HIPAA Reproductive Health Care Amendments: Compliance in an Uncertain Enforcement Landscape

The amendments to the HIPAA Privacy Rule designed to protect reproductive health care information (Amendments) are under legal challenge as the compliance date quickly approaches.

As discussed in more detail in our previous post, regulated entities are required to comply with the Amendments by December 23, 2024 (with a later February 16, 2026 compliance date for the required changes to the Notice of Privacy Practices). Recent legal challenges and a new incoming presidential administration make the enforcement landscape for these Amendments unclear. However, at the time this blog is being published, regulated entities should be prepared to comply as of December 23, 2024.

Recent Cases Challenging the Amendments

Two lawsuits have been filed in the Northern District of Texas against the Department of Health and Human Services (HHS), seeking to invalidate the Amendments. The lawsuits argue that the Amendments violate the Administrative Procedure Act (APA), which governs how federal agencies promulgate and enforce rules and regulations. The plaintiffs argue that under the APA, a court must set aside an agency action that exceeds an agency’s statutory authority, or actions that are determined to be arbitrary, capricious, an abuse of discretion, or not in accordance with the law.

The first lawsuit, State of Texas v. HHS,[1] was filed by the Texas Attorney General in September 2024. The Texas Attorney General claims that HIPAA preserves state investigative authority related to the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention, and thus HHS exceeded its statutory authority by prohibiting regulated entities from disclosing reproductive health care information to state investigators. The Attorney General takes the position that HHS exceeds its statutory authority, as the Amendments obstruct a state’s ability to enforce its own laws on reproductive health care, including abortion and gender affirming care. The Texas Attorney General also seeks to invalidate provisions of the HIPAA Privacy Rule from 2000, claiming that Congress never intended to allow HHS to limit the circumstances related to when a regulated entity can disclose protected health information to law enforcement.

The second lawsuit, Purl v. HHS,[2] was brought by a Texas physician who makes claims similar to the Texas Attorney General. However, the physician claims the Amendments prohibit physicians from reporting abuse or neglect if it involves anything related to reproductive health care, including abortion or gender-transition procedures, or to participate and comply with requests made by law enforcement. Further, the physician argues that the Amendments were arbitrary and capricious because HHS failed to adequately explain why they are implementing these new prohibitions and requirements for reasons other than a response to the Supreme Court’s opinion in Dobbs v. Jackson Women’s Health Organization.[3]

In HHS’ filed response and objection to the Purl case, HHS argues that the Amendments do not interfere with the physician’s duty to report suspected abuse or neglect under state law. Specifically, HHS focused on the fact that the Amendments preserve the definition of “public health,” which includes surveillance, investigation, and intervention as a means to prevent diseases and promote the health of populations, as opposed to conducting investigations or imposing liability on individuals seeking health care. HHS argues that because the Amendments preserved this definition, they do not limit a physician’s ability to report abuse or neglect. Instead, the Amendments only prohibit a physician’s ability to report about activities related to a person seeking, obtaining, providing, or facilitating reproductive health care and thus suspected abuse would be excluded from the prohibition on disclosure.

Change in Administration

It is also unclear at this time if HHS under the Trump Administration will continue to defend these lawsuits and/or enforce these Amendments. However, from December 23, 2024 until the time the court rules on these legality of the Amendments or there is concrete guidance from the Trump Administration once in office, regulated entities should comply with the Amendments when using or disclosing reproductive health care information.

HHS Doubles Down on Support of Reproductive Health Care Information Privacy in Recent Settlement

In November 2024, HHS settled with a hospital for impermissibly disclosing a patient’s full medical record to the patient’s potential employer; the patient had signed an authorization that authorized disclosure of only one test result. The information disclosed included reproductive health care information, which HHS focused on its public statements regarding the settlement — despite this disclosure occurring before the required compliance date of the Amendments.

In the linked press release, HHS stated, “Patients must be able to trust that sensitive, health information in their files is protected to preserve their trust in the patient-doctor relationship and ensure they get the care they need. This is particularly true for reproductive health privacy.” The headline regarding the settlement released by HHS also included the phrase “reproductive health information.” This is indicative of the support that the current HHS has for these Amendments.

Key Takeaways

Although the future of the Amendments is unclear, as of December 23, 2024, regulated entities should be prepared to comply with the Amendments when using or disclosing reproductive health care information until further notice. To prepare to comply, regulated entities should:

Update HIPAA privacy policies and processes to ensure reproductive health care information is not used or disclosed in violation of the Amendments.
Obtain attestations before reproductive health care information is disclosed to health oversight agencies, law enforcement, or coroners or medical examiners, or in judicial or administrative proceedings (including in response to subpoenas and court orders).
Implement updated training for workforce members responsible for disclosing health information to third parties to ensure compliance with the Amendments.

Health care data privacy continues to rapidly evolve and thus regulated entities should closely monitor any new developments and continue to take necessary steps towards compliance. If you have any questions on compliance with the Final Rule and other recent changes to health care data privacy laws, please contact any of the authors or any of the Partners or Senior Counsel in Foley’s Cybersecurity and Data Privacy Group or Health Care Practice Group

[1] Texas v. Dep’t Health & Hum. Servs., No. 5:24-cv-00204 (N.D. Tex. Sept. 4, 2024).

[2] Purl v. Dep’t Health & Hum. Servs., No. 2:24-cv-00228 (N.D. Tex. Oct. 21, 2024).

[3] Dobbs v. Jackson Women’s Health Org., 597 U.S. 215 (2022).

Disclaimer

This blog is made available by Foley & Lardner LLP (“Foley” or “the Firm”) for informational purposes only. It is not meant to convey the Firm’s legal position on behalf of any client, nor is it intended to convey specific legal advice. Any opinions expressed in this article do not necessarily reflect the views of Foley & Lardner LLP, its partners, or its clients. Accordingly, do not act upon this information without seeking counsel from a licensed attorney. This blog is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Communicating with Foley through this website by email, blog post, or otherwise, does not create an attorney-client relationship for any legal matter. Therefore, any communication or material you transmit to Foley through this blog, whether by email, blog post or any other manner, will not be treated as confidential or proprietary. The information on this blog is published “AS IS” and is not guaranteed to be complete, accurate, and or up-to-date. Foley makes no representations or warranties of any kind, express or implied, as to the operation or content of the site. Foley expressly disclaims all other guarantees, warranties, conditions and representations of any kind, either express or implied, whether arising under any statute, law, commercial use or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Foley or any of its partners, officers, employees, agents or affiliates be liable, directly or indirectly, under any theory of law (contract, tort, negligence or otherwise), to you or anyone else, for any claims, losses or damages, direct, indirect special, incidental, punitive or consequential, resulting from or occasioned by the creation, use of or reliance on this site (including information and other content) or any third party websites or the information, resources or material accessed through any such websites. In some jurisdictions, the contents of this blog may be considered Attorney Advertising. If applicable, please note that prior results do not guarantee a similar outcome. Photographs are for dramatization purposes only and may include models. Likenesses do not necessarily imply current client, partnership or employee status.