Update To The HIPAA Privacy Rule To Support Reproductive Healthcare Privacy Compliance 1st Talk Compliance podcast

Content provided by First Healthcare Compliance. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by First Healthcare Compliance or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

1st Talk Compliance »
Update to the HIPAA Privacy Rule to Support Reproductive Healthcare Privacy Compliance

1M ago 33:21

MP3•Episode home

Fetch error

Hmmm there seems to be a problem fetching this series right now. Last successful fetch was on July 21, 2025 13:57 (28d ago)

What now? This series will be checked again in the next day. If you believe it should be working, please verify the publisher's feed link below is valid and includes actual episode links. You can contact support to request the feed be immediately fetched.

In this episode of 1^st Talk Compliance, Kevin Chmura is joined by Rachel Rose, JD, MBA, as they discuss recent changes to the HIPAA Privacy Rule to Support Reproductive Health Care and Privacy in relation to recent court rulings. This rule, which went into effect in April of 2024, still has certain components which practices need to know about and adhere to heading into 2026.

Learn about how these rulings are, and will, impact this important rule, and what HIPAA regulated organizations need to know concerning these updates. In addition, hear about what might be coming in the future of not only reproductive health regulations, but also various other areas of healthcare with regards to privacy.

Kevin Chmura

Hello and welcome to today’s episode of First Talk Compliance. I’m your host, Kevin Chmura, CEO of First Healthcare Compliance and Panacea Healthcare Solutions. And I’m excited to bring you an important discussion about a major legal development that impacts all HIPAA regulated entities. By way of background, on June 18th, 2025, the U.S. District Court for the Northern District of Texas issued a nationwide order striking down the HIPAA Privacy Rule Amendments designed to strengthen reproductive health care privacy.

The amendments had been mandatory since December 2024, and this court decision has created a new compliance challenge for covered entities and business associates. To help us understand what happened, why it matters, and what organizations should do now, we’re joined by our expert guest. Rachel V. Rose, J.D. MBA, who’s a leading authority on HIPAA healthcare privacy law.

If you listen to our podcast, you’ve heard Rachel many times. In fact, we’ve discussed this particular topic, or issues around it, pretty recently. So it’s great to have her back. So, Rachel, welcome back. Thank you for coming to share your expertise with us today.

Rachel V. Rose

Kevin, it’s always my pleasure and thank you for having me back.

Kevin Chmura

Yeah, your content is always heavily consumed because it’s very important. So we thank you for being here. So, maybe probably best way to just start off is if I can ask you to just briefly explain what the U.S. District Court’s order did, why it’s significant and who it applies to?

Rachel V. Rose

Absolutely. So on June 18th of this year, the United States District Court for the Northern District of Texas and specifically the Amarillo Division in the case caption Carmen Purl et all the United States Department of Health and Human Services et all. And for those who are interested, that case number is 224 dash CV, Dash 228, Dash Z and ta Z.

It correlates to the judge at any time you see initials or an initial after a case number, it’s the judge. And I’ll just simply refer to this case as the Purl case. Purl. Basically, what the court did was to issue an order vacating the April 16th, 2024 HIPAA Privacy Rule to support reproductive health care and privacy.

And for simplicity’s sake, I’ll just call that the HIPAA reproductive privacy rule. And basically what it did was to leave intact the requirements regarding the updates to the notice of privacy practices which are due in early 2026. And to focus on that, there really hasn’t been any guidance yet from HHS. But every covered entity and business associate and subcontractor need to be aware that the notice of privacy practices updates, which really incorporate the HIPAA provisions along with a 42 CFR part two regulations, are still in play, and the part two regulations specifically relate to the substance use disorder regulation.

So that’s something that again, covered entities, business associates and subcontractors should put on their calendar and look for updates from First Healthcare Xompliance. Whenever HHS releases some more guidance related to what should be included. As many know who have been in healthcare a long time. Oftentimes HHS and SAMHSA, the Substance Abuse and Mental Health Services Administration, which oversees 42 CFR part two, will issue guidance or form types of agreements or other relevant compliance items.

