Last week, Texas Attorney General Ken Paxton filed a complaint in federal district court against HHS and the Office for Civil Rights (OCR) challenging a recently issued rule strengthening protection of protected health information (PHI) related to reproductive health. As summarized in a previous post, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (Final Rule), generally prohibits disclosure or use of PHI by a covered entity or their business associate for purposes of criminal, civil, or administrative investigations into persons for seeking, obtaining, providing, or facilitating reproductive health care under lawful circumstances. In its complaint, Texas argues that the Final Rule is unlawful and seeks to have it vacated.

Within the Final Rule, OCR defines reproductive health care broadly to include services such as abortions and gender affirming care. Texas is one of several U.S. states that prohibits abortion with limited exceptions for the life and health of the pregnant patient. The state’s abortion law subjects those in violation to criminal and civil penalties.

Texas’s Legal Arguments 

In its complaint, Texas challenges the validity of provisions that limit disclosure of PHI to law enforcement in both the current HIPAA Privacy Rule (which dates back to 2000) and the 2024 Final Rule. Specifically, the current Privacy Rule allows covered entities to disclose PHI to law enforcement under a specific set of circumstances, and the 2024 Final Rule, as mentioned above, generally prohibits disclosure of reproductive health information for law enforcement purposes when services are provided under lawful circumstances. Texas makes four legal arguments against the two regulations in their complaint: 

1. Congress “specifically preserved State investigative authority” within the HIPAA statute, citing a provision limiting OCR’s authority to limit disclosures of PHI in connection with states’ oversight of public health and safety;
2. The HIPAA statute does not give OCR authority to promulgate rules that limit how covered entities may share information with states; 
3. The state of Texas has been harmed by the regulations because they limit the state’s investigative abilities, claiming the regulation has already blocked Texas’s law enforcement’s access to reproductive health information in at least one instance; and
4. The regulations are arbitrary and capricious under the Administrative Procedure Act because HHS “failed to reasonably explain” tests and presumptions within the regulations, such as the presumption that reproductive health care was lawfully provided. 

Takeaways 

It is unclear whether the lawsuit currently has merit given the arguments Texas set forth. Key to the complaint’s claims is that the Final Rule gives health care providers the discretion to determine whether care was legally provided, arguing that this determination should instead lie with law enforcement. Leaving this determination in the hands of the law enforcement officials requesting the information would render the rule and its protections futile. 

Furthermore, Texas’s assertion that the HIPAA statute protects state investigative authority relies on a specific provision, which states should not be construed to “invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention.” The issue with relying on this provision is that (1) it does not specifically mention state laws, and (2) it only mentions investigative authority under the umbrella of public health not criminal laws aimed at curtailing the provision of reproductive health care.   

This complaint is the first state challenge against the recently issued Final Rule. Texas’s lawsuit is likely the first attempt of many to challenge the regulation, especially since numerous other states have similarly restrictive abortion laws. We will continue to track litigation challenging the Final Rule.