Health Law Daily Wrap Up, HEALTH CARE COMPLIANCE NEWS: Texas sues HHS over HIPAA reproductive records rule, (Sep 6, 2024)

By Sheila Lynch-Afryl, J.D., M.A.

Texas also sought to invalidate the portion of the 2000 Privacy Rule that limits disclosures to state investigators.

The state of Texas filed a complaint challenging HHS’ rule on the privacy of reproductive health records, arguing that it “directly contradicts Congress’s intent” because HIPAA includes provisions “designed to preserve states’ investigative authority where health information may need to be accessed.” The complaint also challenges the portion of the 2000 Privacy Rule that limits disclosures to state investigators. The state requested that HHS be enjoined from enforcing both rules.

On April 26 HHS’ Office for Civil Rights updated the HIPAA Privacy Rule to prohibit the disclosure of protected health information (PHI) related to lawful reproductive health care in certain circumstances. The rule, issued to ensure patient trust post-Dobbs, also requires entities to update their Notice of Privacy Practices (NPP) and obtain a signed attestation before disclosing PHI “potentially related” to reproductive health care. OCR will begin enforcing the NPP requirement on February 16, 2026, and all other requirements of the final rule on December 23, 2024.

Texas called the rule a “backdoor attempt” at weakening its laws and said that the “Biden Administration’s motive is clear: to subvert lawful state investigations on issues that the Courts have said the States may investigate.” The two-count complaint alleges that both the 2000 Privacy Rule –which, Texas said, covered entities frequently cite as a reason they cannot comply with an investigative subpoena for documents—and the April reproductive records rule violate the Administrative Procedure Act because they exceed statutory authority and are arbitrary and capricious.

MainStory: NewsStory ComplianceNews HIPAANews PreemptionNews ReproductiveHealthCareNews CyberPrivacyFeed PolicyIndustryPractices