PURL v. UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES (2024)

MEMORANDUM OPINION AND ORDER

Before the Court is Plaintiffs’ Motion for Preliminary Injunction (“Motion”) (ECF No. 24), filed November 12, 2024. Defendants responded on December 3, 2024, and Plaintiffs replied on December 10, 2024. ECF Nos. 29; 31.

 Introduction

Though the Supreme Court's landmark decision in Dobbs returned the issue to the states, the Biden Administration vowed to use federal agency power to “support access to the full spectrum of reproductive care, including abortion.”¹ At issue here, the 2024 Rule invokes the “privacy” protections of the 1996 Health Insurance Portability and Accountability Act (“HIPAA”) to restrict disclosure of information not referenced in the statute or regulations promulgated in the ensuing 28 years: “abortion” and “gender identity,” though the subject-matter is cloaked in the catchall term “reproductive health care.” ECF No. 24 at 9-10 (citing 89 Fed. Reg. 32976, 33005, 32989 n.163 (Apr. 26, 2024) (to be codified at 45 C.F.R. pts. 160, 164)). The 2024 Rule compliance deadline is tomorrow, December 23rd.

Having considered the briefing and relevant law,² the Court GRANTS the Motion and preliminarily ENJOINS Defendants from enforcing the 2024 Rule against Plaintiffs pursuant to Federal Rule of Civil Procedure 65(a). The Court further ORDERS summary judgment briefing pursuant to Federal Rule of Procedure 56 and supplemental briefing by the parties to satisfy the specificity and scope requirements of any permanent relief pursuant to Federal Rule of Civil Procedure 65(d).

 Background

HIPAA

Congress passed HIPAA in 1996. Pub. L. No. 104-191, 110 Stat. 1936 (1996). Congress designed HIPAA to “improve portability and continuity of health insurance coverage,” and “to simplify the administration of health insurance.” Id. 110 Stat. at 1936. In so doing, Congress tackled “the efficiency and effectiveness of the health care system” and “encourage[ed] the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.” Id. § 261, 110 Stat. at 2021. HIPAA is enforceable against “covered entities,” including: health plans, health care clearinghouses, and health care providers “who transmit[ ] any health information in electronic form” in connection with a HIPAA-covered transaction. Id. § 262, 110 Stat. at 2023. Any “covered entity” who “discloses individually identifiable health information to another person” is punishable under HIPAA if said disclosure violated the enforcing regulations. Id. § 262, 110 Stat. at 2029.

Congress instructed the Department of Health and Human Services (“HHS”) to enact “final regulations” for HIPAA if Congress did not respond within “36 months” of the relevant HHS recommendations. Id. § 264, 110 Stat. at 2033. The recommendations or enforcing regulations must cover at least three subjects. First, Congress told HHS to address the “rights that an individual who is a subject of individually identifiable health information should have.” Id. Second, Congress told HHS to address the “procedures that should be established for the exercise of such rights.” Id. And third, Congress told HHS to address the “uses and disclosures of such information that should be authorized or required.” Id.

Congress also considered the relation between HIPAA and state law. Accordingly, any regulation HHS promulgated could not preempt a contrary state law with “more stringent” requirements for protecting health information. Id. § 264, 110 Stat. at 2033–34. Further, Congress mandated that HIPAA cannot be “construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention.” Id. § 262, 110 Stat. at 2030 (emphasis added); 42 U.S.C. § 1320d-7(b); see also Barbara J. Evans, Institutional Competence to Balance Privacy and Competing Values: The Forgotten Third Prong of HIPAA Preemption Analysis, 46 U.C. Davis L. Rev. 1175, 1200 (2013) (Section 1320d-7(b) is “a broad rule of construction that directs judges, regulators, and all others to make sure to protect laws that provide for the enumerated public health activities”).

Congress did not meet its deadline.

Thus, HHS promulgated the Privacy Rule in 2000 to enact “standards to protect the privacy of individually identifiable health information.” Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82462 (Dec. 28, 2000) (codified at 45 C.F.R. pts. 160, 164). The Privacy Rule's standards provide “enhanced protections for individually identifiable health information” to address public concerns about technology in healthcare. Id. In general, the Privacy Rule bars disclosure of protected health information (“PHI”) without an individual's authorization — unless disclosure is for a “specified purpose,” including: treatment, payment, healthcare operations, subpoena or other judicial or administrative proceeding, public health oversight, surveillance, or investigation; a serious and imminent threat to an individual's or the public's safety is present; and for a law enforcement purpose. 45 C.F.R. §§ 164.506, 164.502, 164.512 (2023).

The Privacy Rule permits disclosure to law enforcement “for a law enforcement purpose” when disclosure would meet the requirements of whatever reason the disclosure is needed. See id. § 164.512(f)(1)—(6). Law enforcement purposes include disclosing as the law otherwise requires, identifying or locating an individual, and reporting crime in emergencies. Id. § 164.512(f)(1), (2), (6). The Privacy Rule specifically protects reports of “child abuse” to those “authorized by law” to receive such reports. Id. § 164.512(b)(1)(ii).

