On September 4, 2024, Texas filed a lawsuit against the Department of Health and Human Services (HHS), the HHS Secretary, and Office for Civil Rights (OCR) Director claiming the HIPAA Privacy Rule, which has been in effect for more than 20 years, and the 2024 HHS final rule on reproductive healthcare privacy are unlawful and should be invalidated. Essentially, the complaint requests that the court vacate the HIPAA provision that limits when a health plan or provider can supply PHI in response to a government investigation.
Bottom line first:
-
No matter who prevails, the parties will likely appeal the case.
- The Fifth Circuit will hear any appeals brought be the parties. It has previously ruled in favor of Texas on two important abortion cases brought post-Dobbs.
- The lawsuit leaves substantial doubt regarding the long-term fate of the new privacy protections under HIPAA and when or whether the patient and provider protections in such rule will go into effect.
- This will be a dynamic area of law. Watch this space.
Background:
The Loper Bright ruling dismantled the Chevron framework. It restored the authority of courts to determine whether federal agencies have correctly interpreted enacted laws. This marked a significant shift in the balance of power between the judiciary and federal agencies.
Therefore, without Chevron, the agency may have a challenging case to demonstrate it had authority to interpret the statute to limit a state’s ability to access PHI to investigate reproductive health matters.
In April 2024, HHS enacted the reproductive healthcare privacy rule. The rule aims to prevent states with reproductive healthcare restrictions from obtaining certain records. Specifically, it blocks access to healthcare plan or provider records regarding an individual’s reproductive care received in states without such restrictions.
Conclusion:
Group health plans should keep a close watch on legal proceedings to be aware of adjustments to HIPAA requirements.
By partnering with compliance experts, you ensure your company stays prepared, compliant, and minimizes risks. If you have any questions or need further assistance, consider booking a consultation with our compliance experts. Together, we can help you navigate these challenging times and maintain the highest standards of patient privacy and data protection.