On January 22, 2025, Tennessee Attorney General Jonathan Skrmetti, joined by 14 other states filed a lawsuit in the U.S. District Court for the Eastern District of Tennessee in Knoxville. The lawsuit challenges the legality of the Department of Health and Human Services (HHS) update to the HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy.
The timeline
- April 26, 2024: HHS published the final version of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, which aimed to enhance protections for reproductive health data.
- December 22, 2024: A federal court in Texas granted an injunction against the enforcement of the new rule in a separate case (Purl v. HHS), highlighting concerns about its impact on state investigative powers.
- January 17, 2025: Tennessee, along with several other states, filed a complaint in the United States District Court for the Eastern District of Tennessee. The lawsuit challenges the legality of the new HIPAA rule, arguing that it limits states' access to necessary health information for investigating fraud and abuse.
- January 24, 2025: The current date, indicating ongoing legal proceedings as states seek injunctive and declaratory relief against HHS's new rule.
The main points of the lawsuit
- The states argue that they have the sovereign power to investigate fraud and abuse in healthcare, which is necessary for protecting public welfare.
- The new HIPAA Privacy Rule restricts access to reproductive health data, making it harder for states to gather necessary information for investigations.
- The lawsuit claims that the new rule contradicts the original intent of HIPAA, which allows states to retain their authority to investigate healthcare issues.
- The states assert that the rule causes immediate harm by hindering their ability to address serious misconduct, such as Medicaid fraud and child abuse.
- The plaintiffs argue that the rule is arbitrary and capricious, violating the Administrative Procedure Act, and therefore should be declared unlawful.
- The lawsuit seeks injunctive and declaratory relief, asking the court to block the enforcement of the new rule and declare it invalid.
How the decision could impact the Privacy Rule update
If the court rules in favor of the plaintiff, it may invalidate the new rule, thereby restoring broader access to reproductive health data for state investigations. The outcome would reaffirm the state's authority to enforce healthcare regulations and investigate fraud which would cause more oversight mechanisms in Medicaid and other public health programs. Conversely, if the court upholds the new rule, it could set a precedent that limits state access to sensitive health information, prioritizing patient privacy over state investigatory powers.
What it could mean for healthcare organizations
If the court rules against the new rule the increased access could lead to concerns about patient privacy as organizations may face pressure to balance compliance with fulfilling state investigative requirements. If the court upholds the new Privacy Rule, healthcare organizations would need to meet the requirement for the protection of reproductive information stipulated by the update.
Related: HIPAA Compliant Email: The Definitive Guide
FAQs
What is state preemption in the context of HIPAA?
State preemption occurs when federal law, such as the HIPAA Privacy Rule, takes precedence over state laws that conflict with or are contrary to its requirements. This means that if a state law undermines the privacy protections established by HIPAA, the federal law will prevail.
When does a state law conflict with HIPAA?
A state law is considered "contrary" to HIPAA if it is impossible for a covered entity to comply with both the state law and the HIPAA Privacy Rule.
Are there exceptions to HIPAA preemption?
Yes, certain exceptions exist. If a state law provides greater privacy protections for individually identifiable health information than HIPAA.
Kirsten Peremore
