CARMEN PURL v. UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES (2025)

MEMORANDUM OPINION AND ORDER

Before the Court is Plaintiffs' Motion for Summary Judgment (“Motion”) (ECF No. 44), filed January 17, 2025. Defendants responded on March 3, 2025, and Plaintiffs replied on March 17, 2025. ECF Nos. 70, 91. The Motion is now ripe. Having considered the briefing, Motion, and relevant law, the Court GRANTS the Motion. The HIPAA Privacy Rule to Support Reproductive Health Care Privacy at 89 Fed. Reg. 32976 is VACATED except its modifications to 45 C.F.R. Section 164.520. But the provisions at 45 C.F.R. Section 164.520(b)(1)(ii)(F), (G), and (H) are VACATED. Defendants' Motion to Dismiss for Lack of Jurisdiction is DENIED as moot (ECF No. 39).

INTRODUCTION

Federal agencies cannot “exercise powers reserved to another branch of Government.” Loper Bright Enters, v. Raimondo, 603 U.S. 369, 416 (2024) (Thomas, J., concurring). Here, the Department of Health and Human Services (“HHS”) promulgated a regulation that exceeds the Article I statute it purports to enforce, the Health Insurance Portability and Accountability Act (“HIPAA”), while simultaneously violating the Federalism barriers erected in the Constitution and affirmed in the Supreme Court's most recent opinion on the subject matter. Dobbs v. Jackson Women's Health Org., 597 U.S. 215, 300 (2022) (“It follows that the States may regulate abortion for legitimate reasons, and when such regulations are challenged under the Constitution, courts cannot ‘substitute their social and economic beliefs for the judgment of legislative bodies.’ ”) (quoting Ferguson v. Skrupa, 372 U.S. 726, 729–30 (1963)).

The HHS errors are threefold. First, the HIPPA Privacy Rule to Support Reproductive Health Care Privacy (the “2024 Rule”) is “contrary to law” because it unlawfully “limits” state public health laws. 89 Fed. Reg. 32978. Second, the 2024 Rule impermissibly redefines “person” and “public health,” in contravention of Federal law and “in excess of statutory authority.” Third, under the “major-questions doctrine,” the 2024 Rule arrogates to HHS authority not expressly delegated by Congress.

BACKGROUND

I. Health Insurance Portability and Accountability Act

In 1996, Congress passed HIPAA. Pub. L. No. 104-191, 110 Stat. 1936 (1996). HIPAA improves the “portability and continuity of health insurance coverage” and simplifies “the administration of health insurance.” Id. 110 Stat. at 1936. And Congress designed it to advance “the efficiency and effectiveness of the health care system” through “the establishment of standards and requirements for the electronic transmission of certain health information.” Id. § 261, 110 Stat. at 2021. HIPAA-covered entities include “health plan[s],” “health care clearinghouse[s],” and “health care provider[s] who transmit[ ] any health information in electronic form” in connection with a HIPAA-covered transaction. Id. § 262, 110 Stat. at 2023.

Any such entity that knowingly “obtains” or “discloses individually identifiable health information to another person” is punishable under HIPAA if that disclosure violates HHS's enforcement regulations. Id. § 262, 110 Stat. at 2029. Congress defined protected “individually identifiable health information” as “any information” that (1) “is created or received by a health care provider, health plan, employer, or health care clearinghouse”; (2) “relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual”; and (3) “identifies” or provides a “reasonable basis to believe that the information can be used to identify the individual.” Id. § 262, 110 Stat. at 2023.

Congress instructed HHS to submit its “recommendations on standards with respect to the privacy of individually identifiable health information.” Id. § 264, 110 Stat. at 2033. These recommendations required addressing (1) the “rights that an individual who is a subject of individually identifiable health information should have”; (2) the “procedures that should be established for the exercise of such rights”; and (3) the “uses and disclosures of such information that should be authorized or required.” Id. If Congress did not act on HHS's recommendations within “36 months” after HIPAA's passage, then it granted HHS the authority to “promulgate final regulations containing such standards” that addressed the aforementioned three categories. Id.

Congress also dictated how HIPAA interacts with state laws protecting privacy and public health. First, HHS regulations cannot preempt a contrary state law with “more stringent” health-information protection requirements. Id. § 264, 110 Stat. at 2033–34. And second, Congress prescribed that nothing in HIPAA can be “construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, death, public health surveillance, or public health investigation or intervention.” Id. § 262, 110 Stat. at 2030 (emphasis added); 42 U.S.C. § 1320d-7(b). This provision is “a broad rule of construction that directs judges, regulators, and all others to make sure to protect laws that provide for the enumerated public health activities.” Barbara J. Evans, Institutional Competence to Balance Privacy and Competing Values: The Forgotten Third Prong of HIPAA Preemption Analysis, 46 U.C. DAVIS L. REV. 1175, 1200 (2013). It “very clearly attempts to protect laws that provide for the enumerated public health activities from ․ privacy laws.” Id. Congress wrote Section 1320d-7(b) so that “[n]othing” in HIPAA “shall get in the way of any law—state or federal—that serves various enumerated public health purposes.” Id. at 1201.

II. The Privacy Rule

Congress did not meet its thirty-six-month deadline. Thus, HHS promulgated the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) in 2000 to enact “standards to protect the privacy of individually identifiable health information.” Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82462 (Dec. 28, 2000) (codified at 45 C.F.R. pts. 160, 164). The Privacy Rule provides “enhanced protections for individually identifiable health information” to address public concerns about the use of technology in healthcare. Id. In general, the Privacy Rule bars protected health information (“PHI”) disclosure without an individual's authorization—unless disclosure is for a specified purpose. 45 C.F.R. § 164.502(a) (2023). Those purposes include treatment; payment; healthcare operations; a subpoena or other judicial or administrative proceeding; public health oversight, surveillance, or investigation; child abuse reporting; a serious and imminent threat to an individual's or the public's safety is present; or for a law enforcement reason. Id. §§ 164.506, 164.502, 164.512 (2023).

The Privacy Rule permits the disclosure of PHI to law enforcement “for a law enforcement purpose” when the disclosure meets the requirements of the reason for which law enforcement seeks it. See id. § 164.512(f)(1)–(6). Law enforcement reasons include disclosure as the law otherwise requires, an individual's identification or location, and emergency crime reporting. Id. § 164.512(f)(1), (2), (6). The Privacy Rule specifically protects reporting “child abuse” to those “authorized by law” to receive such reports. Id. § 164.512(b)(1)(ii).

III. The 2024 Rule

HHS amended the Privacy Rule in 2024 (the “2024 Rule”). HIPAA Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg. 32978. The 2024 Rule took effect on June 25, 2024, after HHS's consideration of approximately 25,900 comments. Id. at 32976, 32978–79, 32991. The 2024 Rule required HIPAA-regulated entities to comply by December 23, 2024, and amend their required Notices of Privacy Practices by February 16, 2026. Id.

The 2024 Rule expressly responded to Dobbs v. Jackson Women's Health Organization, which returned “the authority to regulate abortion ․ to the people and their elected representatives.” 597 U.S. 215, 292 (2022). According to HHS, Dobbs wrought “far-reaching implications” for reproductive health care (“RHC”) that “increase[d] the likelihood that an individual's PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect.” 89 Fed. Reg. at 32978. Specifically, HHS leadership worried Dobbs might prevent women from seeking abortion-related providers and invoked HIPAA as a shield against abortion-restrictive States.¹

HHS expressly linked its anti-Dobbs rationale to its statutory authority to promulgate HIPAA regulations. Id. (“Under its statutory authority to administer and enforce the HIPAA Rules, the Department may modify the HIPAA Rules as needed. The Supreme Court decision in [Dobbs] ․ altered the legal and health care landscape.”). Thus, HHS concluded Dobbs may “chill an individual's willingness” to seek an abortion or other RHC. Id. To prevent chilling abortions, HHS “determined that the Privacy Rule must be modified to limit the circumstances in which provisions of the Privacy Rule permit the use or disclosure of an individual's PHI” about RHC for “certain non-health care purposes.” Id.; see also id. at 32987.