2024 Rule

HHS amended the Privacy Rule in 2024 (“2024 Rule”). HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. 32978. The 2024 Rule went into effect on June 25, 2024. Id. at 32976, 32979. Subject entities must comply by December 23, 2024, and amend their required Notices of Privacy Practices by February 16, 2026. Id.

The 2024 Rule was expressly responsive or reactive to the “changing legal landscape.” Id. at 32978. Specifically, according to HHS, Dobbs v. Jackson Women's Health Organization wrought “far-reaching implications for reproductive health care” that “increase[d] the likelihood that an individual's PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect.” 597 U.S. 215, 142 S.Ct. 2228, 213 L.Ed.2d 545 (2022); HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 32978. Specifically, HHS leadership worried aloud that Dobbs might prevent women from seeking abortion-related providers and invoked HIPAA as a shield against abortion-restrictive states.³ The 2024 Rule “amends provisions of the Privacy Rule to strengthen privacy protections for highly sensitive PHI about the reproductive health care of an individual.” HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 32978. It defines “reproductive health care” as “health care ․ that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.” Id. at 33063. The 2024 Rule prohibits the disclosure of information about “reproductive health care” for at least three specific purposes:

(1) To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.

(2) To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.

(3) To identify any person [for these purposes]. Id.

Thus, the 2024 Rule restricts disclosure of “reproductive health care” information if “investigation” or “liability” attaches for the “mere act” of seeking, procuring, or facilitating defined or omitted medical services — including “abortion” and “gender identity” procedures regulated in many states. ECF No. 24 at 9–10 (citing 89 Fed. Reg. at 32987–89 n. 163). But it only restricts disclosure if state or federal law deems the medical service “lawful” under the circumstances it was provided. The 2024 Rule states:

The prohibition ․ applies only where the relevant activity is in connection with any person seeking, obtaining, providing, or facilitating reproductive health care, and the [entity from which information is sought] has reasonably determined that one or more of the following conditions exists:

(1) The reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided.

(2) The reproductive health care is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided.

(3) [The entity presumes the health care lawful unless it knows or is shown otherwise]. Id.

In summary, the 2024 Rule bars disclosure of “reproductive healthcare information” — as HHS vaguely, tautologically defines the term — if “legal” under the circumstances it was provided and the requester seeks to “investigate” or impose “liability” for “merely” seeking, procuring, or facilitating the defined or omitted medical service. Further, those seeking disclosure must often provide an “attestation” that contains a “description of the information requested,” and a “clear statement that the use or disclosure is not for a purpose” the 2024 Rule prohibits. Id. at 33064.

Dr. Purl's Practice

Dr. Carmen Purl is the owner of Dr. Purl's Fast Care Walk In Clinic (“Clinic”). The Clinic employees three nurse practitioners and other personnel who provide common medical services. ECF No. 25 at 3–6. Dr. Purl and the Clinic (collectively, “Plaintiffs”) sued to declare the 2024 Rule “arbitrary and capricious” and “in excess of statutory authority,” in violation of the Administrative Procedure Act (“APA”). ECF No. 1 at 18–20.

Dr. Purl is a “covered entity” subject to HIPAA. She argues that the 2024 Rule will impair her and her employees’ ability to fulfill their state-mandated obligation to report “child abuse” or participate in “public health investigations.” ECF No. 24 at 19; Tex. Fam. Code § 261.101(a). At the Clinic, Dr. Purl and her staff regularly encounter children who have been abused and she reported those cases to Texas Child Protective Services (“CPS”). ECF No. 24 at 8-9. Additionally, she responds to approximately ten to twelve requests per year from Texas CPS to facilitate its investigations of child abuse or neglect. Id. at 10. She seeks a preliminary injunction of the 2024 Rule to continue her longstanding cooperation with these CPS requests even though they may seek information in violation of the 2024 Rule — and to continue to freely report suspected “child abuse.”

 Legal Standard

Federal courts have equitable power to issue preliminary injunctions under Federal Rule of Civil Procedure 65. A preliminary injunction is an extraordinary remedy requiring the movant to unequivocally show she is entitled to relief. Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 22, 129 S.Ct. 365, 172 L.Ed.2d 249 (2008). “Its purpose ‘is merely to preserve the relative positions of the parties until a trial on the merits can be held.’ ” Starbucks Corp. v. McKinney, 602 U.S. 339, 346, 144 S.Ct. 1570, 219 L.Ed.2d 99 (2024) (quoting Univ. of Tex. v. Camenisch, 451 U.S. 390, 395, 101 S.Ct. 1830, 68 L.Ed.2d 175 (1981)). To obtain one, the movant must show (1) she is likely to succeed on the merits, (2) she is likely to suffer irreparable harm without an injunction, (3) the balance of equities tips in her favor, and (4) an injunction is in the public interest. United States v. Abbott, 110 F.4th 700, 706 (5th Cir. 2024) (citing Winter, 555 U.S. at 20, 129 S.Ct. 365).

