of Amendments to the HIPAA Privacy Rule to Protect Reproductive Health Care Information As the compliance date rapidly approaches, the (amendments) are subject to legal challenges.
As detailed in our previous post, regulated entities must comply with the amendments by December 23, 2024 (or later on or after February 16, 2026 for required changes to the Notice of Privacy Practices). compliance date). Recent legal challenges and the incoming presidential administration have made the implementation status of these amendments uncertain. However, at the time of publishing this blog, regulated businesses must be ready to comply as of December 23, 2024.
Recent lawsuits challenging the amendments
Two lawsuits have been filed in the Northern District of Texas against the Department of Health and Human Services (HHS) seeking to invalidate the proposed amendments. The lawsuit alleges that the proposed amendment violates the Administrative Procedure Act (APA), which governs how federal agencies promulgate and enforce rules and regulations. Plaintiffs argue that under the APA, courts must suspend agency actions that exceed a government agency’s statutory authority or that are arbitrary, capricious, an abuse of discretion, or otherwise inconsistent with the law. are.
In the first lawsuit, State of Texas vs. HHS,[1] The Texas Attorney General argues that HIPAA preserves the state’s investigative powers related to reporting of illness or injury, child abuse, birth or death, public health surveillance, and public health investigations and interventions. Therefore, HHS went beyond its statutory authority to prohibit regulated entities from disclosing reproductive health care information to state investigators. The Attorney General’s Office argues that HHS exceeds its statutory authority because the proposed amendment impedes states’ ability to enforce their own reproductive health care laws, including abortion and gender-affirming health care. The Texas attorney general also argued that Congress never intended to allow HHS to limit the circumstances surrounding when regulated entities can disclose protected health information to law enforcement, and the Seeks to invalidate provisions of the HIPAA Privacy Rule.
In the second lawsuit, Pearl vs. HHS,[2] The case was brought by a Texas doctor who made similar claims to the Texas attorney general. However, the proposed amendment would prohibit doctors from reporting abuse or neglect related to reproductive health care, including abortions and sex reassignment procedures, or from participating in and complying with law enforcement requests. claims. Physicians further argue that the amendments were arbitrary and capricious because HHS failed to adequately explain why it was introducing these new prohibitions and requirements for any reason other than in response to the Supreme Court’s opinion. There is. Dobbs v. Jackson Women’s Health Organization.[3]
to HHS file Reply and rebuttal to inside out In this case, HHS argues that the proposed amendments do not preclude a physician’s obligation under state law to report suspected abuse or neglect. Specifically, HHS stated that the proposed amendments would not conduct investigations or impose liability on individuals, but rather would provide a “public Focused on the fact that the definition of “hygiene” is maintained. Seeking medical care. HHS argues that the proposed amendment retains this definition and therefore does not limit a physician’s ability to report abuse or neglect. Instead, the amendment only prohibits a physician’s ability to report on activities related to a person seeking, obtaining, providing, or facilitating reproductive health care, and thus suspicions of abuse may be excluded from the prohibition on disclosure. will be excluded.
change of government
It is also unclear at this time whether HHS under the Trump administration will continue to defend these lawsuits and/or implement these amendments. However, starting December 23, 2024, regulated entities may not use or disclose reproductive health care information until a court rules on the legality of the amendment or until specific guidance is provided after the Trump administration takes office. You must comply with the amendments.
HHS doubles support for reproductive health care information privacy in recent settlement
November 2024, HHS Reconciled with the hospital Unacceptable disclosure of the patient’s complete medical record to the patient’s potential employer. The patient had signed an authorization form allowing disclosure of only one test result. Even though the information disclosed included reproductive health care information and this disclosure was made before the date required to comply with the amendments, HHS focused on public statements regarding the settlement. Ta.
In the linked press release, HHS stated: “Patients must be able to trust that the sensitive health information in their files is protected to maintain trust in the patient-physician relationship and ensure they receive the care they need. This is especially true when it comes to reproductive health privacy.” The headline about the settlement announced by HHS also included the phrase “Reproductive Health Information.” This indicates that the current HHS supports these amendments.
Important points
Although the future of the amendments is uncertain, as of December 23, 2024, regulated entities must be prepared to comply with the amendments when using or disclosing reproductive health care information until further notice. To prepare to comply, regulated businesses must:
- Update your HIPAA privacy policies and processes to ensure that reproductive health care information is not used or disclosed in violation of the Amendments.
- Before reproductive health care information is disclosed to a health oversight agency, law enforcement agency, coroner or coroner, or in any judicial or administrative proceeding (including in response to a subpoena or court order); Get your certificate.
- To ensure compliance with the amendments, we provide up-to-date training for employees who are responsible for disclosing health information to third parties.
As health data privacy continues to rapidly evolve, regulated entities must continue to closely monitor new developments and take necessary steps toward compliance.
[1] Texas v. Department of Health & Ham. Serve.No. 5:24-cv-00204 (ND Tex. September 4, 2024).
[2] Pearl v. Dept. Health & Ham. Serve.No. 2:24-cv-00228 (ND Texas, October 21, 2024).
[3] Dobbs v. Jackson Women’s Health Organization597 U.S. 215 (2022).