One great example is the Business Associate Agreement. So that’s the part that should be calendar and people should make sure that they are staying abreast of. Now that brings us to what was vacated. And so basically, procedurally, the court granted the plaintiff’s motion for summary judgment. And for those non-lawyers, summary judgment is available when there is no issue of a material fact.

In essence, it is judgment as a matter of law, and in doing so, denied the defendants, which in this case is the United States Department of Health and Human Services motion to dismiss for lack of jurisdiction and the specific section that was vacated pursuant to five U.S.C. Section 7062, except for the modifications that I mentioned to C.F.R. Section 164.520 with the notice of privacy practices are the provisions of associated with what were 45 C.F.R. section 1604520b, 1, 2, F, G, and H, And so for those who were familiar with what was required under those particular items, that had to do with the reporting requirements and the attestation requirements under law, and that’s distinct from the law enforcement exception.

A couple of items that are also notable, Kevin, and other healthcare attorneys in the space have also honed in on this, is that the plaintiff indicated, and the court honed in on this, saying that under the Administrative Procedures Act that the government exceeded its rulemaking authority. However, a lot of lawyers are of the opinion that Congress merely barred rules that supersede state statutes, not those that add reasonable conditions.

And so that’s something that I want to emphasize to, as I normally do in our discussions that state laws cannot be overlooked.

Kevin Chmura

So that’s significant given that that you and I not that long ago discussed some of the updates to HIPAA 2024 rules. So it’s interesting that we’re talking about it this this soon thereafter kind of thought that we were a little bit settled there. So maybe just do a quick check. Are there any other reproductive rights related lawsuits that are significant that that we should know about and be paying attention to?

Rachel V. Rose

I would say the one that is very prominent is the recent Supreme Court opinion in United States versus Committee, The attorney general and reporter for the State of Tennessee. And what’s notable about that case is that it was a 6-3 opinion which upheld Tennessee’s ban on puberty blockers and hormone therapy for transgender teenagers. Texas also actually had a similar law.

And last year, in 2024, the Texas Supreme Court upheld a state law banning doctors from prescribing gender affirming care to transgender minors and a state policy expanding the definition of child abuse to include gender affirming care remains blocked following a state court of appeals decision last year. So notably, the court, actually, has agreed to hear a couple of other transgender related cases, including transgender, participate in in female sports.

And so this is an area that should be read in conjunction with any HIPAA privacy, any law enforcement exception, which is found under the HIPAA regulations at 164.51 Q And just really be conscientious and cautious about what the individual states are requiring, as well as following the United States Supreme Court’s ruling. Because this particular case, the court held that Tennessee’s law prohibits certain medical treatments for transgender minors is not subject to heightened scrutiny under the equal protection clause of the 14th Amendment and satisfies rational basis review.

So whenever one looks at civil rights issues under a constitution analysis, we have what’s known as strict scrutiny. We have intermediate scrutiny, and then the lowest level of review is rational basis, strict scrutiny. We typically see applied to those items that are expressly mentioned in the 1964 Civil Rights Act: race, gender, religion. And for those who read any employment agreement with the nondiscrimination provisions, those same items are included there as well.

Intermediate scrutiny is a level below, and then we have rational basis, which is the lowest level of review. I would also add that in relation to some of the 14th Amendment issues and strict scrutiny, one cannot overlook any executive order that is being issued right now. And as it relates to discrimination and the DEI initiatives, the executive orders that were published in January of 2025 that relate to this expressly upheld the Civil Rights Act of 1964.

So you still cannot run afoul of that.

Kevin Chmura

Wow. So just to clarify in question for non-attorney, because that’s amazing. So with respect to scrutiny or really any recent Supreme Court cases, well, any of those have or could have an impact on an appeal or the ultimate outcome of the parole case.

Rachel V. Rose

I think that’s a great question for three main reasons, Kevin. First and foremost, the Purl case. The judge used, as I mentioned earlier, the Administrative Procedures Act, and that’s very relevant because of the recent Supreme Court Trump versus Costa Inc. And what’s relevant about Costa Inc, even though that’s a completely different area of law, is that the Supreme Court case, Costa basically held that nationwide injunctions are invalid and they cannot be issued.