The first factor is “the most important.” Mock v. Garland, 75 F.4th 563, 587 n.50 (5th Cir. 2023). The latter two merge when the government is an opposing party. Nken v. Holder, 556 U.S. 418, 435, 129 S.Ct. 1749, 173 L.Ed.2d 550 (2009). But no factor has a “fixed quantitative value.” Mock, 75 F.4th at 587. On the contrary, “a sliding scale is utilized, which takes into account the intensity of each in a given calculus.” Id. In sum, the “decision to grant or deny [relief] lies within the sound discretion of the trial court.” White v. Carlucci, 862 F.2d 1209, 1211 (5th Cir. 1989).

 Analysis

1. Irreparable Harm

A movant must demonstrate she is likely to suffer irreparable harm if the preliminary injunction is not granted. See Abbott, 110 F.4th at 706. Preventing irreparable harm is the “central purpose of a preliminary injunction” that justifies the exercise of “equitable power.” Parks v. Dunlop, 517 F.2d 785, 787 (5th Cir. 1975). An irreparable harm is one that would not be able to be adequately remedied at law. Daniels Health Scis., LLC v. Vascular Health Scis., LLC, 710 F.3d 579, 585 (5th Cir. 2013). If adequate compensatory relief could be available later in the ordinary course of litigation, then irreparable harm may not be present. Enter. Int'l, Inc. v. Coporacion Estatal Petrolera Ecuatoriana, 762 F.2d 464, 474 (5th Cir. 1985). But if the movant will likely never recover the costs through the litigation, then irreparable harm may be present. See Enter. Int'l, 762 F.2d at 474.

The irreparable harm factor is generally satisfied when the harm would be unrecoverable because of a government-defendant's sovereign immunity. See Wages & White Lion Invs., 16 F.4th 1130, 1142 (5th Cir. 2021). The Fifth Circuit explicitly recognizes that “the nonrecoverable costs of complying with a putatively invalid regulation typically constitute irreparable harm.” Rest. L. Ctr. v. U.S. Dep't of Lab., 66 F.4th 593, 597 (5th Cir. 2023); see also Louisiana v. Biden, 55 F.4th 1017, 1034 (5th Cir. 2022) (“[C]omplying with a regulation later held invalid almost always produces the irreparable harm of nonrecoverable compliance costs.” (emphasis in original) (quoting Texas v. EPA, 829 F.3d 405, 433 (5th Cir. 2016))); Thunder Basin Coal Co. v. Reich, 510 U.S. 200, 220–21, 114 S.Ct. 771, 127 L.Ed.2d 29 (1994) (Scalia, J., concurring in part and in the judgment). Of course, these compliance costs cannot be simple speculation or baseless fears. See Louisiana v. Biden, 55 F.4th at 1034; Daniels Health Scis., 710 F.3d at 585. Instead, those future compliance costs harm must be “real” and “immediate.” Aransas Project v. Shaw, 775 F.3d 641, 648 (5th Cir. 2014). And the “magnitude” of the future costs matters far less than their irreparability. Texas v. EPA, 829 F.3d at 433 (quoting Enter. Int'l, 762 F.2d at 472). Their magnitude must only be more than de minimis. See Louisiana v. Biden, 55 F.4th at 1035. Requiring a movant to achieve a “precise dollar figure” to count as irreparable harm “reflects an exactitude our law does not require.” Rest. L. Ctr., 66 F.4th at 600.

Plaintiffs argue the 2024 Rule will inflict irreparable harm. They claim the 2024 Rule imposes financial costs to comply therewith. ECF No. 24 at 28. These costs include (1) updating privacy notices, (2) developing new or modified procedures, and (3) staff training. Id. Here, the 2024 Rule itself notes that “covered entities” will incur compliance costs. See HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 33056 (explaining and estimating compliance costs for, among other things, “new or modified policies and procedures” and for “training a specialist to update the covered entity's HIPAA training program with new content”). Plaintiffs estimate that their compliance costs will at least meet HHS's estimates. ECF No. 24 at 22; 25 at 7–8.

Defendants’ brief focuses on the irreparable harm factor. See ECF No. 29 at 14-18. They argue Plaintiffs’ compliance costs “do not warrant relief” because they are either de minimis or “purely speculative,” based on unfounded fears. Id. at 16. Defendants dismiss the costs for updating privacy notices because that provision of the 2024 Rule does not go into effect until February 2026. They claim the remaining costs are “speculative, unsubstantiated, or de minimis” because the HHS's own estimates apparently do not sufficiently approximate Dr. Purl's clinic costs. Id. at 17.

Despite Dr. Purl's sworn affidavit estimating the compliance costs she would incur, Defendants think Dr. Purl should (somehow) comply more cheaply. See id. at 18 (puzzlingly invoking FDA v. All. for Hippocratic Med., 602 U.S. 367, 394, 144 S.Ct. 1540, 219 L.Ed.2d 121 (2024), to claim a plaintiff cannot “spend its way into standing” despite FDA v. Alliance rejecting an argument that opposition — not compliance — costs can be injurious). Instead of training or hiring staff, Defendants aver that Dr. Purl should process 2024 Rule requests all by “herself.” Id. at 18. Or maybe Dr. Purl should flout Page 33056 of the 2024 Rule and not create or modify her office policies. Compare id. (“[Dr. Purl] has not explained what her current policies are or why they would have to change in response to the 2024 Rule.”), with HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 33056 (“The Department anticipates that covered entities will need to develop new or modified policies and procedures for the new requirements ․”).

