Compliance Eve Ends with HIPAA Reproductive Health Privacy Rule Order out of Texas: But is it a Gift or Lump of Coal for Regulated Entities?
Today, December 23, 2024, is the compliance deadline for HIPAA covered entities and business associates to apply the protections of the HIPAA Privacy Rule to support Reproductive Health Care Privacy Final Rule—that is all covered entities and business associates except two.
Yesterday, December 22, 2024, a federal district court in Texas enjoined the US Department of Health and Human Services (“HHS”) from enforcing the Reproductive Health Care Privacy Final Rule (“2024 Reproductive Privacy Rule” or “Final Rule”) against Carmen Purl, M.D. and Dr. Purl’s Fast Care Walk In Clinic. To reach this conclusion, the federal judge determined that Dr. Purl has at least a “reasonably probable chance” of prevailing in her lawsuit alleging that HHS exceeded its statutory authority under HIPAA when it published the 2024 Reproductive Privacy Rule. The Final Rule is in full effect for all other covered entities and business associates in all 50 states.
Soon after our October alert about a lawsuit brought by the State of Texas challenging the 2024 Reproductive Privacy Rule, Dr. Purl also sued HHS alleging that HHS exceeded its statutory authority when issuing the Rule in April. (Unlike the State of Texas, Dr. Purl’s case does not challenge aspects of the original 2000 Privacy Rule.) While Dr. Purl’s case to set aside the 2024 Reproductive Privacy Rule is pending, she sought protection against its requirements that she argued would limit her ability to report child abuse consistent with Texas law. The restrictions of the 2024 Reproductive Privacy Rule, the argument continues, are contrary to a congressional mandate that nothing in HIPAA shall “limit the authority, power, or procedures established under any law providing for the reporting of … child abuse …” The Court found Dr. Purl’s argument that Final Rule limits her ability to report child abuse – even if it does not completely prohibit it – sufficiently strong to justify an order protecting her against enforcement while the case is decided on the merits.
We expect that neither of these two Northern District of Texas cases challenging the 2024 Reproductive Privacy Rule will be decided before January 20, when new leadership at HHS and the Department of Justice may take a different approach to addressing reproductive health care privacy. It is possible that a new administration could concede the court challenges to the 2024 Reproductive Privacy Rule, could opt not to enforce it, or withdraw it, even before the cases make their way through the trial and appellate courts. In each of these cases, the process will take time to play out, and this enforcement eve ruling is not a gift of non-enforcement for regulated entities. In the meantime, the requirements of the rule, including:
- Not to produce protected reproductive health care information related to care that was lawful where it was provided and that is sought for the investigation of or to impose liability for the mere act of seeking or providing care; and
- To obtain an attestation from law enforcement and certain other requesters before disclosing reproductive health care information where permitted (a process that can be complex and burdensome) can now be enforced against covered entities and business associates (at least if they aren’t called Dr. Purl).
We will continue to track both cases and any other related litigation and regulatory action, and you can stay up to date on progress with our Health Privacy and Security email list. For questions about this update or inquiries related to HIPAA compliance generally or reproductive health care privacy specifically, please contact your Quarles attorney or:
- Meghan O’Connor: (414) 277-5423 or meghan.oconnor@quarles.com
- Dan Guggenheim: (619) 822-1474 or dan.guggenheim@quarles.com
- Simone Colgan Dunlap: (602) 229-5510 or simone.colgandunlap@quarles.com