A 2024 provision under the Health Insurance Portability and Accountability Act (HIPAA) protects reproductive health information from disclosure to law enforcement when care was legally obtained, such as in another state with abortion access. (Photo by Dave Whitney/Getty Images)

Two pending lawsuits over a 2024 federal rule protecting certain reproductive health information from disclosure are on hold while the Trump administration decides whether to appeal a Texas judge’s June decision that declared the rule unlawful and void.

U.S. District Judge Matthew Kacsmaryk issued an opinion nullifying the federal rule that shielded reproductive health information from law enforcement when care was legally obtained, such as in another state with abortion access. In this case, Dr. Carmen Purl argued that the U.S. Health and Human Services rule conflicted with the laws requiring her to report child abuse. Purl said in court documents she believes abortion and gender-affirming care fall under the definitions of child abuse.

Purl lives in the judicial district where Kacsmaryk — who has taken anti-abortion stances in the past — is the only judge. His ruling applied nationwide and took effect immediately.

Without the rule, law enforcement officials in states with abortion bans may issue subpoenas for records related to reproductive health care obtained legally in another state, as some have already recently tried to do. According to health policy nonprofit KFF, 22 states and the District of Columbia have laws limiting what reproductive health information can be obtained, but others with legal abortion access do not, such as New Hampshire and Virginia.

Abortion-rights advocates say it’s largely an intimidation tactic meant to sow fear in patients and providers. Since the Dobbs decision in 2022,  anti-abortion attorney Jonathan Mitchell filed nine petitions in Texas seeking to legally question abortion funds, providers and researchers, and two individual women who sought abortions in other states, according to the Texas Tribune.

Carmel Shachar, a Harvard law professor who has extensively researched data privacy and health policy, said it’s possible for a patient to travel to a state with legal access and have that information stored in their medical records that is shared with their providers back home.

“Without the reproductive privacy rule, the concern will be, ‘OK, will some of these states that have taken a very strong stance against abortion be able to pinpoint where residents of their states travel to receive abortion care?’” Shachar said.

Tennessee plaintiffs push for separate ruling after Texas decision

Two lawsuits challenging the legality of the rule are frozen at least until the government’s Aug. 18 deadline to appeal. One case is in Missouri, and Texas Attorney General Ken Paxton filed the other. Paxton’s office had also challenged the legality of the underlying privacy rule or HIPAA established in 2000, which could have opened more avenues for state investigations if a judge agreed to throw it out. But according to recent court filings, the state is no longer asking the court to do that.

A Tennessee lawsuit includes 17 other states that heavily restrict or ban abortion as plaintiffs. Their attorneys general asked the court to find the 2024 rule unlawful because they said it impedes their right to investigate cases of waste, fraud and abuse. In the most recent court brief, attorneys for Tennessee Attorney General Jonathan Skrmetti said the case can still be decided by U.S. District Judge Katherine Crytzer, an appointee of Republican President Donald Trump.

Until judgment is affirmed on appeal and no further appellate review is available or the deadline to appeal passes, “the plaintiff states’ claims remain live and ready for this court to resolve,” the brief said.

Legal organization continues attempts to intervene so they can appeal

The Health Insurance Portability and Accountability Act (HIPAA) allows law enforcement to obtain health information for investigation purposes. But the addition of the 2024 provision under former Democratic President Joe Biden prohibited disclosure of protected health information in investigations against any person for the mere act of seeking, obtaining, or facilitating reproductive health care, to impose criminal or civil liabilities for that conduct, or to identify the person involved in seeking or obtaining that care. It also applied to gender-affirming care.

The U.S. Department of Justice did not respond to a request for comment. Whether it appeals Kacsmaryk’s ruling is in question, as the Justice Department under Trump did not address whether it thought the 2024 rule was proper and lawful prior to Kacsmaryk’s decision. Attorneys instead said they were reviewing the rule but had no other updates. In the Missouri and Tennessee cases, DOJ attorneys have argued for dismissal for other legal reasons, but also have not defended the 2024 rule itself.

In March, the DOJ dropped the case that argued the federal law mandating stabilizing emergency care should apply to those who need emergency abortion care. And in early June, U.S. Health and Human Services rescinded guidance that said that care should be required in emergencies.

Attorneys for Democracy Forward, a nonprofit legal organization, are representing Doctors for America and the cities of Columbus, Ohio, and Madison, Wisconsin, and attempted to intervene in the case because they did not expect the government to defend the rule. If they were allowed to intervene, they could appeal Kacsmaryk’s opinion striking down the rule regardless of the Trump administration’s decision.

Kacsmaryk denied their motion, while a decision in the other three cases is pending. Carrie Flaxman, senior legal adviser for Democracy Forward, said they have appealed that denial to a higher court. Given that the Department of Justice attorneys chose not to defend the rule on the merits in court proceedings, Flaxman said, she thinks they have a good argument for appeal.

Repealing the rule was a directive in Project 2025, the blueprint document for the next presidential administration published by the conservative Heritage Foundation. Several prominent anti-abortion organizations were part of the panel that drafted Project 2025, and many of the individuals involved in writing the 900-page document now work for the Trump administration.