But nothing requires Plaintiffs to explain in excruciating detail exactly how their compliance costs will materialize. They simply must not be speculative or de minimis. Plaintiffs’ compliance costs are neither. Instead, Plaintiffs allege the very compliance costs contemplated by Defendants themselves. See HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 33056.

The Fifth Circuit has resoundingly rejected the very arguments Defendants make here. In Restaurant Law Center v. United States Department of Labor, the district court faulted plaintiffs for providing mere “generalizations” about compliance costs when the Department of Labor itself estimated that businesses would incur compliance costs. 66 F.4th at 599-60. But that is exactly what Defendants attempt to do here. Except Plaintiffs exhibit more details than did the party in Restaurant Law Center. This Court will not repeat the lower court's error in that case.

Here, Plaintiffs aver they must do some level of training. HHS agrees. Plaintiffs argue they must implement new or revised procedures. HHS agrees. Defendants manage to miss that “Plaintiffs assert that [they] will incur exactly the kinds of ․ compliance costs predicted by the [HHS] itself.” Rest. L. Ctr., 66 F.4th at 598. And Plaintiffs provide far more information about their estimated compliance costs than the plaintiffs in Restaurant Law Center. Plaintiffs estimate the specific costs they would incur from training and procedure updates.

Defendants respond that these Plaintiffs should find cheaper solutions or provide a more itemized, specific inventory of compliance costs. But Plaintiffs need not provide specific, estimated dollar amounts. See Rest. L. Ctr., 66 F.4th at 600 (“Nor does it matter that Plaintiffs did not convert each allegation of harm into a specific dollar amount․ Stringently insisting on a precise dollar figure reflects an exactitude our law does not require.”). Moreover, Plaintiffs did provide estimated costs. Even if Plaintiffs ultimately incur lesser costs over the next weeks, months, or years, they have easily satisfied the de minimis standard required at this page of litigation. See Texas v. EPA, 829 F.3d at 433 (“[I]t is not so much the magnitude ․ that counts ․”) (quoting Enter. Int'l, 762 F.2d at 472) (second omission in original). And HHS's own expectation that covered entities will need to take compliance actions take the irreparable injury out of the realm of mere speculation. Nobody contests that these costs would be unrecoverable should Plaintiffs prevail: Defendants have sovereign immunity.

Thus, Plaintiffs have provided more than sufficient evidence to find they satisfy the irreparable harm factor and have a cognizable injury for standing.

2. Likelihood of Success on the Merits

A movant must establish a likelihood of success on the merits to prevail on a motion for a preliminary injunction. See Byrum v. Landreth, 566 F.3d 442, 445 (5th Cir. 2009). To decide whether the movant prevails, the Court looks to “standards provided by the substantive law.” Janvey v. Alguire, 647 F.3d 585, 596 (5th Cir. 2011) (quoting Roho, Inc. v. Marquis, 902 F.2d 356, 358 (5th Cir. 1990)). The movant need not provide evidence that would satisfy a summary judgment standard. Id. at 595-96. Nor must she prove she is certain to prevail at the case's conclusion. See Charles Alan Wright, Arthur R. Miller, Mary Kay Kane, 11A Federal Practice & Procedure § 2948.3 (3d ed. 2024) (“All courts agree that plaintiff must present a prima facie case but need not show a certainty of winning.”). Rather, she must show a “reasonably probable chance” of succeeding on the merits.

The APA compels courts to “hold unlawful and set aside” agency actions that are “in excess of statutory jurisdiction, authority, or limitations.” 5 U.S.C. § 706(2), (2)(C). It confers on this Court the duty of “decid[ing] all relevant questions of law, interpret[ing] constitutional and statutory provisions, and determine[ing] the meaning or applicability of the terms of an agency action.” 5 U.S.C. § 706. When exercising this duty, the central question is “always, simply, whether the agency has stayed within the bounds of its statutory authority.” City of Arlington v. FCC, 569 U.S. 290, 297, 133 S.Ct. 1863, 185 L.Ed.2d 941 (2013) (emphasis omitted). To answer that question, courts must begin with the statute's text to fulfill the APA's mandate to “determin[e] the meaning of statutory provisions.” Loper Bright Ents. v. Raimondo, ––– U.S. ––––, 144 S. Ct. 2244, 219 L.Ed.2d 832 (2024); Sackett v. EPA, 598 U.S. 651, 671, 143 S.Ct. 1322, 215 L.Ed.2d 579 (2023). This inquiry is not mechanical or rigid. Instead, the plain, “ordinary meaning and structure of the law itself” governs. Food Mktg. Inst. v. Argus Leader Media, 588 U.S. 427, 436, 139 S.Ct. 2356, 204 L.Ed.2d 742 (2019). Sometimes, statutes grant agencies discretion to interpret and other times, they do not. Loper Bright, 144 S. Ct. at 2263. When they do not, courts exercise their role and Congress's mandate to interpret the statute free from an agency's read. Loper, 144 S. Ct. at 2263.

