Abortion Rule’s Demise Spells Trouble for HHS Privacy Role

A Texas judge’s striking down of abortion protections threatens broader federal health privacy rights and the government’s ability to regulate them, attorneys warn.

Judge Matthew Kacsmaryk, a Trump appointee and go-to jurist for conservative litigants, vacated a Biden administration rule that sought to strengthen Health Insurance Portability and Accountability Act protections involving abortion records. The rule prohibited medical providers from sharing reproductive health information for investigations into people seeking care in states where the services were legal.

In his decision, Kacsmaryk, of the US District Court for the Northern District of Texas, leaned on the major questions doctrine, a legal principle that federal agencies need a green light from Congress to tackle economically and politically significant issues.

The decision in Purl v. HHS—if it survives—could limit the US Department of Health and Human Services’ ability to regulate health privacy, a domain in which the agency has traditionally had nearly unlimited authority under HIPAA.

It comes at a time when issues like gender and reproductive rights are in Republicans’ crosshairs, and helps pave way for further attacks, legal observers say.

“What we’re left with is a court decision that says, HHS, you have the authority to draft privacy standards, as long as they don’t address anything particularly controversial” said Adam Greene, former senior health information technology and privacy adviser with the HHS’ Office for Civil Rights during the Obama era. “What even is uncontroversial in the area of privacy?’’

Now, there’s ambiguity as to whether HHS can use its privacy authority to tackle “the most significant issues of our time,” said Greene, a partner at Davis Wright Tremaine LLP.

Ruling a ‘Departure’

Issued around two years after the US Supreme Court’s stripping of federal abortion protections in 2022’s Dobbs v. Jackson Women’s Health Organization, the Biden administration’s HIPAA reproductive rights rule was quickly met with federal lawsuits.

In striking down the rule, Kacsmaryk wrote that “when an agency tiptoes its way back into abortion-related matters, the major-questions doctrine demands it clearly show” voters and Congress authorized the effort.

HIPAA “confers no authority to distinguish between types of health information to accomplish political ends,” Kacsmaryk wrote.

Natalie Thompson, senior counsel at Christian legal group the Alliance Defending Freedom and attorney representing the doctor who sued the HHS over the rule, said Kacsmaryk “correctly recognized that HIPAA is about protecting privacy for all medical records, not for promoting politically favored medical procedures like gender transitions and abortion.”

But that holding is “a departure from past major questions doctrine rulings,” said Suhasini Ravi, former director for health policy on the White House Gender Policy Council in the Biden administration, as “it’s pretty well settled that the HIPAA statute clearly authorized the HHS secretary to promulgate standards with respect to the uses of disclosure” of personal health information.

Using the doctrine “to evaluate longstanding interpretation of the vital health laws can only increase instability and uncertainty within the health-care landscape,” said Ravi, now at the Georgetown University’s O’Neill Institute for National and Global Health Law. The ruling “has wide ramifications for women and the providers across the country.”

Attorneys say the major questions doctrine lacks clear application standards.

The doctrine “almost invites the kind of decision that Judge Kacsmaryk made,” said Wendy Parmet, faculty director of Northeastern University School of Law’s Center for Health Policy and Law.

HIPAA’s Scope

In crafting the 1996 HIPAA statute, lawmakers called on the HHS to publicize standards for the security of individuals’ health information. They also called on the department to set up privacy standards if Congress failed to do so after three years. Congress did not do so.

That “seemingly meant that HHS can do practically anything it wants with respect to crafting a privacy rule,” Greene said. “The Purl decision now suggests that HHS has to be very careful about proposing new rules relating to potentially contentious subjects without a clear mandate to do so.”

“Any federal agency action that aims to protect a controversial health care service—whether it’s gender-affirming care, abortion, or, in today’s climate, vaccines—could be at risk of being struck down under this doctrine if there isn’t a clear delegation of authority,” said Randi Seigel, partner at Manatt, Phelps & Phillips.

“That’s partly because these issues carry significant political weight, and partly because health care is largely regulated at the state level. As a result, federal involvement can be seen as encroaching on areas traditionally governed by the states,” Seigel said.

WilmerHale cybersecurity and privacy practice co-chair Kirk Nahra said if he were HHS general counsel in a new administration that wanted to treat differently a category of data under the HIPAA statute, he “would need to know this opinion exists.”

“I can’t imagine I would view it as prohibitive,” he said, but “I would try to tailor my regulation and the justification for my regulation with at least an awareness of that decision.”

Pushing Back

The HHS under Secretary Robert F. Kennedy Jr. hasn’t appealed Kacsmaryk’s decision.

However, two cities and Doctors for America are appealing an order from Kacsmaryk denying their request to intervene in the case to defend the rule.

Legal advocacy organization Public Rights Project, in partnership with Democracy Forward, is representing the parties in their effort to intervene.

The group’s chief program officer, Jonathan Miller, said they are appealing Kacsmaryk’s order should the US Court of Appeals for the Fifth Circuit allow them to wade into the litigation.