Seventeen states want to end an abortion privacy rule. A federal judge is questioning HIPAA itself.
by Kelcie Moseley-Morris, Kansas Reflector
March 31, 2025
The decades-old federal law protecting the privacy of individual health information is threatened by multiple lawsuits that seek to throw out a rule restricting disclosure of information in criminal investigations, including for those seeking legal abortion and other reproductive health care.
In one of the cases, the Texas federal judge who has been at the center of several anti-abortion court battles appears to question the constitutionality and legality of the health privacy act in its entirety.
ALSO READ: 'Came as a surprise to me': Senators 'troubled' by one aspect of government funding bill
The Health Insurance Portability and Accountability Act — or HIPAA — established in 1996 to protect the privacy and security of patient health information, includes some exceptions under limited conditions, such as law enforcement investigations. But after the U.S. Supreme Court ended federal abortion rights in 2022 and more than a dozen states passed abortion bans, advocates worried that such records could be used by state officials and law enforcement to investigate and prosecute patients seeking an abortion and those who help them.
Health officials under former President Joe Biden’s administration enacted a HIPAA rule to keep health information private when the patient was in a state with legal access and the care was obtained legally. In order to release information related to this type of care, the entity subject to HIPAA rules must sign a document stating it is not released for one of the prohibited purposes.
“These cases may have been prompted by this newer rule, but they threaten more broadly the entire HIPAA system on which we all rely when accessing medical care,” said Carrie Flaxman, senior legal adviser for Democracy Forward, a nonprofit legal organization.
Two lawsuits seek to rescind that most recent rule, while another brought by Texas Attorney General Ken Paxton goes a step further, asking the court to remove the general rules established in 2000 about how much health information can be disclosed to law enforcement.
“The threats to the 2000 privacy rule would be a seismic shift that could erode patients’ trust entirely in their providers and dissuade them from wanting to seek out health care and be transparent about their symptoms,” said Ashley Emery, a senior policy analyst for the nonprofit Partnership for Women and Families. “A law enforcement officer could pressure a psychiatrist to share patient notes from therapy sessions without a subpoena, without a warrant, if the 2000 privacy rule is invalidated.”
The state of Missouri sued to rescind the Biden rule in January, and the state of Tennessee filed a similar action the same day that 14 other Republican attorneys general joined as plaintiffs: Alabama, Arkansas, Georgia, Idaho, Indiana, Iowa, Louisiana, Montana, Nebraska, North Dakota, Ohio, South Carolina, South Dakota and West Virginia. All but three of those states either heavily restrict or outright ban abortion, and if the lawsuits are successful, records kept by doctors and pharmacists in other states could be subpoenaed.
All of the lawsuits are filed against the U.S. Department of Health and Human Services, which is now under Republican President Donald Trump and HHS Secretary Robert F. Kennedy Jr. The Trump administration has so far followed the direction of the conservative Heritage Foundation’s Project 2025, which calls for the most recent HIPAA rule to be rescinded.
Three cases are still in motion, including one with a physician as the plaintiff. Dr. Carmen Purl, the sole owner of Dr. Purl’s Fast Care Walk In Clinic in Dumas, Texas, sued HHS because she said the rule creates a conflict with the laws requiring her to report child abuse.
“I consider both a pregnant woman and her unborn child to be human persons, and both are entitled to medical care and deserve the protection of the law,” Purl said in court documents. “I believe … that elective abortions harm patients’ health and public health.”
U.S. District Judge Matthew J. Kacsmaryk
The location of Purl’s clinic puts her in the judicial district that has only one federal judge — U.S. District Judge Matthew Kacsmaryk, a Trump appointee. Most federal cases are assigned randomly to a group of judges in a district, but since Kacsmaryk is the only one, many advocates and attorneys have accused law firms like Alliance Defending Freedom, who is representing Purl in the case, of “judge shopping,” or finding a plaintiff in a certain area for the purpose of putting it in front of an ideologically friendly judge.
On Dec. 22, Kacsmaryk granted an injunction blocking enforcement of the rule against Purl while the case proceeds, and he is still considering whether to permanently block the law.
As part of the decision, Kacsmaryk also ordered the parties to submit briefs explaining how recent U.S. Supreme Court rulings that delegate more authority to Congress over administrative agencies “affect the constitutionality or legality of HIPAA and HHS’s authority to issue the 2024 rule.”
Kacsmaryk presided over a lawsuit in 2023 brought by a group of anti-abortion doctors seeking to revoke the U.S. Food and Drug Administration’s approval of mifepristone, one of two drugs commonly used to terminate pregnancies in the first trimester and to treat miscarriages. Kacsmaryk ruled in favor of removing its approval, but the U.S. Supreme Court unanimously overruled him in 2024.
Purl added that she thinks gender-affirming care is harmful to children, never medically necessary and a matter of concern for public health, though she has never treated a child with gender dysphoria. In the process of providing routine medical care, she said she could learn that a child was being subjected to gender-affirming treatments or procedures that could constitute child abuse, and she would be obligated to report it.
Purl’s clinic has fewer than 20 employees, and she has been licensed to practice family medicine in Texas since 1986. In that time, she said she has treated many patients who have been victims of abuse and neglect, and estimates she has personally treated more than 100 pediatric patients who were victims of sexual abuse.