Here, whether the 2024 Rule exceeds statutory authority turns on the meaning of “limit” in HIPAA. 42 U.S.C. § 1320d-7(b). Congress decreed that “[n]othing in [HIPAA] shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention.” Id. (emphasis added).

Plaintiffs argue that the 2024 Rule “unlawfully limits disclosures about child abuse” to states like Texas. ECF No. 24 at 20 (emphasis added). They aver HHS limits such disclosures by curtailing doctors’ ability to freely report suspected “child abuse” and instead forces them into a “labyrinth of criteria” to determine what can and cannot be disclosed. Id. Texas specifically requires doctors to report suspected “child abuse.” See Tex. Fam. Code § 261.101(a) (“A person having reasonable cause to believe that a child's physical or mental health or welfare has been adversely affected by abuse or neglect by any person shall immediately make a report ․”); id. § 261.101(b) (imposing additional requirements on licensed professionals); id. § 261.109 (imposing penalties for failing to report). It even extends immunity “from civil or criminal liability that might otherwise be incurred or imposed” for reports made in good faith. Tex. Fam. Code § 261.106(a). Plaintiffs argue that forcing a doctor to toe a tightrope where the doctor must make complex factual, prudential, and legal judgments is exactly what HIPAA barred with respect to child abuse reporting. Such restrictions and obstructions to the unbarred reporting of “child abuse,” Plaintiffs argue, impose a “limit” where the statute permits none.

Defendants insist the 2024 Rule presents no problem at all. They flag various 2024 Rule language to aver that the regulation “does not seek to prohibit disclosures of PHI where the request is for reasons other than investigating or imposing liability on persons for the mere act of seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which such health care is provided.” HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 32994 (emphasis added). Thus, Defendants aver it is “illogical” for “lawful” care to ever encompass “child abuse” under state law.⁴ Id. at 20. As a backstop, Defendants admit that “some provisions of the 2024 Rule might hypothetically conflict with certain unknown state laws in some circumstances” and say such a hypothetical would counsel an injunction tailored to the parts of the 2024 Rule that do conflict. Id. (arguing that if a conflict occurs in some circumstances there is “no basis to enjoin the entirety of the Rule in all circumstances; the Rule contains a severability provision”).

To determine whether the 2024 Rule places an unlawful “limit” on laws providing for the reporting of child abuse, the Court turns to the meaning of “limit” in HIPAA. A term not defined in a statute is to be given its ordinary, common meaning as understood by the people it governs. See MCI Telecomms. Corp. v. Am. Telephone & Telegraph Co., 512 U.S. 218, 114 S.Ct. 2223, 129 L.Ed.2d 182 (1994) (Scalia, J.) (construing a statutorily undefined term using several dictionaries); see also Grayned v. City of Rockford, 408 U.S. 104, 108, 92 S.Ct. 2294, 33 L.Ed.2d 222 (1972). HIPAA does not define “limit.” Black's Law Dictionary defines “limit” as a “restriction or restraint.” Limit, Black's Law Dictionary (12th ed. 2024). Similarly, Merriam Webster defines “limit” as meaning “to curtail or reduce in ․ extent.” Limit, Merriam-Webster's Collegiate Dictionary (11th ed. 2014). The Oxford English Dictionary says likewise and defines it as meaning “to bound, restrict.” Limit, Oxford English Dictionary (3d ed. rev. 2024). All agree that something is limited when restrictions, restraints, or curtailments are imposed. “Limit” does not mean that such restraints completely bar whatever is limited. Instead, laws that curtail or restrain the activity — even if the activity is not completely prohibited — limit the activity through imposing obstructions to the relevant activity.

Congress forbade HIPAA and its regulations from “limit[ing] the authority, power, or procedures established under any law providing for the reporting of ․ child abuse.” 42 U.S.C. § 1320d-7(b). It prohibited HIPAA and its regulations from placing hurdles in the way of state laws related to child-abuse reporting. The Court agrees that such hurdles, at the end of an interpretive process, may not outright bar reporting of child abuse in select scenarios. The 2024 Rule itself at least does not “seek” that outcome. HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 32994. But as a posted Speed Limit mandates a driver slow down but does not outright prohibit driving, the 2024 Rule slows down the “procedures established under any law providing for the reporting of ․ child abuse” — even if after the doctor treads the 2024 Rule's technicalities, disclosure would be permitted. 42 U.S.C. § 1320d-7(b). Such curtailments constitute “limits” where HIPAA allows none.

