Demonstrators gather near the Texas Capitol in Austin following the US Supreme Court’s decision overturning Roe v. Wade in June 2022.Eric Gay/AP
An ultra-conservative federal judge in Texas has lobbed another hand grenade in his long-running battle to limit access to reproductive healthcare around the country—this time by vacating a privacy rule intended to shield abortion seekers and providers from criminal and civil state investigations.
In a sweeping ruling late Wednesday, US District Judge Matthew Kacsmaryk of Amarillo held that the Biden administration’s attempt to protect reproductive health information from disclosure to law enforcement and other authorities was unlawful. In doing so, Kacsmaryk has opened the floodgates for states with bans on abortion and gender-affirming care to investigate patients who obtain treatment out of state, as well as their providers, using those patients’ own private health records.
Under the Health Insurance Portability and Accountability Act of 1996, or HIPAA, medical providers, health insurance companies, and other covered entities are allowed—but not required—to release protected health information without patient consent to government authorities for the purposes of a criminal, civil, or administrative investigation. In April 2024, the US Department of Health and Human Services finalized a rule expanding HIPAA privacy protections to bar disclosure of reproductive health information to authorities if the government’s purpose was to investigate patients who sought, or providers who offered, such care.
The new regulation was a direct response to the US Supreme Court’s June 2022 decision overturning Roe v. Wade. HHS defined reproductive health broadly to include not just abortion, but any care related to a person’s reproductive organs, including contraception, miscarriage management, and gender-affirming care. For the first time, the rule also defined “person” under HIPAA to exclude fetuses.
The Biden rule defined reproductive health to include not just abortion, but any care related to a person’s reproductive organs, including contraception, miscarriage management, and gender-affirming care.
HHS set a December deadline for compliance with the new rule. But in October, an Amarillo-area family doctor sued the agency, claiming that the new privacy rule prevented her from reporting child abuse. Dr. Carmen Purl and her lawyers, from the conservative legal behemoth Alliance Defending Freedom, argued that under HIPAA, the Biden administration could not limit states’ authority to investigate child abuse or public health concerns.
But Purl also made it clear that her opposition to the rule was rooted in her feelings about certain forms of reproductive care. “I believe based on both medicine and conscience that elective abortions harm patients’ health and public health,” Purl wrote in a declaration to the court. “I also believe that medical interventions trying to achieve ‘gender transition’ of children, such as cross-sex hormones, are harmful to the child, are never medically necessary, and are a matter of concern for public health.”
To Purl, fetuses are children, and the 2024 rule presented undue harm to them. Kacsmaryk agreed, saying that states are free to define child abuse and public health in whatever manner they deem fit, including if certain health procedures, like abortion or puberty blockers for trans youth, constitute abuse. The decision expanded on Kacsmaryk’s previous, narrow preliminary injunction blocking the Biden rule as applied to Purl; on Wednesday, he declared the rule permanently void throughout the US.
“States like Texas can have their capacious definitions of their own child abuse or public health laws,” Kacsmaryk wrote. HIPAA, he added, “affords HHS no leeway to ‘invalidate or limit’ the ‘authority, power, or procedures’ of those laws by slicing off its favored procedures from a State’s purview.”
The decision came the same day the Supreme Court upheld Tennessee’s ban on gender-affirming medical care for transgender minors.
Kacsmaryk also found that the HHS rule violated federal law and states’ authority when it excluded fetuses from the definition of “person.” “States routinely confer ‘legal status’ on unborn children as it relates to child abuse,” he wrote. The new rule “strips unborn humans of any legal status they had under state laws.”
A longtime opponent of abortion, Kacsmaryk has issued other sweeping decisions targeting access to reproductive health, making his court a favorite venue of anti-abortion groups like Alliance Defending Freedom. In December 2022, he ruled that Title X clinics in Texas cannot offer teens contraceptives or family planning services without parental consent. In 2023, he temporarily nullified the Food and Drug Administration’s 2000 approval of the abortion medication mifepristone before the Supreme Court blocked his ruling.
Vacating the rule “will interfere with the ability of healthcare providers and patients to communicate confidentially and openly about a patient’s health needs.”
When Congress enacted HIPAA during the Clinton administration, it included no provisions to protect patient privacy—instead, it directed HHS to create privacy rules if lawmakers failed to act within three years. HHS did so in 2000, laying the foundation for the protection of sensitive health information as the medical field transitioned to electronic records. Abortion and civil rights organizations see HIPAA as an important backstop to protect patients’ health records from being used to criminalize miscarriages, prosecute doctors in s0-called “shield states” who provide abortion medications to patients in states with bans, and investigate people who help teenagers cross state lines to get the procedure.
Purl’s case is one of at least four challenging the Biden HIPAA rule. Missouri filed suit in January, claiming the rule unlawfully limits its ability to investigate public health concerns and health insurance fraud. The same day, 14 other Republican attorneys general sued to block the rule on similar grounds. Nearly all of the states have enacted total or near-total abortion bans
Texas Attorney General Ken Paxton wants the courts to go one major step further: In a complaint filed in September, he claims that the original privacy rule HHS created in 2000—the rule that protected patient health information under HIPAA—exceeded the agency’s rulemaking authority and should be thrown out in its entirety. The judge in that case is expected to make a ruling in the coming months.
A group of Midwest cities and the health advocacy organization Doctors for America, represented by the legal group Democracy Forward, have attempted to intervene in the lawsuits to defend the Biden rule and HIPAA more broadly, but have been challenged by plaintiffs and HHS. In one pleading, Democracy Forward expressed skepticism that Trump’s HHS would sufficiently defend the Biden rule: “The government’s representation of [our] interests is inadequate,” attorneys wrote.
Alliance Defending Freedom celebrated the Kacsmaryk ruling. “As the court rightly found, doctors and states should be able to protect patients from abuse,” ADF attorney Matt Bowman said in a press release. This unequivocally includes protection from “the harms of abortion” and “dangerous and sterilizing procedures” like gender-affirming medical care, he added.
Maddy Gitomer, senior counsel at Democracy Forward, called Kacsmaryk’s ruling “cruel.” “The 2024 HIPAA Privacy Rule has helped protect pregnant people and health care providers from invasive government intrusion into private medical information,” Gitomer told Mother Jones in a written statement. “Vacating this regulation will be detrimental to the privacy rights of pregnant people across the country, and will interfere with the ability of healthcare providers and patients to communicate confidentially and openly about a patient’s health needs.”
