ARTICLE
16 September 2024

Texas Challenges HHS's HIPAA Rule Protecting Reproductive Health Information From State Investigative Bodies

M
Mintz

Contributor

Mintz is a litigation powerhouse and business accelerator serving leaders in life sciences, private equity, sustainable energy, and technology. The world’s most innovative companies trust Mintz to provide expert advice, protect and monetize their IP, negotiate deals, source financing, and solve complex legal challenges. The firm has over 600 attorneys across offices in Boston, Los Angeles, Miami, New York, Washington, DC, San Francisco, San Diego, and Toronto.
Last week, Texas Attorney General Ken Paxton filed a complaint in federal district court against HHS and the Office for Civil Rights (OCR) challenging a recently issued rule strengthening protection of protected...
United States Texas Food, Drugs, Healthcare, Life Sciences

Last week, Texas Attorney General Ken Paxton filed a complaint in federal district court against HHS and the Office for Civil Rights (OCR) challenging a recently issued rule strengthening protection of protected health information (PHI) related to reproductive health. As summarized in a previous post, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (Final Rule), generally prohibits disclosure or use of PHI by a covered entity or their business associate for purposes of criminal, civil, or administrative investigations into persons for seeking, obtaining, providing, or facilitating reproductive health care under lawful circumstances. In its complaint, Texas argues that the Final Rule is unlawful and seeks to have it vacated.

Within the Final Rule, OCR defines reproductive health care broadly to include services such as abortions and gender affirming care. Texas is one of several U.S. states that prohibits abortion with limited exceptions for the life and health of the pregnant patient. The state's abortion law subjects those in violation to criminal and civil penalties.

Texas's Legal Arguments

In its complaint, Texas challenges the validity of provisions that limit disclosure of PHI to law enforcement in both the current HIPAA Privacy Rule (which dates back to 2000) and the 2024 Final Rule. Specifically, the current Privacy Rule allows covered entities to disclose PHI to law enforcement under a specific set of circumstances, and the 2024 Final Rule, as mentioned above, generally prohibits disclosure of reproductive health information for law enforcement purposes when services are provided under lawful circumstances. Texas makes four legal arguments against the two regulations in their complaint:

  1. Congress "specifically preserved State investigative authority" within the HIPAA statute, citing a provision limiting OCR's authority to limit disclosures of PHI in connection with states' oversight of public health and safety;
  2. The HIPAA statute does not give OCR authority to promulgate rules that limit how covered entities may share information with states;
  3. The state of Texas has been harmed by the regulations because they limit the state's investigative abilities, claiming the regulation has already blocked Texas's law enforcement's access to reproductive health information in at least one instance; and
  4. The regulations are arbitrary and capricious under the Administrative Procedure Act because HHS "failed to reasonably explain" tests and presumptions within the regulations, such as the presumption that reproductive health care was lawfully provided.

Takeaways

It is unclear whether the lawsuit currently has merit given the arguments Texas set forth. Key to the complaint's claims is that the Final Rule gives health care providers the discretion to determine whether care was legally provided, arguing that this determination should instead lie with law enforcement. Leaving this determination in the hands of the law enforcement officials requesting the information would render the rule and its protections futile.

Furthermore, Texas's assertion that the HIPAA statute protects state investigative authority relies on a specific provision, which states should not be construed to "invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention." The issue with relying on this provision is that (1) it does not specifically mention state laws, and (2) it only mentions investigative authority under the umbrella of public health not criminal laws aimed at curtailing the provision of reproductive health care.

This complaint is the first state challenge against the recently issued Final Rule. Texas's lawsuit is likely the first attempt of many to challenge the regulation, especially since numerous other states have similarly restrictive abortion laws. We will continue to track litigation challenging the Final Rule.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More