Why Some States Do Not Agree to the HIPAA Privacy Rule Update on Reproductive Health Information Privacy

by | Jan 26, 2025

Tennessee Attorney General Jonathan Skrmetti filed a complaint in the U.S. District Court for the Eastern District of Tennessee in Knoxville questioning the lawfulness of the revised HIPAA Privacy Rule passed by the Department of Health and Human Services to reinforce reproductive health data privacy. The legal action lists 15 plaintiffs including the states of Arkansas, Alabama, Georgia, Idaho, Iowa, Indiana, Louisiana, Montana, North Dakota, Nebraska, Ohio, South Dakota, South Carolina, Tennessee, and West Virginia. Texas filed its own lawsuit against the revised HIPAA Privacy Rule.

The HHS published the HIPAA Privacy Rule Final Rule to aid Reproductive Health Care Privacy (Final Rule) following the decision of the Supreme Court concerning Dobbs v. Jackson Women’s Health Organization that resulted in banning state abortion and restricting reproductive liberty in 21 states. There have been issues regarding the ban on abortions in some states and the probable legal action that will be taken against people who go out of state to acquire legal abortions where it is authorized by states, and against healthcare providers who offer or perform legal reproductive care.

The effectivity of the Final Rule started on June 25, 2024, and compliance with this rule has been required since December 23, 2024. The Final Rule demands that HIPAA-covered entities get a signed formal document whenever there is a request for protected health information (PHI) likely associated with reproductive health care which the use or disclosure isn’t for a banned purpose. The rule is applicable to requests for PHI for wellness oversight activities, administrative and judicial proceedings, disclosures to medical examiners and coroners, and law enforcement reasons.

Just like the Texas Attorney General’s complaint, the plaintiffs claim that The Final Rule will impede the States’ capability to collect data crucial to policing severe misconduct such as Medicaid billing fraudulence, insurance-associated malfeasance, and child and elder abuse. The lawsuit likewise claims the Final Rule flouts HIPAA, which particularly keeps States’ authority to check into healthcare-associated problems. Attorney General Skrmetti said that the carelessly approved HIPAA rule is illegal and not practical. The administrative efforts to cripple observance of conservative state legislation have produced substantial hurdles for daily investigations of misbehaving healthcare companies, which include the continuing scrutiny of a Nashville IVF clinic.

The Texas Attorney General is seeking a breakthrough in consumer protection litigation versus a doctor in a Nashville IVF clinic regarding business practices claimed to have hurt the clinic’s patients. A signed document is necessary under the Final Rule to acquire reproductive health data. Without that signed document, the information will not be given considering that they are covered by the broad description of reproductive health information in the Final Rule. The lawsuit states that regardless of whether the State offers that attestation, the covered entity could refuse when the pertinent data would be utilized to enforce liability for the “mere act” of giving or aiding reproductive health care.”

The lawsuit points out that other States’ initiatives to acquire reproductive health data were foiled since, as per the Final Rule, HIPAA-covered entities have declined to give the records without a signed attestation, even if offered with a subpoena for those data. The lawsuit states that because of the Final Rule, States’ investigations have stopped, which include investigations associated with fraudulence, abuse, disregard, and other health-associated violations, indicating that States were not willing to give signed attestations.

The lawsuit defendants include the HHS and HHS Secretary Xavier Becerra and assets APA violations – agency action beyond statutory authority and arbitrary and capricious agency action – and asks the court to prompt, declare illegal, and put aside the Final Rule. In case the lawsuit succeeds, it would show that anybody going out of state for a legal abortion could be prosecuted as well as any medical expert who offered or facilitated that care. Certain states have enforced shield regulations to safeguard healthcare specialists who offer legal reproductive healthcare. One particular shield law is presently being tested, while the Texas Attorney General is taking legal action against a New York doctor for giving abortion pills to a resident of Texas.

Although these issues are to be addressed in the courts, President Trump can cancel the Final Rule. Ex-Director of the HHS’ Office for Civil Rights Roger Severino has shown his support for abolishing the Final Rule. When the issues have been resolved, HIPAA training requirements should also be updated.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

COMPREHENSIVE HIPAA TRAINING

Please enable JavaScript in your browser to complete this form.

Ryan Coyne

Ryan Coyne is a results-driven leader in the healthcare compliance industry, specializing in regulatory compliance, compliance training, and assisting healthcare organizations and business associates in achieving and maintaining compliance. With a deep knowledge of healthcare regulations and a keen understanding of the challenges faced by the industry, Ryan has developed a reputation as a trusted advisor and advocate for ethical and compliant practices in healthcare. Ryan has successfully advised and guided numerous healthcare organizations, business associates, and healthcare professionals on achieving and maintaining compliance with regulatory training requirements. Ryan's professional focus is using his in-depth expertise and leading a world class team of subject matter experts at ComplianceJunction in regulatory compliance to help organisations navigate the complex landscape of ensuring staff adhere to healthcare regulations. You can connect with Ryan via LinkedIn and follow on Twitter

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy