U.S. District Court Strikes Down HIPAA Privacy Rule Changes to Enhance Protections for Reproductive Health Care Information

            In a recent decision, a federal district court judge in Texas ruled that the U.S. Department of Health and Human Services (“HHS”) exceeded its authority when it issued rules requiring HIPAA covered entities to apply enhanced safeguards for reproductive health care information.  These rules were intended to protect patients who received lawful reproductive health care, and the providers who rendered the care, from investigations and prosecutions concerning this care.^[1] The decision in Purl v. U.S. DHHS^[2] applies nationwide and nullifies these rules. 

Background

            These rules were issued by HHS last year in response to both (i) the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization to eliminate the constitutional right to an abortion under Roe v. Wade, and (ii) demands for reproductive health records made by government agencies and private parties to reproductive health services providers both within their own states and in other states that have not restricted access to reproductive care services.  These enhanced protections applied to information about “reproductive health care”, broadly defined to include abortion, contraception, fertility, and other health care services concerning reproduction.

            Under these changes, covered entities and business associates were prohibited from disclosing PHI for the purposes of certain criminal, civil, or administrative investigations or to impose liability on a person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care where such care was lawful in the state where it was provided. To implement these protections, covered entities and business associates had to obtain a signed attestation from the requestor when the request for PHI was potentially related to reproductive health care. The attestation was required if the request was for health oversight activities, judicial or administrative proceedings, law enforcement purposes, or medical examiner duties. The attestation had to include specific information and representations about the request.

The Decision and its Effect

            The court in Purl determined that the rules exceeded HHS’s statutory authority by hampering state child abuse and neglect reporting laws and other public health laws, redefining terms that were already defined in statute, and implicating the “major questions doctrine” by touching on politically significant issues, such as reproductive health care, without Congressional authorization.

            The decision does not affect other changes to HIPAA that were issued in the same rulemaking as these protections to reproductive health care information, namely the requirement to include a statement in notices of privacy practices about the 42 C.F.R. Part 2 substance use disorder confidentiality protections. (Covered entities must make this change to their notices by February 16, 2026.) The decision also does not affect state law protections for reproductive health care information, such as Maine’s Act Regarding Legally Protected Health Care Activity. However, these state law protections may greatly differ in scope from the invalidated rules. State health care confidentiality laws also need to be analyzed to determine if they are preempted by HIPAA.  Generally, state laws that provide greater privacy protections than HIPAA are not preempted.

            As of the date this client alert was written, no appeal of the Purl decision has been filed. Nor has there been a challenge to the nationwide scope of the decision in light of the U.S. Supreme Court’s recent opinion limiting nationwide orders in U.S. v. CASA, Inc.  Kozak & Gayer will monitor developments and provide updates, as necessary.

            For now, HIPAA covered entities and business associates should review their policies, procedures, and practices with respect to reproductive health care information; communicate changes to staff; and educate staff who handle records requests about this decision and how it affects when such information can be withheld. Covered entities and business associates should be mindful of applicable state law protections when making and communicating these policy changes.

            If you have questions about the Purl decision and how it impacts your organization’s obligations with respect to reproductive health care information, we encourage you to contact a Kozak & Gayer attorney. 

[1] These rules were the subject of a previous Client Alert, available at:  https://www.kozakgayer.com/post/providers-should-prepare-to-comply-with-hipaa-privacy-rule-changes-to-enhance-protections-for-reprod.

[2] A copy of the decision is available at: https://caselaw.findlaw.com/court/us-dis-crt-n-d-tex-ama-div/117411800.html