They’re only specific to the individual parties to that case right. That was brought, which typically makes sense whenever I’ve used in injunctive relief at the state court level, it’s to either get a temporary hold, so to speak, or to have conduct stop, but it only pertains to the parties. It doesn’t go beyond that. I can’t say every oil company, right, or every healthcare company is involved in this. And so basically what Costa did, and there’s been a lot of debate over nationwide injunctions by federal courts in their nationwide applicability for a very long time. So this issue really isn’t new. But Costa affirmatively stated that nationwide injunctions can no longer be issued, and they’re only specific to the parties.

What is relevant to the Purl case is that the court also discussed the Administrative Procedures Act and said this does not relate to the Administrative Procedures Act, and I believe it’s footnote ten in the Costa opinion that highlights that. And what’s notable is that even some of the entities who were involved in some of the nationwide injunctions honed in on that fact.

So will we see an appeal by the United States government? According to the HHS website, they’re evaluating their options. That’s the first item. The second item is since nationwide injunctions are now not permissible, how can a single district court’s ruling invalidate a particular regulation and have that apply to the rest of the country? When is even non-lawyers know if you’re in a particular jurisdiction?

Typically the district court’s opinion is only binding not only on the parties, but it then becomes precedential within that particular district. So every other case that were to follow in the Northern district of Texas, for example, would have to cite the Purl case. Now up on appeal, once an appellate court rules on something that then applies to every district court, which is under that particular circuit and then if the Supreme Court rules, as we saw in the Dobbs case, right. Which overturned Roe or low firm, which is the case. So the Loper Bright versus Raimondo case, which honed in on the Administrative Procedures Act and overturned the Chevron Doctrine, at least in part, the Supreme Court has the ultimate authority to invalidate a law or regulation as it may be applied across the entire country.

So I do think that we will see potentially the government appeal the district court’s opinion, although there’s a potential policy issue there. And then the other item is we could see other cases arise under this that challenge this district court out of a different circuit or district within the United States.

Kevin Chmura

It’s interesting and nationwide bans are a hot topic of late I’m sure in your world especially and so it’s, it is not necessarily always black and white as you point out, which is interesting maybe we can, that’s all super helpful. Perhaps we switch gears just a little bit and think through.

Okay. We know where we are right now. What should we be thinking about doing? So I guess maybe to frame it as a question with this order in place now, what should HIPAA regulated entities, covered entities, business associates alike, but what are they still required to do with respect to reproductive health information as it stands now?

Rachel V. Rose

Well, one item that stood out to me about the Purl case was the definition of a child. And I really do think there’s a lot of interplay there with a variety of different state laws, because even if you look at the United States Census Bureau, they do not include unborn individuals in the definition of a child. So a fetus is not included there.

Yet, Purl reached the opposite conclusion. Right. And the plaintiffs in the Purl case kind of raised that in the reporting of child abuse obligations. So to answer your question, what remains first and foremost and for those individuals who are clients of First Healthcare Compliance, I created a revised FAQ regarding the privacy rule and basically, in light of the opinion as it stands now, because we have no other cases, we don’t have a Fifth Circuit opinion, we don’t have a United States Supreme Court opinion on the APA being able to be utilized at a district court level to overturn an entire statue and make it invalid.

I would recommend that individuals put a placeholder on what was previously only required to be implemented by December of 2024, with the exception of those notice of privacy practices, Kevin, and I would also make sure that people are very aware of the obligations under the law enforcement exception which have been in place for over 20 years. So that’s not new and in compliance with the law enforcement exception.

I specifically would initially go to 164.512 F12 in that relates to a court or court ordered warrant or subpoena or summons issued by a judicial officer, a grand jury subpoena, or an administrative request for which response is required by law, including an administrative subpoena or summons a civil or an authorized investigative demand or a similar process under law, provided that first the information sought is relevant and material to a legitimate law enforcement inquiry.

