Texas Court Issues Injunction on 2024 HIPAA Reproductive Privacy Rule

On October 21, 2024, Dr. Carmen Purl and her practice, Dr. Purl's Fast Care Walk In Clinic, sued HHS, HHS Secretary Xavier Becerra, the OCR, and OCR Director Melanie Fontes Ranier, alleging that the 2024 Final Rule exceeds HHS' regulatory authority, interferes with Dr. Purl's obligation to report suspected child abuse, and violates the Administrative Procedures Act. Dr. Purl's lawsuit followed a similar lawsuit filed by the State of Texas in September of 2024, which seeks to invalidate not only the 2024 Final Rule but also the 2000 Privacy Rule.

On December 22, 2024, the U.S. District Court for the Northern District of Texas (Kacsmaryk, J.) issued a preliminary injunction halting the defendants from enforcing the 2024 Final Rule against Dr. Purl and her practice. The Court held that the plaintiffs had not only provided "more than sufficient evidence" that they would suffer irreparable harm from enforcement of the 2024 Final Rule, but that they had also shown a likelihood of success on the merits (necessary predicates to a preliminary injunction). In finding that the plaintiffs established a likelihood of success on the merits, the Court reached the following conclusions:

• The 2024 Final Rule places an unlawful limit on laws providing for the reporting of child abuse in direct contradiction of HHS' statutory authority and Congress' decree that "nothing in [HIPAA] shall be constructed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth or death, public health surveillance, or public health investigation or intervention." (quoting 42 U.S.C. § 1320d-7(b) (emphasis in original);
   
• The Final Rule requires "a doctor or other 'covered entity' to navigate [its] requirements and make perplexing legal judgments," which the Court found "necessarily 'limits' reporting 'child abuse' as Texas law mandates." The Court opined that physicians and covered entities are "not equipped to navigate [the 2024 Final Rule's] intersecting legal labyrinths," including whether child abuse reporting is required or not, whether an attestation is defective or not, or whether law enforcement is investigating for an impermissible purpose under the 2024 Final Rule; and
   
• According to the Court, the 2024 Final Rule "by its very terms and HHS' admission," restrains and impedes child-abuse reporting.

Lastly, the Court agreed that Dr. Purl and her practice would incur hardships including non-recoverable compliance costs and potential violations of Texas child-abuse reporting laws absent a preliminary injunction. Defendants, on the other hand, would incur little to no hardship if enjoined. While "reproductive healthcare information is indeed sensitive medical information, the Privacy Rule already protects reproductive healthcare information the same as all other sensitive medical information." (Emphasis in original.)

The Court ordered additional briefing "pursuant to Federal Rule of Civil Procedure 65(d) explaining how: (1) the Supreme Court's decision on Loper Bright Enterprise v. Raimondo, 144 S. Ct. 2244 (2024); (2) the major questions doctrine; and (3) the nondelegation doctrine affect the constitutionality or legality of HIPAA and HHS's authority to issue the 2024 [Final] Rule." The Court also ordered supplemental briefing from the parties "explaining how the definition of the regulation is or is not void for vagueness," after noting that the definition of reproductive health care is susceptible to multiple interpretations.

We will continue to monitor developments related to the 2024 Final Rule.

If you have questions or concerns regarding this alert, please reach out to Alexandra P. Moylan, Alisa Chestler, Mike Halaiko, E. Bahati Mutisya, or any member of Baker Donelson's Health Law team.