To restrain Dobbs in that way, the 2024 Rule “amends provisions of the Privacy Rule to strengthen privacy protections for highly sensitive PHI” about an individual's RHC. Id. It defines “reproductive health care” as “health care ․ that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.” Id. at 33063. And it defines “person” as “a natural person (meaning a human being who is born alive)” along with nonnatural entities. Id. at 33062. Finally, it defines “[p]ublic health[ ] as used in the terms ‘public health surveillance,’ ‘public health investigation,’ and ‘public health intervention’ ” as “population-level activities to prevent disease in and promote the health of populations.” Id. But “public health” as used in those terms, HHS explained, could never mean efforts to “conduct․ investigation[s]” or “impose ․ liability” on individuals who only seek or obtain RHC. Id. at 33063-64.

The heart of the 2024 Rule prohibits the disclosure of information about RHC for three specific purposes:

(1) To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, or facilitating reproductive health care.

(2) To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.

(3) To identify any person [for these purposes].

Id. at 33063. Thus, the 2024 Rule restricts RHC information disclosure if “investigation” or “liability” attaches for the “mere act” of seeking, procuring, or facilitating RHC. Id. This definition of RHC means the 2024 Rule protects information about a wide range of procedures States regulate.

But it only restricts disclosure if state or federal law deems the RHC “lawful” when and how the recipient obtained it. The 2024 Rule states:

The prohibition ․ applies only where the relevant activity is in connection with any person seeking, obtaining, providing, or facilitating reproductive health care, and the [entity from which information is sought] has reasonably determined that one or more of the following conditions exists:

(1) The reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided.

(2) The reproductive health care is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided.

(3) [The entity presumes the health care lawful unless it knows or is shown otherwise.]

Id. Therefore, a covered entity must examine relevant state law to determine whether the provided RHC was lawful “under the circumstances in which it [was] provided.” Id. But it also must examine its lawfulness under relevant Federal and constitutional law. If these legal inquiries result in any uncertainty, the covered entity must “presume[ ]” the care was lawful unless “[a]ctual knowledge” or a “substantial factual basis” indicates it was not. Id. The presumption operates to “facilitate the determination by the regulated entity” whether the care was lawful and thereby “reduce the risk of an impermissible use or disclosure.” Id. at 33034. It “lower[s] the burden” for covered entities because it permits them to default against disclosure. Id. at 33054.

Further, those seeking disclosure must often provide an “attestation” containing a “description of the information requested,” and a “clear statement that the use or disclosure is not for a purpose” the 2024 Rule prohibits. Id. at 33064. The covered entity must refuse disclosure if it has “actual knowledge” the attestation is false or even if a “reasonable covered entity․ in the same position would not believe that the attestation” is for permissible purposes. Id. at 33064. Thus, the 2024 Rule requires covered entities to scrutinize a state or federal agency's attestation to determine whether it is reasonable to believe the information therein.

* * *

In sum, HHS harnessed HIPAA to constrain Dobbs. Id. at 32978 (“[Dobbs] has far-reaching implications for reproductive health care ․ [Thus,] the Privacy Rule must be modified․”). The 2024 Rule bars disclosure of RHC information—as HHS defines it—if the health care was “legal” and if the PHI's disclosure would trigger an “investigat[ion]” or impose “liability” for those who only seek, procure, or facilitate the health care.

IV. Dr. Purl's Practice

Dr. Carmen Purl owns Dr. Purl's Fast Care Walk In Clinic (the “Clinic”). The Clinic employs three nurse practitioners and about fifteen others who provide common medical services. ECF Nos. 45 at 13; 46 at 3. The Clinic often treats children, young women, and pregnant women. ECF No. 45 at 13. When caring for a female patient, the Clinic typically collects information about that woman, including her last menstrual period, menarche age, pregnancy number, and live-birth number. Id. Dr. Purl treats every unborn child as a patient. Id. The Clinic has treated “hundreds” of girls under the consent age who were pregnant or reported sexual activity. Id. at 14; ECF No. 46 at 5. The Clinic also treated “hundreds” of child-abuse victims. ECF No. 45 at 15. Texas Child Protective Services (“CPS”) sends the Clinic requests for PHI approximately ten to twelve times per year when it investigates suspected child abuse. ECF No. 46 at 6. Those requests demand the entire, unredacted medical record for each suspected victim. Id.

V. Procedural History

Dr. Purl and the Clinic (collectively, “Plaintiffs”) sued to declare the 2024 Rule “arbitrary and capricious” and “in excess of statutory authority,” in violation of the Administrative Procedure Act (“APA”). ECF No. 1 at 18–20. Plaintiffs are “covered” entities subject to HIPAA. ECF No. 45 at 14-16. Dr. Purl argues the 2024 Rule will impair her and her employees' state-mandated obligation to report “child abuse” or participate in public health investigations. ECF No. 45 at 28–29; TEX. FAM. CODE ANN. § 261.101(a) (West 2021). Plaintiffs sought a preliminary injunction to continue their longstanding cooperation with mandatory reporting requirements and CPS requests, though cooperation may disclose information the 2024 Rule requires be kept private. ECF No. 24. The Court granted a preliminary injunction to Plaintiffs on December 22, 2024. ECF No. 34. And it required an expedited summary judgment schedule after the preliminary injunction. ECF No. 35. Plaintiffs and Defendants each filed motions for summary judgment on January 17, 2025. ECF Nos. 39, 44.

LEGAL STANDARD

Summary judgment is appropriate if the movant shows no genuine dispute of material fact exists, and the movant is entitled to judgment as a matter of law. FED. R. ClV. P. 56(a). The moving party bears the initial burden to demonstrate both. See Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986). A genuine dispute of material fact exists if “the evidence is such that a reasonable jury could return a verdict for the non-moving party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986).

Summary judgment “is particularly appropriate in cases in which the court is asked to review or enforce a decision of a federal administrative agency.” Girling Health Care, Inc. v. Shalala, 85 F.3d 211, 214–15 (5th Cir. 1996). “Under the APA, it is the role of the agency to resolve factual issues to arrive at a decision that is supported by the administrative record.” Hi-Tech Pharmacal Co., Inc. v. FDA, 587 F. Supp. 2d 13, 18 (D.D.C. 2008). And the court's role in an APA case is to “sit[ ] as an appellate tribunal.” Am. Bioscience, Inc. v. Thompson, 269 F.3d 1077, 1083 (D.C. Cir. 2001); see also Amin v. Mayorkas, 24 F.4th 383, 391 (5th Cir. 2022). In such a posture, the “entire case on review is a question of law, and only a question of law.” Marshall Cnty. Health Care Auth. v. Shalala, 988 F.2d 1221, 1226 (D.C. Cir. 1993). So summary judgment in an APA case “merely serves as the mechanism for deciding, as a matter of law, whether the agency action is supported by the administrative record and otherwise consistent with the APA standard of review.” Oceana, Inc. v. Locke, 831 F. Supp. 2d 95, 106 (D.D.C. 2011). Judicial review under the APA is limited to the administrative record. 5 U.S.C. § 706.