Former Democratic President Joe Biden’s administration added the 2024 rule prohibiting disclosure of protected reproductive health information for criminal, civil or administrative investigations to the Health Insurance Portability and Accountability Act or HIPAA. (Connect Images for Getty Images)

A 2024 federal rule that shielded reproductive health information from disclosure to law enforcement when care was legally obtained, such as in another state with abortion access, was struck down by a federal judge in Texas on Wednesday evening.

U.S. District Judge Matthew Kacsmaryk of Texas’s decision applied nationwide, nullifying the rule immediately. Kacsmaryk had temporarily blocked its enforcement against Dr. Carmen Purl, who sued HHS because she said the rule created a conflict with the laws requiring her to report child abuse.

“Striking down this critical rule is cruel,” said Maddy Gitomer, senior counsel at Democracy Forward, in an emailed statement. “The 2024 HIPAA Privacy Rule has helped protect pregnant people and health care providers from invasive government intrusion into private medical information.’’

The rule did not allow disclosure of protected health information for criminal, civil or administrative investigations against any person for the mere act of seeking, obtaining, or facilitating reproductive health care, to impose criminal or civil liabilities for that conduct, or to identify the person involved in seeking or obtaining that care. It also applied to gender-affirming care.

Two other cases challenging the same rule are still pending in federal courts in Tennessee and Missouri, but it’s unclear what  Kacsmaryk’s decision means for those cases, or another Texas lawsuit led by Attorney General Ken Paxton that also seeks to strike down a broader 2000 privacy rule.

Former Democratic President Joe Biden’s administration added the rule to the Health Insurance Portability and Accountability Act, a 30-year-old federal law meant to protect patient health information, especially when that information travels between providers. The law contains exceptions for when information can be disclosed to investigators, who can subpoena records for a law enforcement matter. After the 2022 Dobbs decision returned abortion regulation to the states, prompting more than a dozen to pass abortion bans, advocates worried that such records could be used by state officials and law enforcement to investigate and prosecute patients seeking an abortion and those who help them.

Lauren Paulk, senior research counsel for If/When/How, a nonprofit that provides legal support for reproductive health care, told States Newsroom on Wednesday evening that people are still protected by the federal HIPAA law, including the foundational 2000 privacy law that requires certain procedural steps to be met before records can be subpoenaed. The 2024 rule was meant to provide reassurance to patients who are afraid to seek abortion or gender-affirming care, even where it is legal, by specifically exempting those records.

Kacsmaryk’s decision, she said, will erode trust between patients and providers and potentially damage that relationship. And it could be a sign of more actions to come.  

“There’s a laundry list of things that I think could start to be added here whenever the courts are saying there really aren’t protections for private reproductive health information,” Paulk said.

Democracy Forward, a nonprofit legal organization, filed a filed a motion to intervene earlier in the case on behalf of the cities of Columbus, Ohio, and Madison, Wisconsin, because attorneys said they no longer had faith that the U.S. U.S. Department of Health and Human Services would adequately defend the law under Republican President Donald Trump’s administration. Kacsmaryk denied that motion to intervene, and Democracy Forward appealed that decision to the 5th U.S. U.S. Circuit Court of Appeals. That appeal is pending.

“Vacating this regulation will be detrimental to the privacy rights of pregnant people across the country, and will interfere with the ability of healthcare providers and patients to communicate confidentially and openly about a patient’s health needs,” Gitomer said.

Gitomer said Democracy Forward will continue to explore all of its options to defend reproductive rights from “political interference and anti-abortion extremists.”

Conservative law firm Alliance Defending Freedom represented doctor in Texas judge’s district

Purl is the sole owner of Dr. Purl’s Fast Care Walk In Clinic in Dumas, Texas. In court documents, she said:

“I consider both a pregnant woman and her unborn child to be human persons, and both are entitled to medical care and deserve the protection of the law. I believe … that elective abortions harm patients’ health and public health.”

The location of Purl’s clinic put her in Kacsmaryk’s district, where he is the only judge. Most federal cases are assigned randomly to a group of judges in a district, but since Kacsmaryk, a Trump appointee, is the sole jurist, some advocates and attorneys have accused law firms like Alliance Defending Freedom, who is representing Purl in the case, of “judge shopping.” That phrase refers to finding a plaintiff in a certain area for the purpose of putting it in front of an ideologically friendly judge.

In an earlier high-profile case, Kacsmaryk attempted to order the U.S. Food and Drug Administration to rescind its decades-old approval of mifepristone, one of two drugs used to terminate early pregnancies and treat miscarriages. That decision was eventually returned  by the U.S. Supreme Court to a lower court for consideration.

Officials in Texas have already attempted to investigate women who left the state, which has a near-total abortion ban and other abortion-related laws, to terminate a pregnancy.

In a 65-page opinion, Kacsmaryk said the U.S. Department of Health and Human Services’ leadership under Biden “invoked HIPAA as a shield against abortion-restrictive states.” He determined the rule unlawfully limited disclosures about abuse and public health to state authorities, and said it exceeded statutory authority because it employed HIPAA to impose special rules for abortion. Such action should only be taken by Congress, he said, especially because the issues at hand are of major political significance.

“People of good faith vehemently disagree on both these issues,” Kacsmaryk wrote, referring to abortion and gender-affirming care. “These issues transcend politics, implicating anthropology, philosophy, and concepts of self. … The 2024 rule creates special rules for information about these politically favored procedures that implicate fundamental and hotly debated questions.”