The 2024 Rule “limits” practitioners from reporting “child abuse” in several ways. It requires “covered entities” to determine whether the relevant “reproductive healthcare” was “lawful” under the circumstances it was acquired. See HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 33063 (prohibiting disclosure if the reproductive healthcare was “lawful under the law of the state in which such health care is provided” or is “protected, required, or authorized by” federal law). If the doctor or other “covered entity” cannot reasonably make that determination, they must presume it was “lawful” unless they know or are reasonably shown otherwise. See id. (the “reproductive health care provided by another person is presumed lawful” unless the covered entity has “[a]ctual knowledge that the reproductive health care was not lawful” or supplied information “demonstrates a substantial factual basis that the reproductive health care was not lawful”).

But, of course, many “covered entities” are not prepared or equipped to make nuanced legal judgments. HHS itself admits that they are not: “[T]he Department recognizes that situations may arise where a regulated entity reasonably determines that reproductive health care was lawfully provided, while at the same time, the person requesting the PHI (e.g., law enforcement) reasonably believes otherwise.” HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 32993. In such circumstances, the 2024 Rule would “prohibit the regulated entity from disclosing [the] PHI.” Id. Then, a “covered entity” risks a HIPAA violation or, on the other hand, incurring whatever penalties Texas law may or may not impose for their refusal. This legal analysis is difficult for lawyers, much less doctors.

For example, HHS previously argued that the Emergency Medical Treatment and Active Labor Act (“EMTALA”) mandates abortion care under federal law in emergency scenarios. See Guidance on Nondiscrimination Protections Under the Church Amendment, Dep't of Health & Hum. Servs. (Feb. 3, 2023), https://www.hhs.gov/conscience/conscience-protections/guidance-church-amendments-protections/index.html [https://perma.cc/59C4-FJE8]. The 2024 Rule would require a doctor to navigate whether an abortion was “legal” under EMTALA, and therefore federal law, before disclosing and risking liability under HIPAA. Such questions confounded Article III courts — never mind medical professionals. See, e.g., Moyle v. United States, 603 U.S. 324, 144 S. Ct. 2015, 219 L.Ed.2d 804 (2024) (mem.).

Moreover, the legality of abortion and other “reproductive health care” procedures fluctuate with the political winds. See, e.g., Anjalee Behti, Comment, Trump's Ruthless Expansion of the Mexico City Policy Threatens Reproductive Health Abroad, 53 Univ. S.F. L. Rev. 117, 119–21 (2019) (describing the back-and-forth implementation and recission of a policy that prohibits U.S. funds to NGOs that provide abortions). HHS's own guidance, reviewed and unmodified after Dobbs, avers that abortions are lawful “under federal law.” See Guidance on Nondiscrimination Protections Under the Church Amendment, supra. The 2024 Rule precludes PHI disclosure if the “reproductive health care is protected, required, or authorized by ․ the United States Constitution․” 89 Fed. Reg. at 33063. Should Plaintiffs consult Article III courts or law professors to ascertain which abortions are “lawful” after Dobbs? See, e.g., John Hart Ely, The Wages of Crying Wolf: A Comment on Roe v. Wade, 82 Yale L.J. 920, 944 (1973) (“Law professors do not agree on what results are ‘good,’ and even if they did, there is no reason to assume their judgment is any better on that issue than the Court's.”).

Even more, the 2024 Rule imposes an “attestation” requirement on law enforcement before specified “reproductive health” information may be disclosed. Id. at 33064 (“A covered entity ․ may not use or disclose protected health information potentially related to reproductive health care for purposes specified in [the 2024 Rule] without obtaining an attestation ․”). HHS imposes strict requirements for a valid “attestation.” It must say the information will not be used for a prohibited purpose; must not contain any extra, nonrequired statements; must be believable to a reasonable covered entity; must contain a specific description of the sought information; must contain a statement that a covered entity could be subject to penalties for a HIPAA violation; must be in plain language; and must be signed. Id. at 33063-64. If any one of these requirements is not met, the covered entity “may not use or disclose.” Id. at 33063. The “covered entity” is responsible for evaluating the “attestation” and if it is “defective” then they are “not in compliance.” Id.

Requiring a doctor or other “covered entity” to navigate these requirements and make perplexing legal judgments necessarily “limits” reporting “child abuse” as Texas law mandates. For professionals like Dr. Purl, Texas law requires a suspected report to be made within 48 hours of her suspicion. Tex. Fam. Code § 261.101(b). Further, she may not delegate the task to others or rely on them to submit the report. Id. Or, Dr. Purl must navigate the same complex requirements in response to any one of the ten to twelve requests she receives from CPS per year regarding suspected “child abuse.” See ECF No. 24 at 10. CPS typically demands the “full, unredacted patient chart” when it makes such requests. Id. That chart contains “information about the patient's last menstrual period, her age of menarche, number of pregnancies, and number of live births.” Id. at 9. If Dr. Purl misreads the 2024 Rule and fails to make a report within 48 hours, she is in violation of Texas law. If CPS requests PHI pursuant to a “child abuse” investigation but Dr. Purl discerns the CPS “attestation” is defective — or suspects law enforcement is “investigating” for an impermissible purpose under the 2024 Rule — therein lies another “limit.”