ANALYSIS

Under the APA, courts must “hold unlawful and set aside” agency action “not in accordance with law” and “in excess of statutory jurisdiction.” 5 U.S.C. § 706(2)(A), (C). When doing so, the “court shall decide all relevant questions of law” and “interpret․ statutory provisions.” Id. § 706.

After Loper Bright Enterprises v. Raimondo, the “text of the APA means what it says.” 144 S. Ct. 2244, 2262 (2024). Courts interpret the statute and evaluate agency action by “applying their own judgment” to “decide legal questions.” Id. at 2261. Agencies possess “only the authority that Congress has provided” because they are “creatures of statute.” Nat'l Fed'n of Indep. Bus. v. Dep't of Lab., 595 U.S. 109, 117 (2022). The central question is “always, simply, whether the agency has stayed within the bounds of its statutory authority.” City of Arlington v. FCC, 569 U.S. 290, 297 (2013) (emphasis omitted). Courts thus “effectuate the will of Congress,” “recogniz[e] constitutional delegations,” and “ ‘fix[ ] the boundaries of [the] delegated authority.” ’ Loper Bright, 144 S. Ct. at 2263 (third alteration in original) (quoting H. Monaghan, Marbury and the Administrative State, 83 COLUM. L. REV. 1, 27 (1983)).

Defendants waived their merits arguments in their response to Plaintiffs' Motion. See ECF No. 70 at 6 (“HHS's new leadership is currently reviewing the Rule, so Defendants do not further address the merits here.”). “Generally, the failure to respond to arguments constitutes abandonment or waiver of the issue.” Kellam v. Services, No. 3:12-CV-352, 2013 WL 12093753, at *3 (N.D. Tex. May 31, 2013) (quoting Abraham v. Greater Birmingham Humane Soc. Inc., No. 2:11-CV-4358, 2013 WL 1346534, at *4 (N.D. Ala. Mar. 28, 2013)); see also In re Dall. Roadster, Limited, 846 F.3d 112, 126 (5th Cir. 2017); In re Online DVD Rental Antitrust Litig., M 09-2029, 2011 WL 5883772, at *12 (N.D. Cal. Nov. 23, 2011) (failure to respond to argument on the merits typically is “viewed as grounds for waiver or concession of the argument”).

Instead, Defendants only challenge standing and the scope of potential relief. ECF No. 70 at 6. Defendants did move for summary judgment and argued the merits. See ECF No. 40. But in their reply brief to their own motion, Defendants again only challenge standing and scope of potential relief. ECF No. 93 at 5–12. They do not address the merits arguments Plaintiffs made in the response to Defendants' motion. Thus, nowhere do Defendants address the merits of Plaintiffs' arguments. But they do present merits arguments in their motion for summary judgment. Though Defendants have abandoned their merits arguments, the Court will nevertheless consider the arguments presented in their motion for summary judgment.

I. Standing

“Article III of the Constitution limits federal courts' jurisdiction” to cases and controversies. Clapper v. Amnesty Int'l, 568 U.S. 398, 408 (2013). Standing helps ensure a true Case or Controversy exists. See Daimler Chrysler Corp. v. Cuno, 547 U.S. 332, 342 (2006). It is thus a “bedrock constitutional requirement.” United States v. Texas, 599 U.S. 670, 675 (2023). To satisfy this threshold requirement, a Plaintiff bears the burden to show “(i) that she has suffered or likely will suffer an injury in fact, (ii) that the injury likely was caused or will be caused by the defendant, and (iii) that the injury likely would be redressed by the requested judicial relief.” FDA v. All. for Hippocratic Med., 144 S. Ct. 1540, 1555 (2024) (citing Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009); Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992)).

Defendants argue Plaintiffs lack standing because their claims rest “on unrealistic and unsubstantiated theories of harm.” ECF No. 70 at 7. Defendants claim Plaintiffs' “principal theory of standing” is that the 2024 Rule restricts their ability to comply with state child-abuse reporting laws. Id. But they claim that theory is “imaginary.” Id. In their view, the 2024 Rule does not “restrict[ ] her ability to report suspected child abuse” and that “it is [not] likely to do so in the future.” Id. at 8. Thus, they argue, Plaintiffs' “fight with the Rule is ․ an abstract one—hardly the basis for Article III standing.” Id. And Defendants claim Plaintiffs' alleged compliance costs are similarly insufficient. Id. They maintain that Plaintiffs have not specifically enumerated or shown conclusive compliance costs incurable under the 2024 Rule. Id. at 8–9.

Plaintiffs respond a “fundamental doctrine of APA standing” holds that “objects of a regulation have standing to sue.” ECF No. 91 at 8. Whether the regulation truly bars the activity a plaintiff claims is the “incorrect” analysis. Id. at 9. Instead, Plaintiffs assert, standing is “ ‘self-evident’ for the object of a regulation.” Id. at 10 (quoting Sierra Club v. EPA, 292 F.3d 895, 900 (D.C. Cir. 2002)). And further, even if Defendants correctly state the standing standards, Plaintiffs' compliance costs “independently prove standing.” Id. at 12. Though Plaintiffs have not conclusively established the precise compliance costs, they have “amply testified” they exist to some degree. Id. And “pecuniary harm is a quintessential injury in fact.” Id.

A. Object of the Regulation Standing

If plaintiffs are “subject to regulations that are contrary to law,” then that is “a concrete injury sufficient to give them standing.” Tex. Med. Ass'n v. U.S. Dep't of Health & Hum. Servs., 110 F.4th 762, 773 (5th Cir. 2024). When “a plaintiff is an object of a regulation ‘there is ordinarily little question that the action or inaction has caused them injury, and that a judgment preventing or requiring the action will redress it.’ ” Contender Farms, L.L.P. v. U.S. Dep't of Agric., 779 F.3d 258, 264 (5th Cir. 2015) (quoting Lujan, 504 U.S. at 561–62). Thus, standing's three elements are satisfied.

The Supreme Court recently held that objects of regulation typically have standing to sue. All. for Hippocratic Med., 144 S. Ct. at 1556 (“Government regulations that require or forbid some action by the plaintiff almost invariably satisfy both the injury in fact and causation requirements. So in those cases, standing is usually easy to establish.”). The Fifth Circuit held the same just thirty days ago. Nat'l Religious Broadcasters v. FCC, 138 F.4th 282, 290 (5th Cir. 2025) (because the plaintiff was “ ‘an object of the [FCC's] action,’ ․ the standing requirements are met” (alteration in original) (quoting Lujan, 504 U.S. at 561)). Of course, so-called third-party standing can be more problematic and “substantially more difficult to establish.” All. for Hippocratic Med., 144 S. Ct. at 1556 (quoting Lujan, 504 U.S. at 562); see also All. for Hippocratic Med. v. FDA, 117 F.4th 336, 340 (5th Cir. 2024) (Ho, J., concurring) (noting that a consistent injury analysis should apply to all plaintiffs in third-party standing scenarios).

Object-of-the-regulation standing does not require a perfect match between the regulation's mandates and Plaintiffs proven day-to-day behavior. Instead, being the mere object of a regulation typically grants standing because the regulation “require[s] or forbid[s] some action by the plaintiff.” Id. (emphasis added). Plaintiffs are free to seek relief from regulations that require or demand action from them.