The request is specific and limited in scope to the extent reasonably practicable, in light of the purpose for which the information is sought, and de-identified information could not be reasonably used. A couple of examples related to that have actually come out of State Supreme Courts and one case that is very much an example of not adhering to the law enforcement exception that got a practice in hot water is the civil case, and it’s the Byrne case, versus Avery Center for Obstetric and Gynecology.

It’s case number 18 904. It was a Connecticut Supreme Court case and it was decided on November 11th of 2014. And basically, as everyone in healthcare should know, through their training, before you send any HIPAA information out, you should look at that patient or the legal representatives. HIPAA authorized the patient and see if any individual or entity is excluded.

So what happened in the Connecticut case was that a woman learned she was pregnant and expressly stated on her HIPAA authorization that no provider was to release her protected health information to the child’s father with whom she was no longer in a relationship. So the practice gets served with a subpoena from the child’s father, and instead of going to a lawyer, the practice simply released the medical records.

And so the Connecticut Supreme Court said, Hey, from our review of the record in the present case, it appears that the defendant did not even comply with the face of the subpoena, which is required by the custodian of records for the defendant to appear in person before the attorney who was issued the subpoena. Instead, the defendant mailed a copy of the plaintiff’s medical records directly to the court.

And then secondly, although it was a civil case, the costs to the plaintiff in terms of losing trust in the healthcare system and to the practice in the form of a lawsuit is significant. And there is a provision in the law enforcement exception which actually requires a covered entity to contact the patient first. And so not meeting those fundamental requirements of the law enforcement exception is critical and something that’s related to that.

Lastly, Kevin, which dovetails into the compliance, is absolutely making sure that you’re looking at two things: state laws again and then secondly, it has to be, is the demand that has been received compliant with due process. So is it official? Is it a response required by law, things of that nature? And I always advise all clients to absolutely reach out to an attorney when you get any sort of request for HIPAA information that’s not directly from the patient.

Kevin Chmura

And Rachel, I take that advice myself from you and reach out to you whenever I have a question. So that’s excellent advice for the listeners. So the Connecticut cases is a great example and I guess maybe it leads to a more obvious question or something that’s a little more practical for people. Certainly keeping up on state laws and rulings, that’s important, that requires really the expertise of an attorney.

I wonder if you can give the listeners any advice on any immediate steps they should be taking to adjust their use, their HIPAA policies, procedures and training in light of this decision and the entire environment? I mean, that’s really where they can have the most immediate impact on their organizations. Any advice for folks?

Rachel V. Rose

Absolutely. So as I mentioned, I would put an update in red in any policy changes that were put into place as required in December of 2024. So just place hold it and, as I did for your clients in our model policies and procedures, just put that this update the policies and procedures pursuant to this court ruling and then note that there could be changes and that appeals and HHS, the landscape need to be stayed abreast of to know how this may shift.

Right. Because it may shift back. We don’t, we don’t know. So that’s the first thing. The second thing, again, is to reiterate the law enforcement exception and as you also know, Kevin, under HIPAA, there is the ability for any provider to potentially report child abuse. Right. Or suspected child abuse or under Tarasov, which is a California Supreme Court cases, Tarasov One and Tarasov 2, a provider has the option of notifying law enforcement if a person is a risk to themselves or to another person. So appreciating other items which may come into play and then reading what’s known as, Amparo Materia is the Latin, or the in conjunction with the state law for what is a child right under state law and what constitutes child abuse?

What requirements are in place for reporting that? Because what you want to avoid and we’ve seen this already, not only on the reporting of child abuse, but there was that case out of Ohio when a medical professional was naturally suffering a miscarriage and actually miscarried at home because the hospital sent home. And as a result, there was a criminal investigation into abuse of a corpse.

Now, that was not upheld. The autopsy revealed that the miscarriage was, in fact, natural. It wasn’t induced by any chemical which would have run afoul of that particular state’s law. And as a result, and rightly so, the certain entities are being sued by this individual. So it’s a balance of the potential harm to individuals. And looking at that potential downstream liability as well as child abuse and potential Tarasov abuse reporting.