Again, even if a more nuanced reading of the 2024 Rule allowed child-abuse reporting to Texas CPS, a nonlawyer licensed physician is not equipped to navigate these intersecting legal labyrinths. And it is precisely such restraints and impediments that Congress forbade when it comes to child-abuse reporting. Congress said HIPAA shall not “limit the authority, power, or procedures” for reporting child abuse. 42 U.S.C. § 1320d-7(b). But, as HHS admits, Dr. Purl may mis-navigate these labyrinthine legal rules. If so, the 2024 Rule “limits” exactly as Congress prohibited. Even if Dr. Purl, without legal training, enforced the 2024 Rule perfectly in response to every CPS request or case of suspected child abuse, the 2024 Rule would still constitute a limit. A “limit” presents anytime a HIPAA regulation raises impediments, restraints, or curtailments to eventual disclosure. See, e.g., White v. State, 370 Ark. 284, 259 S.W.3d 410, 415 (2007) (“The purpose of HIPAA is to increase privacy surrounding medical records; however, HIPAA at 42 U.S.C. § 1320d-7(b) (1998), provides that nothing within the Act is to be construed to limit a state's authority to investigate crimes.”). The 2024 Rule, by its very terms and HHS's admission, does just that. At this juncture, Plaintiffs have satisfied a likelihood of success on the merits that the 2024 Rule is in excess of HIPAA's statutory authority.

3. Balance of Equities and Public Interest

The remaining preliminary injunction factors require that the “balance of equities” tip in Plaintiffs’ favor and that the “public interest” would be served by an injunction. These two factors “merge when the Government is the opposing party,” as here. Clarke v. Commodity Futures Trading Comm'n, 74 F.4th 627, 643 (5th Cir. 2023). To prevail on these factors, a movant must establish that her irreparable harm is greater than the hardship the government would incur from a preliminary injunction. A court is to weigh “the competing claims of injury and ․ consider the effect on each party of the granting or withholding of the requested relief” while at the same time consider the public consequences of granting the preliminary injunction. Winter, 555 U.S. at 24, 129 S.Ct. 365 (quoting Amoco Production Co. v. Cambell, 480 U.S. 531, 542, 107 S.Ct. 1396, 94 L.Ed.2d 542 (1987)). District courts may consider an opposing party's harms, but they may not consider a party's desire or interest in continuing to engage “in an alleged violation” of a statute. Starbucks Corp., 602 U.S. at 362, 144 S.Ct. 1570 (Jackson, J., concurring in part and in the judgment and dissenting in part).

Plaintiffs argue that the “balance of equities” tips in their favor because if they comply with the 2024 Rule, they will risk violating state-law reporting mandates and will incur compliance costs for their trouble. ECF No. 24 at 29-30. Defendants counter that “reproductive healthcare information” is particularly sensitive and if the 2024 Rule is enjoined, Dr. Purl may disclose patient PHI. ECF No. 29 at 28. Defendants continue and claim that if the 2024 Rule were enjoined, “individuals may be deterred from seeking needed health care if they do not trust that their sensitive information will be kept private.” Id. (quoting HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 32984).

Plaintiffs prevail on these factors as well. As shown, Plaintiffs would incur “hardship” if forced to comply with the 2024 Rule or conflicting Texas “child abuse” requirements. Congress explicitly forbade HIPAA and its regulations from placing Plaintiffs in such a bind. Additionally, Plaintiffs’ nonrecoverable compliance costs constitute another “hardship,” further tipping the scales in their favor.

Defendants invoke little to no “hardship.” Reproductive healthcare information is indeed sensitive medical information. But the Privacy Rule already protects reproductive healthcare information the same as all other sensitive medical information. That has been the status quo since the Privacy Rule took effect in 2000. If Defendants are concerned that denying surplus protection to “reproductive health care” information will dissuade some patients, it is because select states have curtailed or banned select abortion services. (HHS press releases, webpages, and portions of the 2024 Rule admit as much.) But that is fully within a state's constitutional purview post-Dobbs. Here it is not the state's medical judgments that are contrary to law but, as explained, it is likely the 2024 Rule. So, Defendants’ assertions that enjoining the law is against the public interest ring hollow because a party may not invoke an interest in engaging in a likely statutory violation. See Starbucks Corp., 602 U.S. at 362, 144 S.Ct. 1570 (Jackson, J., concurring in part and in the judgment and dissenting in part).

 Additional Briefing

The Court ORDERS the parties to submit summary judgment briefing pursuant to Federal Rule of Procedure 56. The summary judgment briefing dates and deadlines will be set in a subsequent ORDER.

The 2024 Rule was responsive and reactive to the “changing legal landscape” following Dobbs — and the need to preserve trust in the healthcare system. ECF No. 29 at 11 (quoting HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 32978). Thus, the 2024 Rule “limits” state law amidst a public controversy of vast “economic and political significance” based on a broad delegation of legislative power to HHS via HIPAA. See, e.g., West Virginia v. EPA, 597 U.S. 697, 142 S. Ct. 2587, 2607-08, 213 L.Ed.2d 896 (2022).