The regulation must only present an “increased regulatory burden” of some sort. Contender Farms, 779 F.3d at 266. This is a “common sense” inquiry. Id. at 265. In Contender Farms, the Fifth Circuit held object-of-the-regulation standing satisfied where regulation-imposed requirements meant plaintiffs “may ․ face prosecution” and needed to “take additional measures” to prevent possible prosecution. Id. at 266. And in Texas v. EEOC, the Fifth Circuit held object-of-the-regulation standing was easily met where Texas challenged EEOC guidance because “the Guidance covers Texas.” 933 F.3d 433, 446 (5th Cir. 2019). The guidance imposed an increased regulatory burden because “Texas face[d] the possibility of investigation” unless it “align[ed] its laws and policies with the Guidance.” Id. at 447.

Defendants' argument that the 2024 Rule does not prevent child-abuse reporting, as Plaintiffs claim, do little to discount standing here. See ECF No. 40 at 20 (“Dr. Purl's theory of harm continues to rest heavily on a fundamental misunderstanding that the 2024 Rule interferes with the reporting of suspected child abuse to state authorities.”). For object-of-the-regulation standing, it does not matter whether the 2024 Rule does or does not conclusively preclude child-abuse reporting. To examine that issue would conflate the standing and merits inquiries. See, e.g., Fed. Election Comm'n v. Cruz, 596 U.S. 298, 298 (2022) (“For standing purposes, we accept as valid the merits of [plaintiffs'] legal claims ․”); OCA-Greater Hous. v. Texas, 867 F.3d 604, 613 (5th Cir. 2017) (holding an “argument conflates the merits of the suit with the plaintiff's standing to bring it․ [Defendant] cannot defeat standing by arguing that the [regulation] is ․ valid”). All that matters is whether the 2024 Rule regulates Plaintiffs to forbid or require “some action” and whether vacating the 2024 Rule would remedy Plaintiffs' burden. All. for Hippocratic Med., 144 S. Ct. at 1556. Plaintiffs argue the 2024 Rule is contrary to law because it limits child-abuse reporting. Defendants would deny standing because Plaintiffs are wrong on the merits. Duarte ex rel. Duarte v. City of Lewisville, 759 F.3d 514, 520 (5th Cir. 2014) (reversing because the district court “conflated the actual-injury inquiry for standing purposes with the underlying merits of the ․ claims” (emphasis added)).

But the Court will adhere to the true inquiry: whether Plaintiffs are objects of the 2024 Rule that, if vacated, will no longer present a regulatory burden. See, e.g., Nat'l Horsemen's Benevolent & Protective Ass'n v. Black, 107 F.4th 415 (5th Cir. 2024) (injury requirement satisfied because plaintiffs “had to agree to be subject to and comply with [Authority's] rules, standards, and procedures” (alteration in original) (internal quotation omitted)); Tex. Med. Ass'n v. HHS, 110 F.4th 762, 773 (5th Cir. 2024) (“[T]he fact that the Plaintiffs are now subject to regulations that are contrary to law is itself a concrete injury sufficient to give them standing.”).

Plaintiff's are objects of the 2024 Rule. It requires and forbids action by Plaintiffs. The 2024 Rule prevents a “covered entity” from disclosure of RHC information for prohibited purposes. 89 Fed. Reg. at 33063. Dr. Purl's Clinic is a covered entity. To ensure compliance with the 2024 Rule, Plaintiffs must conduct additional training, update policies, and amend their notice of privacy practices. ECF No. 66 at 16; 89 Fed. Reg. at 33049 (“In general, each regulated entity․ is required to adopt new policies and procedures for responding to requests for the use or disclosure of protected health information ․ for which an attestation is required and to train its workforce members on the new requirements.”); Nat'l Religious Broadcasters, 2025 WL 1428620, at *4.

And, if Plaintiffs received a request for PHI from a government entity, they must comply with the 2024 Rule by (1) ensuring the request is not for a prohibited purpose and (2) demanding a valid attestation from the requestor. ECF No. 66 at 8. Finally, Plaintiffs are the objects of the 2024 Rule simply because it forbids them from disclosing RHC information contrary to the 2024 Rule's terms. If Plaintiffs can conduct their business in the exact same manner after the 2024 Rule as before the 2024 Rule, then the 2024 Rule does not regulate them. But they cannot. A court order vacating the 2024 Rule would relieve the regulatory burdens the 2024 Rule imposes. See Nat'l Religious Broadcasters, 2025 WL 1428620, at *4 (“Causation and redressability ‘flow naturally’ from this injury because [Plaintiffs] will not face [their] injury if we vacate the [regulation], as P[laintiffs] request.” (quoting Contender Farms, 779 F.3d at 266–67). For these reasons, ‘ “common sense’ dictates that the Plaintiffs have standing to challenge” the 2024 Rule. Tex. Med. Ass'n, 110 F.4th at 773 (quoting Contender Farms, 779 F.3d at 265).

B. Compliance Costs

Additionally, Plaintiffs have standing because they must incur an “increased regulatory burden” via compliance costs. Texas v. EEOC, 933 F.3d at 446. “For standing purposes, a loss of even a small amount of money is ordinarily an ‘injury.’ ” Czyzewski v. Jevic Holding Corp., 580 U.S. 451, 464 (2017). Here, Plaintiffs properly allege they will expend funds to comply with the 2024 Rule. ECF No. 66 at 18. These funds include (1) acquiring online training for the Clinic's employees on 2024 Rule compliance, (2) pulling employees from the Clinic's work to undergo training, and (3) Dr. Purl's own time evaluating the 2024 Rule and updating the Clinic's notice of privacy practices. ECF No. 46 at 7–8. Plaintiffs include estimated dollar amounts for said compliance. Id. (estimating online training to be $100 to $300 per person, closing the Clinic for one hour of training to be $1,385, and Dr. Purl's time expense to be about $360 to $480 per hour).

Defendants claim this is all too speculative. ECF No. 70 at 8–9. They frame Plaintiffs' estimates as “conclusory” and that they do not explain what the “estimates are based upon.” Id. at 8. Instead, Defendants assert, Plaintiffs must explain “what training costs․ are necessary and directly attributable to the Rule” to satisfy the injury requirement. Id. In short, Defendants worry Plaintiffs “ha[ve] not provided any evidence, aside from conclusory assertions and references to the generalized estimates in the 2024 Rule, to corroborate [their] claims about the costs, in time or money, that any training or procedural updates will consume.” ECF No. 40 at 23. Rather, Defendants frame Plaintiffs' compliance costs as a “self-inflicted injury.” Id. at 24.

But Defendants' specificity arguments do not negate Plaintiffs' injury, nor do Plaintiffs merely “spend [their] way into standing.” Id. (quoting All. for Hippocratic Med., 602 U.S. at 394).

i. Plaintiffs' injuries are not self-inflicted.

First, Plaintiffs are not spending themselves into standing. To be sure, a plaintiff cannot lavish money on a litigation project separate from its actual business and call it “standing.” See Deep S. Ctr. for Env't Just. v. EPA, 138 F.4th 310, 318 (5th Cir. 2025). That is not an injury. All. for Hippocratic Med., 602 U.S. at 394 (a plaintiff cannot “spend its way into standing simply by expending money to gather information and advocate against the defendant's action”).

