HIPAA Reproductive Healthcare Uncertainty

By Matt Fisher, Healthcare Attorney
LinkedIn: Matthew Fisher
X: @matt_r_fisher
Host of Healthcare de Jure#HCdeJure

2024 cannot end without a further wrinkle on the HIPAA front. Earlier in the year, the Office for Civil Rights (OCR) in the Department of Health and Human Services (HHS) modified the HIPAA Privacy Rule by adding language specific to reproductive health care and reproductive health care services (the 2024 Modifications). A court in Texas has now granted a preliminary injunction to one covered entity so it does not need to comply with the 2024 Modifications. The key is that the preliminary injunction is not nationwide, but limited solely to the party in the lawsuit.

What are the 2024 Modifications?

The 2024 Modifications were proposed and finalized directly in response to the changing legal landscape, on both the federal and state levels, following the Supreme Court’s Dobbs decision that removed federal recognition of a right to an abortion. Following the Dobbs decision many states enacted laws either severely limiting the ability to obtain an abortion or prohibiting it altogether. The disparities between the states created tension with regard to privacy as individuals potentially or actually sought care in different states.

With the existing disparities, certain states sought records of citizens of their states who obtained an abortion in a state where it was still legal. In response, OCR proposed additions to the HIPAA Privacy Rule aimed at reproductive health care. In a very brief summarization, the changes set stringent restrictions on when and how protected health information that addressed reproductive health care could be obtained. The limitations generally relate to not having to disclose information concerning reproductive health care to enable prosecution or liability if the reproductive health care services were legal in the state where such services were provided. Further, covered entities would need to modify their Notice of Privacy Practices to call out the new requirements. Those changes were finalized in the 2024 Modifications.

The Challenge

Since many regulations cannot be enacted without challenge anymore, a lawsuit was initiated in Texas asserting that the 2024 Modifications exceeded OCR’s authority. The entity initiating the lawsuit was Dr. Purl’s Fast Care Walk In Clinic (the Clinic). The Clinic stated that it regularly reports concerns of child abuse in accordance with Texas law. The Clinic claimed that the 2024 Modifications would impair Clinic’s ability to report the suspected child abuse.

Given the Clinic’s concerns, the Clinic sought to invalidate the 2024 Modifications. The first step in that process was a request for an injunction against having to comply with the 2024 Modifications. The start date for compliance with the 2024 Modifications is December 23, 2024.

The Injunction Decision

On December 22, 2024 the United States District Court for the Northern District of Texas (the Court) granted the Clinic’s request for a preliminary injunction. How did the Court get to its decision? The Court examined the standard factors to obtain an injunction and found a likelihood of success on the merits after weighing the factors.

Factor 1: Irreparable Harm
The first factor is whether the complainant will suffer an irreparable harm, which means a harm that cannot be adequately remedied at law. In this instance, the Court found irreparable harm because the Clinic would incur costs driven by complying with the 2024 Modifications. Specifically, the Court said the Clinic would have to update its Notice of Privacy Practices, develop new or modified procedures, and train staff. In the Court’s view, this is enough to establish irreparable harm.

Identifying costs of compliance as an irreparable harm is relatively standard. While pretty much every new rule or regulation comes with a cost to comply, those are sunk costs for entities that need to comply and cannot be recovered. As such, the compliance costs are an irreparable harm.

Factor 2: Likelihood of Success on the Merits
The second factor is being able to establish a reasonable chance that success will occur if the case is developed and proceeds to a full determination on a request for summary judgment. At the preliminary stage, it is not necessary to provide evidence that will be presented going forward, only that the reasonable chance of winning exists.

In this instance, the Clinic asserts that the 2024 Modifications exceeded OCR’s authority by limiting the Clinic’s ability to comply with reporting child abuse. Specifically, the Clinic pointed to language in the HIPAA statute that OCR cannot limit the authority, power, or procedures established under any law for the reporting of child abuse.

Here, the Clinic points to Texas law that requires reporting of child abuse. The Texas law seems to impose the obligations to report when a person has reasonable cause to believe that a child’s physical or mental health or welfare has been adversely affected by abuse or neglect. The Clinic argues that the 2024 Modifications creates a delicate balancing act for it to follow when determining whether a report of child abuse can be made.

OCR disputed that assertion. OCR pointed out that the 2024 Modifications only relates to reproductive health care. The new requirements also relate to a request sent to the covered entity to investigate or impose liability for obtaining, providing, or facilitating reproductive health care. The connection to child abuse is not clear.

The Court does not agree with OCR. The Court goes through a lengthy discussion of how the 2024 Modifications require covered entities to engage in a legal judgment call to determine if a child abuse report can be made. It is not clearly discussed whether reproductive health care, including abortion, constitutes child abuse. The Court only focuses on the process for disclosure of reproductive health care information. That seems to gloss over the bigger point of whether child abuse is even involved. Does that hinge on definitions in state law or personal interpretation of state law by the applicable covered entity? That analysis would offer more instruction.

Factors 3 and 4: Balance of Equities and Public Interest
The third and fourth factors assess whether the irreparable harm to the plaintiff is greater than the hardship that would result from granting the preliminary injunction and whether the injunction is in the public interest. The Court compressed the two factors since the government is the defendant. On cursory analysis, the Court sided with the Clinic that the costs of complying with the 2024 Modifications and risk of allegedly not complying with state law outweighed the interests of OCR in driving immediate compliance with the 2024 Modifications.

What Comes Next?

The Court ordered further briefing on OCR’s authority to promulgate the 2024 Modifications and also seemed to implicitly question HIPAA as a whole (??). Given the upcoming change in administration and the very different view, there is a more than likely outcome that the government withdraws its opposition and does not submit the requested briefing. An order setting the briefing deadlines will be separate, which means it will be necessary to track whether those briefs are submitted prior to the change over in the administration and what could happen on that front.

Aside from the potential for the government to stop contesting the case, the analysis of the court seemed to find ways to support the Clinic’s assertions. Will the 2024 Modifications really impact reports of child abuse? Is abortion or other reproductive health care a form of child abuse? There are a lot bigger policy questions wrapped into the claims that point to more fundamental issues with respect to healthcare that need to be addressed. The situation is a clear outgrowth so many issues across the spectrum at the moment.

This article was originally published on The Pulse blog and is republished here with permission.