Texas Attorney General Ken Paxton is suing the Biden administration, claiming HIPAA Privacy Rule regulations hinder state law enforcement investigations into abortion and reproductive healthcare cases.
Texas Attorney General Ken Paxton has filed a lawsuit against the Biden administration, accusing the U.S. Department of Health and Human Services (HHS) of implementing unlawful regulations under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Paxton argues that the 2024 update to the HIPAA Privacy Rule, which restricts the disclosure of reproductive healthcare information, including abortion, is obstructing law enforcement investigations in Texas. He is asking the federal court to vacate both the 2024 update and the original HIPAA Privacy Rule, enacted in 2000, claiming that the HHS exceeded its authority.
The outcome of the lawsuit is dependent on the Administrative Procedure Act (APA), a federal law governing how agencies like HHS create and enforce regulations. According to Paxton, the HIPAA Privacy Rule was improperly implemented under the APA. The 2024 update to the rule, which went into effect in June, prohibits healthcare providers and entities from sharing protected health information (PHI) related to reproductive healthcare services if the information is being used to investigate individuals or providers involved in legal reproductive care, such as abortion.
The complaint from Paxton’s office alleges that HHS has no legal grounds to enforce the Privacy Rule and contends that the rule "violates the APA." The Texas lawsuit also expands the scope of reproductive healthcare under scrutiny to include gender-affirming treatments, although the updated HIPAA rule primarily addresses abortion-related care.
Read more: The HIPAA Privacy Rule to Support Reproductive Health Care Privacy
Attorney General Ken Paxton’s office emphasized that the lawsuit is focused on protecting the investigative powers of state law enforcement, claiming that the HIPAA Privacy Rule unlawfully interferes with those efforts. In a statement, Paxton's office said that "the original HIPAA statute as written by the U.S. Congress explicitly preserves the investigative authority of state law enforcement, and the law in no way gives HHS the authority to allow HIPAA-regulated institutions to refuse to cooperate with state investigations."
Paxton's lawsuit further argues that HHS lacks legal standing to implement the Privacy Rule under the APA. According to the complaint, "HHS has not and cannot point to any authority that allows it to promulgate the 2000 Privacy Rule or the 2024 Privacy Rule."
Meanwhile, the HHS defended the updated rule, despite declining to comment directly on the lawsuit due to its pending status. According to Bank Info Security, the statement reads, "This rule stands on its own. The Biden-Harris Administration remains committed to protecting reproductive health privacy and ensuring that no woman’s medical records are used against her, her doctor, or her loved one simply because she got the lawful reproductive care she needed."
The 2024 HIPAA Privacy Rule was introduced in response to the U.S. Supreme Court's Dobbs decision, to prevent the use or disclosure of PHI in cases where it is sought to investigate or hold accountable individuals, healthcare providers, or others involved in providing or facilitating reproductive healthcare that is legally permissible.
Adam Greene, a privacy attorney at Davis Wright Tremaine, said, "This is one of the broadest attacks on the HIPAA Privacy Rule that we have seen since HHS first promulgated the rule in 2000." Greene added that if Texas wins, "it could fundamentally alter the protection of health information in the U.S. and potentially invalidate the Privacy Rule’s limitations on disclosures to law enforcement or the Privacy Rule more generally."
Attorney Kirk Nahra of WilmerHale called the lawsuit "a pretty surprising challenge" and questioned its implications for Texas consumers. "I would be curious what Texas consumers would think if their health privacy rights were eliminated as a result of this lawsuit," Nahra said.
The Administrative Procedure Act (APA) and the Health Insurance Portability and Accountability Act (HIPAA) serve distinct but important roles in U.S. law. The APA, enacted in 1946, establishes the procedures federal agencies must follow when creating and enforcing regulations, ensuring transparency and public involvement in rule-making. HIPAA, introduced in 1996, primarily aims to safeguard patient information and streamline healthcare operations. A component of HIPAA is the Privacy Rule, which, enacted in 2000, sets standards for the protection of individuals' medical records and personal health information. This rule restricts the use and disclosure of PHI without patient consent, thus balancing the need for privacy with the demands of healthcare administration.
Privacy experts warn that Paxton’s lawsuit could have far-reaching consequences for patient privacy across the country. If successful, the challenge could dismantle HIPAA's protections that have been in place for over two decades. If the court sides with Texas, it could limit HHS's ability to regulate health information disclosures, particularly to law enforcement, and potentially invalidate the entire Privacy Rule.
The case also follows a growing trend of state challenges to federal authority, especially in light of recent Supreme Court rulings. Regulatory attorney Paul Hales noted that the case aligns with broader efforts by conservative states to roll back federal protections related to reproductive rights and other healthcare issues, emboldened by the Supreme Court's overturning of Roe v. Wade in 2022.
The Texas lawsuit against the HIPAA Privacy Rule is a high-stakes legal battle with significant implications for the future of patient privacy in the U.S. If Texas prevails, it could disrupt key protections under HIPAA, affecting reproductive healthcare and the broader regulation of PHI. This case further highlights the increasing tension between federal and state authorities as they navigate privacy and healthcare rights in the aftermath of Roe v. Wade being overturned. It reflects the deeper struggle over who holds the power to protect or limit personal healthcare choices in this new legal landscape.
HIPAA, the Health Insurance Portability and Accountability Act, is a U.S. federal law enacted in 1996 to safeguard the privacy and security of individuals' health information. It establishes standards for how healthcare providers, insurers, and their business associates must handle and protect sensitive medical data, ensuring confidentiality, integrity, and availability of health information. HIPAA also promotes the secure and efficient exchange of healthcare information while preventing unauthorized access or misuse of patients' personal health records.
The Administrative Procedure Act (APA) is a U.S. federal law enacted in 1946 that governs how federal agencies create and enforce regulations. The APA establishes procedures for rulemaking, requiring agencies to provide notice of proposed rules, allow public comment, and publish final rules in the Federal Register. It also outlines the process for judicial review of agency actions, ensuring that regulations are developed transparently and that agencies act within their statutory authority. The APA aims to ensure that federal agencies follow fair and accountable procedures in their rulemaking and decision-making processes.
The Biden Administration refers to the executive branch of the U.S. government under President Joe Biden, who was inaugurated as the 47th President of the United States on January 20, 2021. The administration encompasses the President, Vice President Kamala Harris, and the various federal agencies and departments that carry out government functions and policies. It is responsible for implementing and enforcing laws, setting domestic and foreign policy, and managing the federal budget. The Biden Administration is characterized by its focus on issues such as climate change, healthcare, economic recovery, and social justice.