But Plaintiffs are not doing that. Their costs stem from compliance with the 2024 Rule—not from spending money to advocate against it. Instead, it is a quintessential “increased regulatory burden.” Career Colleges & Schs. of Tex. v. U.S. Dep't of Educ., 98 F.4th 220, 234 (5th Cir. 2024). Costs to comply with presumably unlawful regulations—if they would truly stem from good faith efforts to comply best with a regulation—are pecuniary injuries. See id. In Career Colleges, the Fifth Circuit identified “preparatory analysis, staff training, and reviews of existing compliance protocols” to be “precisely the types of concrete injuries that this court has consistently deemed adequate to provide standing in regulatory challenges.” 98 F.4th at 234. And Texas v. EEOC affirmed that a “regulatory burden ․ to comply with [an agency action] to avoid enforcement actions” is an injury. 933 F.3d 433, 447 (5th Cir. 2019). Like the Fifth Circuit, this Court “assume[s] for purposes of the standing analysis” Plaintiffs are “correct on the merits of [their] claim that the [2024 Rule] was promulgated in violation of the APA.” Id.

Plaintiffs' alleged compliance costs are “precisely the types of concrete injuries” that satisfy standing. They do not stem from “advocacy.” Deep S., 2025 WL 1452098, at *4–6. Rather, they are good-faith attempts to avoid violation of the 2024 Rule by ensuring Clinic employees are properly trained to abide its strictures. The 2024 Rule itself contemplates such compliance costs may incur. First, HHS specifically stated that “covered entities will need to develop new or modified policies and procedures for the new requirements.” 89 Fed. Reg. 33056. Second, HHS recognized there will be “costs associated” with additional employee training, whether integrated into existing HIPAA training or not. Id. Plaintiffs allege the same. ECF No. 40 at 7–8. Thus, Plaintiffs are not spending themselves into standing. They are spending what the 2024 Rule expressly contemplates. And they only do so because the 2024 Rule imposes an “increased regulatory burden.”

ii. Plaintiffs have shown sufficient specificity.

Nor must Plaintiffs show more specificity. For standing purposes, “a loss of even a small amount of money is ordinarily an ‘injury.’ ” Czyzewski, 580 U.S. at 464. Defendants lament that Plaintiffs provided inadequate accounting of the costs “directly attributable to the Rule.” ECF No. 70 at 8.

But Plaintiffs need not meet a certain cost threshold, nor do they need to testify exactly what they base their estimates on. Plaintiffs need to show only that they will suffer some cost, time or money suffice, arising from 2024 Rule compliance—even if it is a small cost. Czyzewski, 580 U.S. at 464. Defendants argue Plaintiffs suffer no injury if “easy and costless” measures are available. ECF No. 40 at 24. But that only repeats the error they made at the preliminary injunction stage. ECF No. 34 at 10 (“Defendants think Dr. Purl should (somehow) comply more cheaply․ But nothing requires Plaintiffs to explain in excruciating detail exactly how their compliance costs will materialize.”). HHS itself recognizes some policy updates and staff training will be “need[ed].” 89 Fed. Reg. at 33056. Defendants argue Plaintiffs should ignore that. ECF No. 40 at 24. But they cannot.

At bottom, Plaintiffs have sufficiently testified that some training and preparatory review will be required. ECF No. 46 at 7–8. Whether Plaintiffs' estimates are too broad matters not. See Young Conservatives of Tex. Found. v. Smatresk, 73 F.4th 304, 310 (5th Cir. 2023) (“Plaintiffs spent money that, absent defendants' actions, they would not have spent․ This is a quintessential injury-in-fact․ Standing is defeated only if it is concluded that the injury is so completely due to the plaintiff's own fault as to break the causal chain.” (first omission in original) (internal quotations omitted)). Here, Plaintiffs provided affidavit evidence of the same sort of preparation and training deemed adequate in Career Colleges. 98 F.4th at 234 (plaintiffs provided “through evidence in the record that․ the new Rule requires at least some degree of preparatory analysis, staff training, and reviews of existing compliance protocols” (internal quotation omitted)). Defendants may bicker about the degree of these costs. But HHS expressly states such costs are necessary. 89 Fed. Reg. at 33056. This Court need not contradict HHS's own prescriptions and cannot contradict what the Fifth Circuit considers an injury.

* * *

Because Plaintiffs are the object of the 2024 Rule, standing is “easy to establish” here. All, for Hippocratic Med., 602 U.S. at 382. Plaintiffs incur an “increased regulatory burden” not only through the 2024 Rule's restrictions but also through expending costs to ensure compliance with the 2024 Rule. Contender Farms, 779 F.3d at 266. Defendants caused these injuries. Vacating the 2024 Rule would redress them.

II. Contrary to Law

Plaintiffs argue the 2024 Rule is contrary to law in three different ways. First, the 2024 Rule “unlawfully limits disclosures about abuse and public health to state authorities.” ECF No. 45 at 29. Second, the 2024 Rule redefines “person” and “public health” contrary to statute. Id. at 35. And third, the 2024 Rule exceeds statutory authority because it employs HIPAA to impose “special rules for abortion” and RHC. Id. at 40. Defendants decline to respond substantively to Plaintiffs' arguments. See ECF No. 70; supra pp. 11–12. But they do address the core arguments in their own motion for summary judgment. See ECF No. 40. For the following reasons, Plaintiffs' arguments prevail.

A. The 2024 Rule Is Not in Accordance with 42 U.S.C. § 1320d-7(b).

The APA requires courts to “set aside” agency actions “not in accordance with law.” 5 U.S.C. § 706(2), (2)(A). The 2024 Rule is not in accordance with 42 U.S.C. Section 1320d-7(b) because it impedes, restrains, or curtails potential child abuse reporting.

42 U.S.C. Section 1320d-7(b) stipulates “[n]othing in [HIPAA] shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention.” 42 U.S.C. § 1320d-7(b) (emphasis added).

Plaintiffs argue the 2024 Rule does exactly that. They contend Dr. Purl and the Clinic employees have “a duty to report suspected child abuse” to Texas. ECF No. 45 at 29 (citing TEX. FAM. CODE ANN. § 261.101(a) (West 2021) (“A person having reasonable cause to believe that a child's physical or mental health or welfare has been adversely affected by abuse or neglect by any person shall immediately make a report․”)). But, in Plaintiffs' view, the 2024 Rule bars them from doing so because it imposes layers of “incomprehensible standards” that function as ‘ “limits’ on reporting.” Id. at 30.

Defendants do not respond to Plaintiffs' arguments. But in their own motion for summary judgment, they argue the 2024 Rule “does not limit the ability to report child abuse.” ECF No. 40 at 25. They note the 2000 Privacy Rule permits child abuse reports, and the 2024 Rule amends that in no way. Id. They aver that the Court's order granting a preliminary injunction was “premised on several errors.” Id. at 26. First, they distinguish “reporting” from “requests for information.” They claim “reporting” in 42 U.S.C. Section 1320d-7(b) only contemplates affirmative child abuse reports instead of information a doctor provides in response to a child abuse investigation. This matters because the Court's prior analysis applied whenever a covered entity responds to requests for information. Id.

Second, Defendants surprisingly claim the 2024 Rule only applies when a covered entity responds to a request for information rather than affirmatively discloses protected information. Id. (“The 2024 Rule's disclosure prohibition applies to disclosures in response to requests, submitted either as part of an investigation or with the aim of imposing liability.”). So “neither Dr. Purl nor any other doctor is required to ‘navigate [the 2024 Rule's] requirements’ before affirmatively reporting suspected child abuse.” Id. at 27 (quoting ECF No. 34 at 18). Defendants facially misread the statute and contradict their own regulation.

i. Section 1320d-7(b) prohibits limitations on disclosures in response to a state's requests for information relating to the specified public health laws.

