The US Department of Health and Human Services’ (HHS) final rule on reproductive healthcare privacy is already subject to challenge even before its effective date. As described in our previous blog post, the HHS issued final rules amending the HIPAA Privacy Rule, with the intention of enhancing safeguards surrounding the use and disclosure of protected health information in the context of reproductive healthcare. Covered entities must comply with certain provisions of the final rule by December 23, 2024.
Specifically, two lawsuits have been filed challenging the final rule. The first lawsuit was filed on September 4, 2024, in the US District Court for the Northern District of Texas, by Texas Attorney General Ken Paxton, challenging the restrictions imposed by the final rule on the disclosure of reproductive healthcare to state investigators. The complaint asserts that the Health Insurance Portability and Accountability Act (HIPAA) statute does not grant the HHS the authority to impose restrictions on the disclosure of reproductive healthcare information to state governments.
Moreover, the lawsuit contends that the final rule was specifically designed to prevent states from accessing protected health information to enforce their own laws relating to abortion and other reproductive health matters, including treatment related to gender dysphoria.
The plaintiffs argue that the final rule violates the Administrative Procedure Act (APA) of 1946, which regulates the process by which federal agencies promulgate and enforce rules. The plaintiffs claim that under the APA, a court must hold unlawful and set aside agency action that is arbitrary, capricious, and an abuse of discretion, or otherwise not in accordance with law and that the APA’s arbitrary and capricious standard requires that agency action be reasonable and reasonably explained. The plaintiffs also argue that the final rule is unenforceable because the HHS has failed to reasonably explain the elements of the final rule and the final rule is both without statutory authority and is arbitrary and capricious.
A separate lawsuit was filed against the HHS on October 21, 2024, in the US District Court for the Northern District of Texas, on behalf of healthcare providers operating walk-in clinics in Texas with similar arguments as brought by the Texas attorney general in the first case. This lawsuit challenges the final rule's limitations on the circumstances under which healthcare professionals may disclose reproductive healthcare information to state welfare agencies and law enforcement when reporting suspected abuse.
The plaintiffs argue that the final rule interferes with doctors' legal obligations under Texas state law to report instances where a patient—particularly a minor—is seeking an abortion, has contracted a sexually transmitted disease, or has undergone illegal gender dysphoria treatments, such as receiving prescription drugs or gender-affirming surgery in violation of state law, given Texas' prohibition on gender dysphoria treatment for minors.
The fate of the final rule is uncertain with the foregoing lawsuits pending and a new incoming presidential administration that may decide to roll back the final rule. Despite the foregoing, plan sponsors should continue taking steps toward complying with the final rule until such time when they are no longer effective or additional guidance is issued. That means that plan sponsors should update their HIPAA Privacy Policies and Procedures and provide workforce training to comply with the final rule by December 23, 2024.