The Court ORDERS the parties to submit supplemental briefing pursuant to Federal Rule of Civil Procedure 65(d) explaining how (1) the Supreme Court's decision in Loper Bright Enterprises v. Raimondo, ––– U.S. ––––, 144 S. Ct. 2244, 219 L.Ed.2d 832 (2024), (2) the major questions doctrine, and (3) the nondelegation doctrine affect the constitutionality or legality of HIPAA and HHS's authority to issue the 2024 Rule.

Additionally, the 2024 Rule defines “reproductive health care” to be “health care ․ that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.” HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. at 33063. “A regulation is void for vagueness when it is so unclear that people ‘of common intelligence must necessarily guess at its meaning and differ as to its application.’ ” McClelland v. Katy Indep. Sch. Dist., 63 F.4th 996, 1013 (5th Cir. 2023) (quoting Connally v. Gen. Constr. Co., 269 U.S. 385, 391, 46 S.Ct. 126, 70 L.Ed. 322 (1926)). The 2024 Rule defines “reproductive health care” as any health care that affects or relates to the reproductive system. That definition may be construed in several ways such that reasonable people may “differ as to its application.” McClelland, 63 F.4th at 1013 (quoting Connally, 269 U.S. at 391, 46 S.Ct. 126). The Court ORDERS supplemental briefing from both parties explaining how the definition of the regulation is or is not “void for vagueness.”

The supplemental briefing dates and deadlines will be set in a subsequent ORDER.

 Conclusion

Plaintiffs’ Motion is GRANTED. Defendants are preliminarily ENJOINED from enforcing the 2024 Rule against Plaintiffs during the remainder of this suit.

SO ORDERED.

FOOTNOTES

1.   Dobbs v. Jackson Women's Health Org., 597 U.S. 215, 142 S.Ct. 2228, 213 L.Ed.2d 545 (2022); see Dep't of Health & Hum. Servs., Marking the 50th Anniversary of Roe: Biden-Harris Administration Efforts to Protect Reproductive Health Care 3 (2023), https://www.hhs.gov/sites/default/files/roe-report.pdf [https://perma.cc/NMH4-656E]; HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care, Dep't of Health & Hum. Servs. (June 29, 2022), https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/phi-reproductive-health/ index.html [https://perma.cc/UT87-BWNU].

2.   Neither party requested nor even mentioned a hearing. A hearing is only required for a preliminary injunction if relevant factual disputes exist. See Kaepa, Inc. v. Achilles Corp., 76 F.3d 624, 628 (5th Cir. 1996). “If no factual dispute is involved, however, no oral hearing is required” if parties have “ample opportunity to present their respective views of the legal issues involved.” Id. (quoting Commerce Park at DFW Freeport v. Mardian Const. Co., 729 F.2d 334, 341 (5th Cir. 1984)). Both parties had ample opportunity, and the Court discerns that the injunction does not turn on any material factual disputes. Further, no bond is required. See Corrigan Dispatch Co. v. Casa Guzman, S.A., 569 F.2d 300, 303 (5th Cir. 1978) (“The amount of security required is a matter for the discretion of the trial court; it may elect to require no security at all.”).

3.   See Dep't of Health & Hum. Servs., Marking the 50th Anniversary of Roe: Biden-Harris Administration Efforts to Protect Reproductive Health Care 3 (2023), https://www.hhs.gov/sites/default/files/roe-report.pdf [https://perma.cc/NMH4-656E]; HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care, Dep't of Health & Hum. Servs. (June 29, 2022), https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/phi-reproductive-health/index.html [https://perma.cc/UT87-BWNU]. Whether a sword (Plaintiffs) or shield (Defendants), the controversial 2024 Rule departs from the bipartisan origins of HIPAA: the statute was a political compromise between Democrats and Republicans following the contentious “Hillarycare” debates of 1993 and 1994. See Megan Bradshaw & Benjamin K. Hoover, Not So Hip?: The Expanded Burdens on and Consequences to Law Firms as Business Associates Under Hitech Modifications to HIPAA, 13 Rich. J.L. & Pub. Int. 313, 315-17 (2010) (“Largely due to the intense political controversy surrounding the Clinton health care plan, Congress enacted HIPAA piecemeal through amendments ․” (footnotes omitted)).

4.   The federal Child Abuse Prevention and Treatment Act (“CAPTA”) requires mandatory “child abuse” reporting statutes for all aid-recipient states. See 42 U.S.C. § 5106a(b)(2)(B)(i). Other federal statutes impose “child welfare” reporting requirements, which (could) run afoul of the 2024 Rule's tautological “reproductive health care” definition or its “public health” surveillance, investigation, and intervention definitions, which are an omission wrapped in an exception inside the Privacy Rule. See 42 U.S.C. §§ 670–79c; 42 U.S.C. §§ 701–13; ECF No. 24 at 6 (citing 45 C.F.R. § 164.512(f), 164.512(b)(1)(i); ECF No. 24 at 9–10 (citing 89 Fed. Reg. at 32987–89 n. 163).

MATTHEW J. KACSMARYK, UNITED STATES DISTRICT JUDGE