| Summary Points: |
- The Texas Attorney General filed suit against the Department of Health and Human Services (HHS) to block new privacy protections under the Health Insurance Portability and Accountability Act of 1995 (HIPAA) aimed at protecting patient reproductive health care information from going into effect later this year.
- The Attorney General also asked the court to invalidate long-standing provisions of HIPAA that limit when a provider or a plan can provide patient protected health information in response to a government investigation without the patient’s authorization, which would give a State investigatory agency unfettered access to such information.
- The case is pending before a judge that may be sympathetic to the Attorney General and any decision would be appealed to the Fifth Circuit, which already issued two abortion-related decisions in favor of Texas.
- This case, therefore, leaves substantial doubt regarding the long-term fate of these new privacy protections under HIPAA and when or whether the patient and provider protections in such rule will go into effect. Invalidation of this rule may have a chilling effect on access to abortion and other reproductive health care services.
|
Big Picture
Last week, Texas AG Ken Paxton (R) sued the Department of Health and Human Services (HHS), alleging that the new HHS final rule amending HIPAA regulations to strengthen protections for reproductive health information is unlawful and should be vacated (e.g., not go into effect). The complaint, filed in the Lubbock Division of the Northern District of Texas, alleges that the rule would harm Texas’s investigative abilities into medical care such as abortion, lacks statutory authority, and is arbitrary and capricious. The suit threatens to overturn the rule’s reproductive privacy protections, which are scheduled to go into effect on December 23, 2024.
In addition, the complaint requests that the court invalidate the HIPAA privacy provisions in effect since 2000 that limit when a health care provider or health plan can provide PHI in response to a government investigation.
Background
The Final Rule
HHS’s April rule titled “HIPAA Privacy Rule To Support Reproductive Health Care Privacy” is one of a number of actions taken by HHS to protect access to and privacy of reproductive health care in response to the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, overturning Roe v. Wade. That decision has led to state abortion bans and other restrictions on reproductive health care in 21 states—including Texas, where abortion is a crime in almost all circumstances.
The final rule seeks to address post-Dobbs concerns that protected health information (PHI) may be used in investigations or proceedings against individuals who seek legal reproductive health care or providers who furnish such care—potentially discouraging individuals from seeking lawful treatment from (or discussing it with) their provider and providers from providing reproductive health care. Specifically, the final rule prohibits the use or disclosure of PHI when it is sought to investigate or impose criminal, civil or administrative liability on individuals, health care providers or others who seek, obtain, provide or facilitate reproductive health care that is lawful under the circumstances in which such health care is provided, or to identify persons for such purposes. For example, the final rule would prohibit the Texas Attorney General from obtaining PHI from a New York-based provider who provided abortion care to a Texas resident when that care was provided in New York (where abortion is legal) if the Texas Attorney General requested that information so they could prosecute the individual (or the friend who drove the individual) under Texas anti-abortion laws.
The Lawsuit and Its Arguments
Paxton’s complaint is brief and alleges that HHS has promulgated the final rule to “obstruct States’ ability to enforce their own laws on abortion” and other laws that HHS deems to fall under the umbrella of “reproductive health care,” which is broadly defined in the final rule. The complaint alleges that the broad definition “clearly meant to encompass abortion, hormone and drug therapy for gender dysphoria, surgical procedures related to gender dysphoria, and gender experimentation.””
The complaint argues that Congress expressly preserved state investigative authority in the HIPAA statute and, as a result, HHS may not impose requirements contrary to and not authorized by the HIPAA statue. Thus, the complaint states the final rule unlawfully restricts state officials and law enforcement from obtaining evidence of a crime or other potential violation of state law.
“This new rule actively undermines Congress’s clear statutory meaning when HIPAA was passed, and it reflects the Biden Administration’s disrespect for the law,” said Paxton. “The federal government is attempting to undermine Texas’s law enforcement capabilities, and I will not allow this to happen.”
Relying on this same premise, the complaint goes one step further and also seeks to invalidate part of the original HIPAA privacy rule that dates back to 2000, which limits when law enforcement may obtain access to PHI without patient authorization . The Attorney General likely is challenging the older rule under the Supreme Court’s recent decision in Corner Post, Inc. v. Board of Governors of the Federal Reserve System, which allows challenges to federal rules that are filed more than six years after their issuance, if the plaintiff is newly injured by the rule, although the complaint does not cite to such case. The Attorney General has also filed the complaint in the shadow of the ruling in Loper Bright, in which the Supreme Court held that courts should not defer to agencies’ interpretation of statutes, as had previously occurred under the Chevron doctrine. Without the benefit of Chevron deference, the agency faces an uphill battle to demonstrate it had the authority to interpret the statute to limit a state’s ability to access PHI to conduct an investigation.
Implications for Patients and Providers
Attorney General Paxton may find a sympathetic ear in Judge James Wesley Hendrix, the federal judge assigned to the case. The Texas Attorney General has previously brought cases in the Lubbock division with the goal of the case being assigned to Judge Hendrix or the other judge in the district, both of whom are Republican appointees who have expressed skepticism of rulemaking from Democratic administrations. Regardless of who prevails, the case will likely be appealed. Any appeals will be brought before the Fifth Circuit, a conservative appellate court that has previously ruled in favor of Texas on two important abortion cases brought post-Dobbs.
The complaint, therefore, leaves substantial doubt regarding the long-term fate of the new privacy protections under HIPAA and when or whether the patient and provider protections in such rule will go into effect. Without the rule, providers may be more hesitant to provide reproductive health care services, even when legal, to individuals who are residents of states with abortion bans, and individuals residing in those states may be more cautious about seeking legal reproductive health care. However, for the time being, providers should plan for the final rule to go into effect, on December 23, 2024 deadline. Further, the litigation would have no impact on the numerous state laws that have been enacted post-Dobbs that are also intended to protect reproductive health care.