Texas AG Hopes to Upend HIPAA Guidelines to Examine Abortions

Texas Attorney General Ken Paxton is suing the Biden administration alleging that “unlawful” HIPAA privacy rule regulations are hindering the state’s law enforcement investigations into abortion and other reproductive health care cases.

See Also: Live Webinar | Building a More Resilient Healthcare Enterprise and Ecosystem

Paxton says the U.S. Division of Well being and Human Companies overstepped its authority is asking a federal choose to not solely vacate the 2024 replace to the HIPAA Privateness Rule – enacted to limit disclosures of protected well being data associated to reproductive well being care – but additionally the 24-year-old HIPAA Privateness Rule.

The lawyer normal claims HHS didn’t have the authority to promulgate the HIPAA Privateness Rule due to one other federal regulation – the Administrative Process Act, a 1946 federal regulation that regulates how federal businesses create and situation guidelines.

The complaint alleges “HHS has not and can’t level to any authority that permits it to promulgate the 2000 Privateness Rule or the 2024 Privateness Rule, the principles violate the APA.”

“The unique HIPAA statute as written by the U.S. Congress explicitly preserves the investigative authority of state regulation enforcement, and the regulation on no account provides HHS the authority to permit HIPAA-regulated establishments to refuse to cooperate with state investigations,” Paxton’s workplace said in its assertion.

Each HHS Secretary Xavier Becerra and HHS Workplace for Civil Rights Director Melanie Fontes Rainer are named as defendants within the Texas lawsuit.

HHS in an announcement to Info Safety Media Group declined touch upon the lawsuit as a result of it’s a pending litigation matter, however defended the HIPAA rule.

“This rule stands by itself. The Biden-Harris Administration stays dedicated to defending reproductive well being privateness and guaranteeing that no girl’s medical information are used towards her, her physician or her liked one just because she acquired the lawful reproductive care she wanted,” the HHS assertion stated.

HHS’ 291-page closing HIPAA Privateness Rule to Assist Reproductive Well being Care Privateness, which was printed in April and went into impact in June, prohibits the use or disclosure of PHI when it’s sought to research or impose legal responsibility on people, healthcare suppliers, or others who search, receive, present or facilitate reproductive healthcare that’s lawful underneath the circumstances through which such healthcare is offered (see: HHS Beefs Up Privacy Protections for Reproductive Health Info).

The 2024 up to date HIPAA privateness rule additionally requires a regulated healthcare supplier, well being plan, clearinghouse or their enterprise associates to acquire a signed attestation that sure requests for PHI doubtlessly associated to reproductive healthcare will not be for functions prohibited underneath the rule.

HHS’ OCR issued the 2024 HIPAA privateness rule replace after the U.S. Supreme Court docket within the 2022 Dobbs determination overturned Roe v. Wade, a authorized precedent that assured the nationwide proper to an abortion for greater than 50 years.

The Texas lawsuit alleges that the scope of reproductive healthcare that falls underneath the HHS rule not solely consists of abortion, and likewise “hormone and drug remedy for gender dysphoria, surgical procedures associated to gender dysphoria, and gender experimentation.”

The HHS rule doesn’t particularly point out any kind of reproductive healthcare service moreover abortion.

“In sum, the 2024 Privateness Rule restricts state officers and regulation enforcement from acquiring proof of against the law or different potential violation of state regulation,” the Texas lawsuit alleges.

The Texas lawyer normal workplace didn’t instantly reply to ISMG’s request for touch upon its lawsuit.

A Hazard to Affected person Privateness?

Privateness specialists stated the transfer by Texas asking the federal courtroom to nullify the HIPAA privateness guidelines shouldn’t be solely surprising however may very well be doubtlessly devastating to affected person privateness rights.

“This is likely one of the broadest assaults on the HIPAA Privateness Rule that we’ve seen since HHS first promulgated the rule in 2000,” stated privateness lawyer Adam Greene of the regulation agency Davis Wright Tremaine.

“If the go well with is profitable, it may essentially alter the safety of well being data within the U.S. and doubtlessly invalidate the Privateness Rule’s limitations on disclosures to regulation enforcement or the Privateness Rule extra typically,” he stated.