First, the statute. Under Section 1320d-7(b), neither HIPAA nor its regulations may be construed to “invalidate or limit the authority, power, or procedures established under any law providing for the reporting of” several categories. 42 U.S.C. § 1320d-7(b). One of those is the “reporting of․ child abuse.” Id. Defendants construe “reporting” to only contemplate “affirmative ‘reporting.’ ” ECF No. 40 at 26. By their read, “reporting” cannot occur “in response to a state's requests for information, even if those requests relate to suspected child abuse.” Id. (emphasis omitted). Instead, a report can only occur if prompted by nothing but the individual's own initiative—not in response to a request for information. But they offer nothing to argue “reporting” should be read so narrowly—especially when Section 1320d-7(b) so broadly protects the “authority, power, or procedures established” under such a law. 42 U.S.C. § 1320d-7(b).

The Court need not adopt Defendants' blinkered interpretation. “Reporting” is an undefined term. So the Court turns to its ordinary meaning. See MCI Telecomms. Corp. v. Am. Telephone & Telegraph Co., 512 U.S. 218 (1994) (Scalia, J.). Reporting means “to give a formal or official account or statement of,” “to make known to the proper authorities,” or “to make a charge of misconduct against.” Report, MERRIAM-WEBSTER, https://www.merriam-webster.com/dictionary/reporting [https://perma.cc/N6J9-XBBR]. Nothing in these definitions constrains “reporting” to Defendants' view that one cannot report information in response to a request for information. Instead, “giv[ing] a formal․ account,” or “mak[ing] known to the proper authorities,” can uncontrovertibly bear that meaning. After all, giving an official statement or making information known to authorities can easily be done in response to a request for information. And the statute itself provides no other indication to support Defendants' myopic reading.

In fact, it provides just the opposite. Two textual indicators confirm.

First, HIPAA and its regulations cannot be construed to “invalidate or limit” the “authority, power, or procedures” of the whole state law—not just the subsections specific to “reporting.” 42 U.S.C. § 1320d-7(b). The statute does not textually demand a line-by-line examination of such a law to determine whether each phrase deals with “reporting” one of the enumerated activities. Instead, all that law's “authority, power, or procedures” must stand regardless of HIPAA and its regulations.

Second, Section 1320d-7(b) requires “[n]othing” shall even be “construed” to invalidate or limit the protected authorities, powers, or procedures. That is not narrow or nebulous. Instead, the public health provision at [Section] 1320d-7(b)․ is a muscular provision” that sets forth “a broad rule of construction that directs judges, regulators, and all others to make sure to protect laws that provide for the enumerated public health activities” from “privacy laws.” Evans, supra, at 1206, 1200. “Congress spoke very directly: the rule of construction binds courts as well as the agency, and courts can be expected to understand it and follow it.” Id. at 1208. It is “unambiguous in its basic directive,” which is to implement the “broad rule of construction” to protect the enumerated laws. Id. at 1200, 1201. Congress was not unclear, and the Court will not adopt Defendants' narrow misreading and thereby constrain Section 1320d-7(b) to mean much less than Congress wrote.

ii. The 2024 Rule applies both when a covered entity responds to a request for information and when it affirmatively discloses PHI.

Next, the 2024 Rule. Defendants argue the 2024 Rule's disclosure prohibition applies only to “disclosures in response to requests”—but not when a covered entity makes an “affirmative report” disclosing protected information. ECF No. 40 at 26 (emphasis omitted). That means, in their mind, the 2024 Rule would never require a covered entity to make “any determination of whether [ ] care was lawful before submitting a report” of child abuse. Id. But the 2024 Rule's text and explanations contradict this reading. The 2024 Rule's text states a covered entity may not “use or disclose” PHI for any of the forbidden purposes. 89 Fed. Reg. 33063. That is the prohibition. No reference to “only in response to requests.” ECF No. 66 at 22–23 (“Defendants would read in a limitation—may not use or disclose PHI ‘in response to requests’—not mentioned in the [regulatory] language.”). Defendants rely on a phrase later in the 2024 Rule that states the use-or-disclosure prohibition applies when “the covered entity or business associate that received the request for protected health information has reasonably determined” the RHC was lawful. 89 Fed. Reg. at 33063 (emphasis added). Thus, according to Defendants, covered entities may not use or disclose only if someone requests information. ECF No. 40 at 26. Not so. The descriptor “that received the request for protected health information” is a postpositive modifier for “business associate.” It does not extend backward to “covered entity.” But see ANTONIN SCALIA & BRYAN A. GARNER, READING LAW 148–49 (2012) (explaining the insertion of a determiner typically “cut[s] off” a postpositive modifier's backward effect). Thus, the use-and-disclosure prohibition applies when “the covered entity․ has reasonably determined that” the RHC was lawful. And the use-and-disclosure prohibition applies when a “business associate that received the request for protected health information has reasonably determined” the RHC was lawful. 89 Fed. Reg. 33063.

The 2024 Rule's explanations reveal this is precisely the meaning HHS envisioned. The 2024 Rule states it “does not permit a regulated entity to disclose PHI as part of a report of suspected child abuse based solely on the fact that a parent seeks reproductive health care ․ for a child.” 89 Fed. Reg. at 33004. But if the Court adopts Defendants' reading—that the use-and-disclosure prohibition applies only in response to requests for information—then “a report of suspected child abuse based solely on the fact that a parent seeks reproductive health care ․ for a child” would be permitted. Id. But here the explanation states it is not. The only provision that could prohibit such a report is the use-and-disclosure prohibition. So it must not mean what Defendants say it means. Thus, the postpositive modifier “that received the request for protected health information” must not apply to “covered entity.” That reading alone harmonizes the 2024 Rule's text and HHS's explanation for what that text means. Defendants recognize this problem and argue that neither “federal law nor Texas law defines ‘child abuse’ to include activities related to reproductive health care.” ECF No. 40 at 27. But they do not address how this proffered explanation harmonizes with the use-and-disclosure provision. Elsewhere, HHS seems to take a different view. See 89 Fed. Reg. at 33012 (referencing “the regulated entity that receives the request for PHI”). At best, the 2024 Rule's explanations are ambiguous. But Defendants cannot now exploit a postpositive modifier to contradict HHS's own explanations of the 2024 Rule. Perhaps the 2024 Rule only prohibits disclosures in response to requests, as Defendants claim. But to base that conclusion on one textual ambiguity which does not appear in the 2024 Rule's “[p]rohibition” section is small footing.

iii. The 2024 Rule limits state laws on child-abuse reporting and public-health investigations.

The 2024 Rule imposes at least four limits that violate 42 U.S.C. Section 1320d-7(b). First, the 2024 Rule prohibits any child-abuse report based solely on lawful RCH—and flatly bars States from considering RHC alone as abuse or part of a state's public health reporting regime. Second, covered entities must scrub PHI for capaciously-defined RCH information any time they receive a disclosure request—or otherwise seek to use or disclose PHI. Third, if the relevant PHI contains RHC information, a covered entity must delve into legal intricacies to determine whether it was lawful when provided, or it must presume it to have been lawful. And fourth, a covered entity must comply with an attestation requirement whenever it receives a disclosure request for RHC PHI.

Defendants argue none of these limits completely bar PHI disclosure. But, as explained in the Court's preliminary injunction, a limit may still exist even if it does not completely bar PHI disclosure. Limits are not the same as prohibitions. Defendants' more particular objections are addressed below. The Court first reiterates the ordinary meaning of “limit” in Section 1320d-7(b) and explains how Section 1320d-7(b) prohibits each of the 2024 Rule's limits summarized above.

