Texas District Court Vacates Majority of HIPAA Reproductive Privacy Rule
In a decision with nationwide implications, the U.S. District Court for Northern Texas on Wednesday vacated a majority of the Health Insurance Portability and Accountability Act's (HIPAA) Privacy Rule to Support Reproductive Health Care Privacy. A U.S. Department of Health and Human Services motion to dismiss the suit, case 24-00228, was also denied.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
“Federal agencies cannot ‘exercise powers reserved to another branch of Government,’” Judge Matthew Kacsmaryk said in explaining his decision. In short, he ruled that HHS overstepped its congressional authority in amending the regulation last year in response to Dobbs v. Jackson Women’s Health Organization.
“The HHS Reproductive Privacy Rule had prohibited covered entities or their business associates from using or disclosing protected health information to investigate or sue a person for ‘seeking, obtaining, providing, or facilitating reproductive health care’ that was lawful where it was provided," said privacy lawyer Felicity Slater in a statement emailed to Privacy Daily.
“The invalidation of the HHS rule is likely to complicate the health data landscape for businesses that collect data related to health, fitness, and wellness, and especially reproductive care,” Slater said. “The HHS rule was uniform nationwide and, in its absence, companies will be left to navigate a confusing array of state laws regulating the collection and use of health data (broadly defined). These laws are enforceable by state attorneys general as well as, in states including Washington State and Virginia, by private plaintiffs.”
Responding to Slater's post Thursday on LinkedIn about the ruling, software company Boltive CEO Dan Frechtling commented that the decision is “a striking reminder that the privacy landscape is shaped by (1) the court system, (2) plaintiff firms, and (3) state legislatures ... while the FTC and other federal authorities say little and do even less.”
Health care attorney Andrea Frey said the decision wasn't surprising. “The ruling also highlights the widening gap in federal protections for sensitive health care and data," she wrote on LinkedIn. "In response, several states are stepping in to fill the void by enacting laws that restrict disclosures of reproductive and other sensitive health information. While these state-level efforts can provide meaningful protections, they also contribute to an increasingly complex compliance environment and fragmented legal landscape for healthcare providers.”
At the National HIPAA Summit in March, some privacy lawyers predicted that the Trump administration would likely try to undermine HIPAA’s Privacy Rule and encouraged states to close the gaps (see 2503250057).
“It is unlikely that HHS will appeal this decision, given the positions taken by this Administration and the federal government['s] increasing abdication of responsibility for abortion-related issues to the states,” Slater said. “As a result, we expect Democratic states (and their residents) to become increasingly aggressive in their enforcement of health data-related laws. Many of these laws, including Washington State’s My Health, My Data Act and Virginia’s SB 754, establish novel definitions that delineate the scope of health and reproductive health-related data extremely broadly.”
The My Health, My Data Act was enacted in 2024, and the first class-action complaint was filed under it in February (see 2502120053). Virginia’s reproductive data privacy law is set to take effect July 1 (see 2504110039).