Late on Wednesday June 18, Judge Matthew J. Kacsmaryk of the U.S. District Court for the Northern District of Texas issued an order vacating almost the entirety of HHS’s 2024 amendments to the HIPAA Privacy Rule that created special protections for reproductive health care information (the “Reproductive Health Privacy Rule”). The order was issued in a case brought by a Texas health care provider challenging the Reproductive Health Privacy Rule on the bases that the Rule unlawfully limited mandatory child abuse reporting, impermissibly redefined key statutory terms such as “person” and “public health,” and exceeded HHS’s statutory authority by using HIPAA to impose special rules for reproductive health care information. Purl, M.D. et al, v. United States Department of Health and Human Services et al., 2:24-cv-00228-Z (N.D. Tex.).  

The Reproductive Health Privacy Rule amended the HIPAA Privacy Rule by prohibiting HIPAA-regulated entities from using or disclosing “reproductive health care” information if that information would be used for certain prohibited purposes – namely, investigating the provision of lawful reproductive health care. The Rule also required, in part, that HIPAA-regulated entities obtain pre-disclosure attestations in certain situations, in which a party requesting information that may relate to reproductive health care must attest that the information will not be used or disclosed for any prohibited purpose. “Reproductive health care” is defined broadly under the Reproductive Health Privacy Rule and would likely include services like maternity care, contraception, vasectomies, mammograms, and STD screenings, as well as abortion, IVF, and gender affirming care.  

Judge Kacsmaryk concluded in Purl that HHS exceeded its statutory authority when issuing the Reproductive Health Privacy Rule for three interconnected reasons:

  • (1) by effectively nullifying state child-abuse and public-health reporting laws—prohibiting disclosures based solely on lawful reproductive health care, compelling covered entities to excise any reproductive-related data from lawful requests, forcing them to parse unsettled abortion and gender-identity laws, and imposing a burdensome attestation regime—the Rule contravenes Congress’s directive that “nothing” in HIPAA may curtail such state powers, 42 U.S.C. § 1320d-7(b);
  • (2) by redefining “person” to exclude unborn humans and “public health” to broaden HIPAA pre-emption, the Rule conflicts with the Dictionary Act, 1 U.S.C. § 8(c), and thereby prevents disclosure of protected health information to protect unborn children despite many states’ purported conferral of legal status on the unborn; and
  • (3) because abortion and gender-transition procedures are matters of “great political significance” reserved to the states after Dobbs, the Rule implicates the major-questions doctrine, and—absent a clear congressional mandate—HHS lacks authority to elevate reproductive-health information over other protected health information, thus rendering the Rule unlawful.

The Purl order immediately resets the compliance landscape for HIPAA-regulated entities, removing the additional legal layers HHS imposed on the sharing of reproductive health information.

A Reed Smith client alert with an in-depth review of the decision and key implications for health industry stakeholders is forthcoming.