Court Blocks Enforcement of HIPAA Reproductive Privacy Rule Against Provider

February 11, 2025

On December 22, 2024, a federal court in the Northern District of Texas issued a preliminary injunction against HHS in a case concerning the 2024 HIPAA Privacy Rule to Support Reproductive Healthcare Privacy, preventing that agency from enforcing that rule against the plaintiffs pending the resolution of litigation.

As discussed in our May 8, 2024, article in Compliance Corner, this rule prohibits the use or disclosure of PHI by individuals, covered entities (which includes group health plans), or their business associates (collectively, “regulated entities”) for either of the following purposes:

• To conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive healthcare, where such healthcare is lawful under the circumstances in which it is provided.
• The identification of any person for the purpose of conducting such investigation or imposing such liability.

The final rule also requires regulated entities to obtain a signed attestation from whoever submits a request for PHI potentially related to reproductive healthcare and requires that the Notice of Privacy Practices, provided to all participants in a health plan, must be revised by February 16, 2026, to reflect these new requirements. (As explained in our July 16, 2024, article, regulated entities were also required to update their HIPAA privacy policies and procedures by December 23, 2024, to incorporate the final rule’s requirements.)

In this case, the plaintiffs are a doctor and her clinic. They argue that the rule will impair their ability to report child abuse or participate in public health investigations and that HHS violated the federal Administrative Practices Act by acting in an arbitrary and capricious manner when the agency promulgated the rule outside its statutory authority. The plaintiffs sought the preliminary injunction so that they could continue to work with Texas state authorities in their investigations into child abuse.

The court determined that the plaintiffs showed that a preliminary injunction was appropriate in this case. The court agreed with the plaintiffs that the rule would cause irreparable harm by requiring them to spend money to update privacy notices, develop new HIPAA privacy procedures, and train staff. The court also agreed that the plaintiffs were likely to succeed in their case against HHS because the plaintiffs argued that the rule prevents them from reporting child abuse and such a limitation exceeded the agency’s authority under HIPAA. The court notes that the statute prohibits the agency from limiting reporting child abuse and concluded that the rule likely violates that prohibition by requiring the plaintiffs (who are not lawyers) to make legal determinations regarding whether a request for information relates to reproductive healthcare.

Accordingly, the court issued the injunction and ordered the parties to submit briefings concerning the limits of the agency’s authority to promulgate and enforce the rule.

Employer Takeaway: The injunction prevents HHS from enforcing the rule against the plaintiffs. It does not appear to apply to anyone else, although it may impact compliance with the rule nationwide in the future. Accordingly, employers should consider continuing their efforts to comply with this rule, such as by updating privacy policies, training staff, and updating their Notice of Privacy Practices. As noted above, plans must comply with the requirements imposed by this rule by December 23, 2024, although changes to the Notice of Privacy Practices have a delayed effective date of February 16, 2026.

Purl v. HHS, District Court Case Ruling: Memorandum Opinion and Order