Kevin Chmura

Yeah. Wow. So great, great advice as usual. So, Rachel, we up to this point, I wanted to make sure we kept everything grounded in in what’s happening now. Factor in your expert advice, now I’m going to ask you to look into your crystal ball maybe, and get to the place of speculation. So relative to world, do you expect HHS to appeal the decision?

And if they do, what would that process look like.

Rachel V. Rose

So, the process is something that is set forth in the rules of procedure. And because the northern District of Texas falls under the umbrella of the Fifth Circuit, a notice would be filed in the district court and then the appeal would eventually be filed in the Fifth Circuit Court of Appeals. So whether or not HHS does that, I from my perspective and from other perspectives that I’ve read, there’s really a tension here on the public policy because it’s reproductive healthcare related.

But the fact that HHS does have some issues to contend with, including the definition of a child, which is I mentioned the U.S. Census Bureau defines differently, is something that we could see, another item that we could see potentially as a case being brought in another district court in another circuit. And so we could see that being an issue or an appeal specific to the APA.

So I think we have a lot of different options that we could see play out. Ultimately, it is at the discretion of the government and then any other cases which may be brought on this topic or the APA topic in general.

Kevin Chmura

Yeah, that was well said. So maybe as we move to our closing, what I’ll ask you a few more sort of simple things for practical advice for our listeners. Do you think there’s any other potential future legal or regulatory changes they should really be watching out for? And maybe, two-part question, How do they stay informed and prepare for any additional changes in the area?

Rachel V. Rose

That’s a great question. I think first and foremost, your primary sources are your best sources. So I would always look at state websites, typically their own HHS items. I also would look to trusted partners such as Panacea and First Healthcare Compliance. And for example, AHEMA normally has really good reviews and experts. There are there’s Namaz. I mean, there are a lot of really good, reputable third parties that are conscientious about the content that they put out.

So trying to stay abreast of all of the myriad of changes can be daunting. But I will say appreciating where to go in your own state is probably first and foremost what’s important, because as we’ve discussed, some of this is going to come down to the state level as well. And that’s something that is, you know, I tell your clients all of the time and I’m very cautious whenever I get asked questions to say state law may differ or alter the outcome.

So it’s imperative that any covered entity or business associate consult those state laws and the HHS website.

Kevin Chmura

But that’s great advice and I will add to it for our listeners case follow Rachel as well. She recently authored an article on this exact topic, which was helpful in me preparing for this today. So with that, Rachel, I say thank you very much as always, your expert advice here is invaluable. This is a shifting topic.

So what I would say is for the listeners, pay attention. We’re likely to put out more content on this face. Rachel, I’ll reserve the right to ask you to come back and keep us updated because it feels like there will be more to talk about relative to Purl and other areas. We have a lot happening right now.

So Rachel, thank you very much as always.

Rachel V. Rose

You’re very welcome, Kevin. And one thing just to bear in mind is that the reproductive healthcare definition that was initially issued was broadly defined and actually not only considered maternity care and contraception, it also impacted vasectomies, mammograms, sexually transmitted infection screenings and in vitro fertilization, as well as the gender affirming care, which we also discussed.

Kevin Chmura

Wow, yeah, so and that’s the complexity of these issues goes often beyond just the headline, which is why your advice is so helpful for everybody. So thank you again.

Rachel V. Rose

Thank you., and we’ll look forward to next time, Kevin.

Kevin Chmura

Thank you. So to our listeners, we encourage you to review your HIPAA policies, procedures, and training materials in light of these court decisions and stay informed on as legal landscape changes. So please pay attention. We’re here for you, at First Healthcare Compliance and Panacea. Rachel is a great resource for you as well. If you’d like to learn more, just visit our website, at First Healthcare Compliance, which is 1sthcc.com. Or you can go to Panacea and follow the links for compliance or reach out to our team at any time with questions. Don’t forget to subscribe to 1^st Talk compliance on your favorite platform and never miss another episode. Thanks for tuning in and we’ll see you next time.

270 episodes

#Business News #Healthcare Compliance #1st Talk Compliance #News