An undefined statutory term must be read consistent with its ordinary, common meaning. MCI Telecomms. Corp., 512 U.S. 218 (1994). HIPAA does not define “limit.” Thus, the Court must construe the term as it is ordinarily understood. Black's Law Dictionary defines “limit” as a “restriction or restraint.” Limit, BLACK'S LAW DICTIONARY (12th ed. 2024). Similarly, Merriam Webster defines “limit” as meaning “to curtail or reduce in․ extent.” Limit, MERRIAM-WEBSTER'S COLLEGIATE DICTIONARY (11th ed. 2014). The Oxford English Dictionary concurs and defines it to mean “to bound, restrict.” Limit, OXFORD ENGLISH DICTIONARY (3d ed. rev. 2024). All three dictionaries agree something is limited when one raises restrictions, restraints, or curtailments against it. None of these definitions defines “limit” to always require a complete bar. There are other words for that—“prohibit” or its synonyms. Instead, regulations that curtail or restrain the activity, even if the activity remains ultimately possible, limit the activity by raising obstructions and impediments. The 2024 Rule does just that.

1. The 2024 Rule limits state public health laws in Section 1320d-7(b) by prohibiting child abuse reports based solely on the provision or facilitation of RHC.

First, the 2024 Rule prohibits disclosing PHI “when the sole basis of the report of abuse ․ is the provision or facilitation of” RHC. 89 Fed. Reg. at 33043. And it explains it bans disclosing PHI “as part of a report of suspected child abuse based solely on the fact that a parent seeks [RHC] ․ for a child.” 89 Fed. Reg. at 33004. That is, any time a child receives lawful RHC, a covered entity cannot report child abuse if said RHC's “provision or facilitation” were the only known indication something was amiss. The 2024 Rule explicitly seizes the State's prerogative to include such activity in their public health or child abuse-reporting regimes. And it is not unclear about it. The 2024 Rule explains: “while a state might assert that investigating or imposing liability on persons for the mere act of seeking, obtaining, providing, or facilitating health care satisfies the definition of ‘public health,’ their interpretation would not supersede the definition of ‘public health’ in the context of public health surveillance, investigations, or interventions.” 89 Fed. Reg. at 33003.

That is a facial “limit” on state laws that provide otherwise. Instead of accepting how a State defines its own child abuse laws—or public health surveillance, investigations, and interventions laws—the 2024 Rule expressly forecloses those options to the States. But Section 1320d-7(b) prohibits such foreclosure. It offers “very little ambiguity for an agency to interpret.” Evans, supra, at 1208. At most, an agency may interpret “the precise scope of public health activities that are protected.” Id. That does not include flatly barring States from considering RHC in their child abuse or public health laws. Defendants argue the 2024 Rule changed nothing about the 2000 Privacy Rule's existing permission to disclose or use PHI to report child abuse or otherwise comply with the public health laws specified in Section 1320d-7(b). ECF No. 40 at 25. That is flatly wrong. The 2024 Rule “transformed” that existing permission by prohibiting PHI disclosure “when the sole basis of the report of abuse ․ is the provision or facilitation of” RHC. 89 Fed. Reg. at 33043; ECF No. 66 at 21. That was not barred before.

Defendants protest neither “federal law nor Texas law defines ‘child abuse’ to include activities related to” RHC. ECF No. 40 at 27. To be sure, nothing in Texas's child abuse statute explicitly refers to RHC. See TEX. FAM. CODE ANN. § 261.001(1) (West 2023). But a statute need not explicitly define RHC procedures as child abuse RHC procedures to be child abuse. Rather, types of otherwise-lawful RHC can constitute child abuse even under a statute's more generalized terms. That interpretation of state laws lies with States.

In fact, Texas can interpret its child abuse statutes in this way. The Texas Attorney General opined that “(1) sterilization through castration, vasectomy, hysterectomy, oophorectomy, metoidioplasty, orchiectomy, penectomy, phalloplasty, and vaginoplasty; (2) [and] mastectomies” can in certain instances “legally constitute child abuse under several provisions of chapter 261 of the Texas Family Code” when performed on children. Tex. Att'y Gen. Op. No. KP-0401 (2022), 2022 WL 579379, at *1. The Texas Attorney General evaluated the very provision Defendants claim does not reference RHC as child abuse and concluded that sometimes, it may. And all these procedures would fall under the 2024 Rule's expansive reproductive-health definition because they all “relat[e] to the reproductive system and to its functions and processes.” 89 Fed. Reg. at 33063.

Of course, Texas grants the Attorney General no power to “alter the pre-existing legal obligations of state agencies or private citizens” nor any “formal legal authority to direct the investigatory decisions” of Texas's Department of Family and Protective Services. In re Abbott, 645 S.W.3d 276, 281 (Tex. 2022). And this particular opinion letter is, unsurprisingly, controversial. Id.; see also Abbott v. Doe, 691 S.W.3d 55 (Tex. App. 2024). But the Attorney General's opinion letters are not without weight. They instead “clarify the legal obligations and liabilities of state officials.” Freedom from Religion Found., Inc. v. Mack, 4 F.4th 306, 310 (5th Cir. 2021) (first citing TEX. GOV'T CODE ANN. § 402.042 (West 2013); and then Thomas v. Groebl, 212 S.W.2d 625, 632 (Tex. 1948)). Even more, they are “entitled to great weight” in Texas's courts and provide a liability shield for those who rely on them. Id. (quoting Royalty v. Nicholson, 411 S.W.2d 565, 572 (Tex. App. 1967)) (citing Manion v. Lockhart, 114 S.W.2d 216, 219 (Tex. 1938); TEX. PENAL CODE ANN. § 9.21 (West 1994)).

Despite the opinion letter's lack of binding effect, it still demonstrates that States like Texas can have capacious definitions of their own child abuse or public health laws. And Section 1320d-7(b) affords HHS no leeway to “invalidate or limit” the “authority, power, or procedures” of those laws by slicing off its favored procedures from a State's purview. Holding otherwise would permit an agency to protect its favored procedures by declaring them outside the enumerated public health laws in Section 1320d-7(b). That can only atrophy Congress's “muscular” protections. Evans, supra, at 1206.

2. The 2024 Rule limits state public health laws in Section 1320d-7(b) by requiring covered entities to determine whether PHI contains information potentially related to RHC.

Second, the 2024 Rule requires covered entities to scrub PHI to determine whether it contains RHC information before use or disclosure under a public health law enumerated in Section 1320d-7(b). That is a “limit” on such laws because it restrains or curtails a covered entity's ability to disclose—either affirmatively or in response to a request—PHI under a Section 1320d-7(b) public health law. As Plaintiffs note, “[w]ithout the 2024 Rule, a doctor could simply produce the PHI in compliance with state-law reporting procedures.” ECF No. 45 at 30–31. But after the 2024 Rule, a covered entity cannot comply so blithely. Rather, if a State were to request PHI from a covered entity per a “procedure[ ]” under a state law concerning “public health surveillance” or “public health investigation,” then a covered entity must undergo the burden of “screen[ing] requested PHI for whether it contained information potentially related” to RHC. 42 U.S.C. § 1320d-7(b); 89 Fed. Reg. at 33060-61 (emphasis added). And the 2024 Rule's expansive definition of RHC only makes the task more daunting. Thus, a covered entity is limited by the “burden” of screening “requested PHI” for any “information potentially related” to RHC. 89 Fed. Reg. at 33060.