“I have treated hundreds of girls under the age of consent who were either pregnant or reported sexual activity. During my career, I have delivered babies from mothers as young as 12 years old,” Purl wrote.
Purl said she has responded to Child Protective Services investigations between 10 and 12 times, and she fears that providing full, unredacted patient records in response to an entity such as CPS would violate the 2024 rule and subject her and the clinic to civil and criminal penalties, which often means hefty fines.
In a response filed by HHS in December, before Trump’s second term began, the department said the rule does nothing to prevent Purl from reporting suspected child abuse, and denied the other harms Purl said she would incur.
“Given the nature of her medical practice, Dr. Purl is highly unlikely to ever encounter a conflict between her obligations under state law and under the Rule,” the department said in court documents.
The Texas case led by Paxton has been on hold since February, after the U.S. Department of Justice asked the court to delay scheduling until the new administration could determine how to proceed. U.S. District Judge James Wesley Hendrix, a Trump appointee, ordered the parties to file a status report by May 1.
Attorneys general in states with abortions bans have already attempted to prosecute providers in other states for prescribing abortion pills via telehealth and prosecute women who obtained an abortion in another state without the consent of a male partner. Louisiana Gov. Jeff Landry signed an extradition warrant for a doctor in New York for prescribing and mailing abortion pills to residents of the state.
New York is one of 17 Democratic-led states that has a shield law to protect providers and patients from out-of-state legal actions for reproductive care and gender-affirming care, and the state government has so far refused to comply with Louisiana’s law enforcement efforts.
The coalition of states that joined Tennessee’s lawsuit claim the privacy rule harms their ability to investigate cases of waste, fraud and abuse, and “sharply limits state investigative authority.”
Chad Kubis, spokesperson for Tennessee Attorney General Jonathan Skrmetti, told States Newsroom via email that the office could not comment for this story because of the ongoing litigation.
“The final rule will hamper states’ ability to gather information critical to policing serious misconduct like Medicaid billing fraud, child and elder abuse, and insurance-related malfeasance,” the complaint says.
Attorneys at Democracy Forward have asked the courts to allow the clients they are representing to intervene as defendants in all four cases, arguing that the new administration is likely to either not defend the cases at all or defend them inadequately. They are representing the cities of Columbus, Ohio, and Madison, Wisconsin, as well as Doctors for America, an activist organization of physicians and medical students. None of the judges have ruled on their motions yet.
Partnership for Women and Families filed an amicus brief with 23 other advocacy organizations to support upholding the rule.
“We can’t count on the Trump administration to defend this regulation, given its longstanding record of hostility toward reproductive health and rights,” Emery said.
It’s possible the new leadership at HHS will rescind the 2024 rule, Emery said, but the lawsuits alone are concerning enough because of the threat posed to privacy protections. That’s part of the goal, said Emery and Flaxman — to present the threat and sow fear and intimidation in patients and providers. And the method of launching multiple lawsuits in various jurisdictions fits a pattern that has been observed in the fight for abortion rights, Emery said.
“Anti-abortion extremists’ legal campaign against HIPAA’s reproductive health privacy protections is designed to test out different legal venues and arguments to obtain the most favorable outcome possible,” she said.
Indiana OB-GYN Dr. Caitlin Bernard knows what it’s like to be the target of an investigation, and said she’s still in court fighting new attempts to instill fear in doctors and patients.
Indiana Dr. Caitlin Bernard waits for a question from the Attorney General’s Office at a medical licensing hearing on May 25, 2023. (Photo by Whitney Downard/Indiana Capital Chronicle)
Bernard was an abortion provider in Indiana before the state enacted its ban in August 2023. She reported in 2022 that she had provided a medication abortion to a 10-year-old rape victim who traveled to Indiana from Ohio when the state briefly had a ban in place. She was accused of violating patient privacy laws and investigated by Indiana Attorney General Todd Rokita, and the state licensing board fined her $3,000 and reprimanded her for the incident after Rokita asked the board to revoke her license to practice medicine. She was not found to have violated patient privacy and kept her license.
“Now my case is held up as an example of what can happen to you if you speak out about abortion bans,” Bernard said. “I’ve spoken to many physicians across the country who are intimidated by that. They say, ‘Look at Dr. Bernard and what happened to her.’”
Now, Bernard is part of a lawsuit against the state to categorize terminated pregnancy records as medical records in state law that cannot be released to the public. Indiana has historically treated abortion reports as public record with certain details redacted, but Bernard said with the ban in place and so few people qualifying for its limited exceptions, that policy should change. The records include demographic information like age, ethnicity and education level, as well as information such as diagnoses and the date, location and physician who provided care.
“It also includes the county, so you could imagine in these very small counties, somebody could absolutely figure out who that person is,” Bernard said.
Ashley Emery, senior policy analyst at Partnership for Women and Families, said the lawsuits take aim at a deeply needed line of defense against abortion criminalization, and said it will disproportionately affect immigrants, people of color and low-income populations. Trust is already low between marginalized people and health care providers, Emery said, and this would further erode that trust.
“These challenges to HIPAA are designed to take protections away from patients and try to allow anti-abortion politicians to have more control, and I think that power deficit is really important to note, and it should be very chilling,” she said.
Last updated 10:43 a.m., Mar. 31, 2025
Kansas Reflector is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Kansas Reflector maintains editorial independence. Contact Editor Sherman Smith for questions: info@kansasreflector.com.