Overview
The privacy of sensitive reproductive health data remains precarious despite the HIPAA Final Rule to Support Reproductive Health Care Privacy, which went into effect in June 2024. Much remains to be seen in the coming months as lawsuits proceed and federal policies shift with a change in administration. For now, the Final Rule provides important, albeit limited, protections to uphold privacy, improve access to appropriate care, and counteract punitive surveillance that undermines health.
The privacy of sensitive reproductive health data remains precarious despite new protections. On December 23, 2024, compliance with most parts of the HIPAA Final Rule to Support Reproductive Health Care Privacy (“Final Rule”) became mandatory for regulated entities. The Final Rule, which went into effect in June 2024, strengthens privacy protections for protected health information (PHI) related to the reproductive health care of an individual. In environments hostile to reproductive health, these federal protections provide important safeguards, but their reach is threatened as legal challenges play out in the courts.
The U.S. Department of Health and Human Services (HHS) issued the Final Rule amidst increased concern post-Dobbs that reproductive health information could be used to penalize individuals seeking or health care providers delivering reproductive health care. The Final Rule addresses this concern by prohibiting uses and disclosures of PHI for certain non-health-care purposes, including conducting investigations or imposing liability on a person for seeking, obtaining, providing, or facilitating reproductive health care that was lawful under the circumstances in which it was provided.
Safeguarding the privacy of sensitive information like reproductive health data—the disclosure of which could lead to stigma and criminalization, among other harmful outcomes—is critical for strengthening trust between patients and providers, improving care access and quality, and protecting individual wellbeing. This is particularly paramount for patients of color, as pregnant people of color are disproportionately targeted through punitive surveillance in health care settings, and legacies of harm have engendered well-earned medical mistrust within Black communities.
The Final Rule faced challenges in the courts soon after its effective date in June 2024, evidencing continued hostility to reproductive health care privacy. In one lawsuit, Purl v. Department of Health and Human Services, a Texas-based physician and her walk-in clinic filed a complaint challenging the Final Rule in the United States District Court for the Northern District of Texas. The plaintiffs, represented by Alliance Defending Freedom, allege that the Final Rule exceeds HHS’s statutory authority and is arbitrary and capricious, in violation of the Administrative Procedure Act.
In November 2024, the Purl plaintiffs filed a motion for a preliminary injunction to halt enforcement of the Final Rule. The day before the Final Rule’s compliance date, District Court Judge Matthew Kacsmaryk granted the motion, preventing HHS from enforcing the Final Rule against the plaintiffs. (The court’s order was limited to the plaintiffs and does not bar enforcement nationwide). Concluding that the plaintiffs were likely to succeed on the merits, the court focused on the argument that the Final Rule interferes with mandatory reporting of child abuse under Texas law. According to the plaintiffs, such interference violates a statutory provision of HIPAA stating that HIPAA shall not be “construed to . . . limit the authority, power, or procedures established under any law providing for the reporting of . . . child abuse.” Although the Final Rule does not seek to prohibit disclosures where the request is for reasons other than investigating or imposing liability related to lawful reproductive health care, the court found that the Final Rule unlawfully limits reporting of child abuse required by Texas law.
The Purl decision erodes reproductive health care privacy by invoking mandatory reporting—a practice that results in the overreporting, policing, and separation of families of color, driving racial disparities. In doing so, the decision reflects how intersecting mechanisms of punitive surveillance can undermine the trust, safety, and dignity that should be central to health care and public health.
In another challenge to the Final Rule, Texas v. Department of Health and Human Services, the state of Texas filed a complaint in the Northern District of Texas, alleging, as in Purl, that the Final Rule exceeds HHS’s statutory authority and is arbitrary and capricious. Notably, the plaintiff seeks to invalidate not only the Final Rule but also the Privacy Rule, the broader HIPAA provision protecting PHI that has been in place since 2000. The plaintiff takes aim at a Privacy Rule provision that governs disclosure of PHI in response to a state’s administrative subpoena. According to the plaintiff, the provision exceeds the authority granted by HIPAA and improperly limits state law enforcement access to PHI. The plaintiff requests that the court set aside and permanently bar enforcement of both the Final Rule and the Privacy Rule. Texas thus may have significant implications for reproductive health care privacy as well as the privacy of all PHI and the reach of law enforcement into health care spaces.
In a bright spot amidst this opposition, an Indianapolis physician has filed a lawsuit in the United States District Court for the Southern District of Indiana, seeking to bar enforcement of a state statute she alleges conflicts with the Final Rule. The state statute at issue in Scifres v. Indiana Department of Health requires that physicians who perform abortions submit a “terminated pregnancy report” to the Indiana Department of Health. These reports are used to ensure providers do not violate state abortion restrictions. According to the plaintiff, the statute requires disclosure of PHI for purposes prohibited by the Final Rule (i.e., investigating and imposing liability in connection with lawful reproductive health care); thus the Final Rule preempts the statute. Scifres illustrates the potential of the Final Rule to safeguard privacy in environments where reproductive rights are under attack.
Much remains to be seen in the coming months as lawsuits proceed and federal policies shift with a change in administration. For now, the Final Rule provides important, albeit limited, protections to uphold privacy, improve access to appropriate care, and counteract punitive surveillance that undermines health. Numerous resources provide further information on the Final Rule.
This post was written by Emma Kaeser, Staff Attorney, Network for Public Health Law – Mid States Region. The Network promotes public health and health equity through non-partisan educational resources and technical assistance. These materials provided are provided solely for educational purposes and do not constitute legal advice. The Network’s provision of these materials does not create an attorney-client relationship with you or any other person and is subject to the Network’s Disclaimer.
Support for the Network is provided by the Robert Wood Johnson Foundation (RWJF). The views expressed in this post do not represent the views of (and should not be attributed to) RWJF.