Privateness lawyer Kirk Nahra of the regulation agency WilmerHale provides an identical evaluation.

“It’s a fairly stunning problem at the very least so far as it seems to reject the Privateness Rule written in 2000, which has been in impact since 2003 – and issued in closing type by the Bush Administration,” Nahra stated. “I’d be curious what Texas shoppers would assume if their well being privateness rights had been eradicated on account of this lawsuit.”

If the courts rule in Texas’s favor, then, at a minimal, this may seemingly restrict the power of HHS to control disclosures to regulation enforcement absent further statutory authority, Greene stated.

“Whereas the grievance focuses on disclosures to regulation enforcement, although, Texas broadly asks the courtroom to vacate and put aside the entire Privateness Rule,” he stated.

“Accordingly, if Texas had been to win, then two massive questions can be: whether or not the courtroom strikes down parts of the Privateness Rule past these associated to regulation enforcement; and the extent that the choice can be utilized nationally,” Greene stated.

However profitable the lawsuit shouldn’t be a slam dunk for the state.

“The argument doesn’t deal with the statutory grant of authority that’s the foundation of the Privateness Rule,” he stated. Part 264(c)(1) of HIPAA states “that, if Congress fails to enact privateness requirements in three years – which Congress did not do – then HHS should promulgate privateness laws that deal with the makes use of and disclosures of individually identifiable well being data that must be approved or required,” Greene stated.

The grievance purchased by the lawyer normal of Texas provides brief shrift to concept that the HIPAA guidelines had been the product of the mandate from Congress to “promulgate” requirements for the privateness of affected person well being data, stated privateness lawyer David Holtzman of the consulting agency HITprivacy LLC.

“A cynical view can be {that a} craven, politically motivated state lawyer normal has crafted a lawsuit that was purposely filed in a federal district courtroom pleasant to these with who disdain the train of federal company motion,” he stated.

The Texas lawsuit additionally seems to observe a rising pattern in litigation by states difficult federal authority, stated regulatory lawyer Paul Hales of the Hales Legislation Group.

“Crimson states handed anti-abortion legal guidelines following the Dobbs determination. Concurrently they filed lawsuits attacking HHS rule making authority concerning reproductive rights and different matters,” Hales stated.

On high of that, a Supreme Court docket determination in June abolishing the long-standing “Chevron” judicial doctrine of deferring to authorities businesses’ interpretation of statutes, has inspired “assaults on unpopular administrative laws,” Hales stated (see: Experts Warn of Cyber Regulatory Chaos Post Chevron Overturn).

“The brand new Texas lawsuit is much and away the boldest assault on a federal company. The try and invalidate your entire HIPAA Privateness Rule would have been unthinkable earlier than Chevron and earlier than current choices by the Fifth Circuit Court docket of Appeals, which covers Texas federal courts,” Hales stated.

The Texas lawsuit towards HHS “is ostensibly concerning the Administrative Process Act, nevertheless it actually is concerning the present emotional and political local weather in our nation. I count on extra to return,” he stated.

Full Circle

The Administrative Simplification provisions included into the Omnibus HIPAA Act greater than a decade in the past sought to facilitate using digital data methods within the healthcare business, Holtzman stated.

“However Congress was cautious that the federal authorities may misuse information it collected to develop an digital file containing the well being information of each American except there have been protections for the use and disclosure of affected person well being data,” he stated.

“The Texas lawsuit that seeks to undermine these identical affected person privateness protections now brings us full circle to confront the governmental overreach Congress sought to stop,” he stated.

The Paxton go well with is one in all two main challenges to HHS HIPAA guidelines being heard in Texas. The American Hospital Affiliation and different teams sued HHS over its rule that net monitoring instruments doubtlessly violated the HIPAA Privateness Rule. HHS dropped its enchantment of a Texas federal courtroom ruling that discovered that HHS OCR exceeded its authority in sure provisions of HIPAA steering associated to using net trackers (see: HHS OCR Drops Appeal of Court’s Web Tracker Ruling).