas’ argument that HIPAA protects state investigative powers relies on a specific provision that should not be interpreted to “override or limit any authority, power, or procedure established under law providing for the reporting of illness or injury, child abuse, birth, death, public health surveillance, or public health investigations or interventions.” The problem with relying on this provision is that (1) it does not specifically mention state law and (2) it only mentions investigative powers that fall under the public health umbrella, not criminal law, intended to restrict the provision of reproductive health care.
This complaint is the first lawsuit by a state challenging the recently issued final rule. The Texas lawsuit is likely to be the first of many challenging the regulation, especially since many other states have similarly restrictive abortion laws. We will continue to track the litigation challenging the final rule.