3. The 2024 Rule limits state public health laws in Section 1320d-7(b) by requiring covered entities to determine the lawfulness of RHC or presume it lawful.

Third, before use or disclosure of PHI or response to a PHI request, a covered entity must divine whether the RHC was lawful. 89 Fed. Reg. at 33063 (prohibiting disclosure if the RHC was “lawful under the law of the state in which such health care is provided” or is “protected, required, or authorized by” Federal law). If the covered entity cannot reasonably make that determination, it must presume it was “lawful” unless it knows or is reasonably shown otherwise. See id. (the RHC “provided by another person is presumed lawful” unless the covered entity has “[a]ctual knowledge that the [RHC] was not lawful” or information supplied “demonstrates a substantial factual basis that the [RHC] was not lawful”).

Requiring a covered entity to surmise whether RHC is lawful under federal, state, or constitutional law raises an intolerable impediment to disclosing that RHC information under a public health law Section 1320d-7(b) protects. Covered entities cannot make nuanced legal judgments. Even HHS understands that: “[T]he Department recognizes that situations may arise where a regulated entity reasonably determines that [RHC] was lawfully provided, while at the same time, the person requesting the PHI (e.g., law enforcement) reasonably believes otherwise.” 89 Fed. Reg. at 32993. RHC legalities under “Federal law, including the United States Constitution” and the “law[s] of the state[s]” are often intractable. 89 Fed. Reg. at 33063. Again, HHS admits the post-Dobbs legal landscape “has also led to questions about both the current and future lawfulness of other types” of RHC. Id. at 32987.

These questions even stymie courts. Take two recent examples Plaintiffs highlight:

HHS has averred the federal Emergency Medical Treatment and Active Labor Act (“EMTALA”) mandates abortion care in emergencies even if it might “violate state law.” Brief for the Respondent at 11, Moyle v. United States, 144 S. Ct. 2015 (2024) (No. 23-726). But the Supreme Court itself declined to demarcate the relationship between EMTALA and state abortion prohibitions after granting certiorari on the question. See Moyle, 144 S. Ct. 2015 (mem.); see also id. at 2019 (“We granted certiorari before judgment in these cases to decide whether [EMTALA] preempts a provision of Idaho law that prohibits abortions except when necessary to save the life of the mother.”) (Barrett, J., concurring). And yet the 2024 Rule requires medical professionals to toe the same preemption tightrope the Supreme Court declined to walk—at least for now.

Abortion legalities fluctuate day-to-day. See, e.g., RACHEL L. ZACHARIAS, MAYDHA B. VINSON & ALICIA W. MACKLIN, LEGALITY OF ABORTION IN EMERGENCY MEDICAL CIRCUMSTANCES CONTINUES TO EVOLVE (2025), 2025 WL 1372964; Allison McCann & Amy Schoenfeld Walker, Tracking Abortion Laws Across the Country, N.Y. TIMES (May 29, 2025, at 12:24 ET), https://www.nytimes.com/interactive/2024/us/abortion-laws-roe-v-wade.html [https://perma.cc/798N-22NM] (tracking where abortion is legal and not in part because “the fight over abortion access is still taking place in courtrooms”). And misinformation abounds—even from the Federal government. See, e.g., Guidance on Nondiscrimination Protections Under the Church Amendment,DEP'T OF HEALTH & HUM. SERVS. (Feb. 3, 2023), https://www.hhs.gov/conscience/conscience-protections/guidancd-church-amendments-protections/index.html [https://perma.cc/G5EF-WUKE] (citing Planned Parenthood of Se. Pa. v. Casey, 505 U.S. 833 (1992), overruled by Dobbs, 597 U.S. 215) (HHS insisting that an “abortion that violates an unconstitutional state law may be a lawful abortion,” while citing standards for the now-terminated constitutional right to abortion). To determine whether an abortion prohibited under a state's law was truly unlawful, as the 2024 Rule requires, a covered entity must journey through the abortion's factual circumstances. Next, it must slog through the legal subtleties bog where confusion and false information abound. Such inquiries take time. And it would present a distinct limit to disclosure if the PHI were requested or disclosed per a protected state public health law.

Consider a second example. The Supreme Court only today issued an opinion in United States v. Skrmetti that holds state laws that restrict or prohibit gender-transition procedures for minors must only satisfy rational-basis review because they do not classify to trigger heightened scrutiny under the Equal Protection Clause. No. 23-477, 2025 WL 1698785, at *7 (U.S. June 18, 2025). The United States argued such laws violate the Equal Protection Clause. Brief for the Petitioner at 19–23, Skrmetti, No. 23-477 (“SB1 classifies based on sex, through and through.” Id. at 21.). Many States disagreed. Lindsey Dawson & Jennifer Kates, Policy Tracker: Youth Access to Gender Affirming Care and State Policy Restrictions, KFF (May 27, 2025), https://www.kff.org/other/dashboard/gender-affirming-care-policy-tracker/ [https://perma.cc/RH99-E788]. If Texas requested PHI from a covered entity to investigate child abuse via child gender-transition procedures deemed illegal in Texas, that said entity must have—before today—parsed the intricacies of Equal Protection jurisprudence to determine whether the Constitution voids Texas's law via the 14th Amendment. But medical professionals cannot answer legal questions that divide Supreme Court Justices. See Skrmetti, 2025 WL 1698785, at *40 (Sotomayor, Jackson & Kagan, JJ., dissenting). If they must, that presents a prohibited limit on the “authority, power, or procedures” of statutorily protected public health laws because such laws sometimes require reporting and disclosures. 42 U.S.C. § 1320d-7(b). Impediments to those objectives curtail those “procedures.” Id.

And the 2024 Rule's “[p]resumption” provision does not alleviate the problem. 89 Fed. Reg. at 33063. HHS instructed covered entities to “presume[ ]” the RHC was lawful unless “[a]ctual knowledge” or “[f]actual information supplied․ demonstrates a substantial factual basis that the [RHC] was not lawful.” Id. HHS admitted the confused legal landscape was a potential pitfall for covered entities: it added the presumption provision “to ensure that the regulated entity is not required to make a determination about the lawfulness of such” RHC. See 89 Fed. Reg. at 33012; id. at 33014 (“To address commenters' concerns about obligating regulated entities to determine whether [RHC] that occurred outside of the regulated entity is lawful, the Department is adding a new presumption provision․ ”). This presumption limits a State's ability to conduct public health investigations because the State must provide sufficient information to overcome the presumption. Again, HHS recognizes “this new regulatory presumption may make it more difficult for a state to investigate whether [RHC] was unlawful under the circumstances in which it was provided.” Id. at 33015. If a State decides to define investigating unlawful RHC as part of its “public health investigation” power, regardless of whether the 2024 Rule agrees, then the presumption raises another impediment to the “procedures” of such laws. 42 U.S.C. § 1320d-7(b). And such limits Congress forbade.

4. The 2024 Rule limits state public health laws in Section 1320d-7(b) by requiring covered entities to administer a detailed affidavit requirement.

Finally, the 2024 Rule's attestation requirement limits the “procedures” of Section 1320d-7(b)'s protected public health laws. The 2024 Rule requires covered entities to obtain an “attestation” before use or disclosure of PHI “potentially related” to RHC. 89 Fed. Reg. at 33063. The attestation must meet strict requirements. It must state the requested information will not be used for a prohibited purpose; must not contain any extra, nonrequired statements; must be believable to a reasonable covered entity; must contain a specific description of the sought information; must contain a statement that a covered entity could be subject to penalties for a HIPAA violation; must be in plain language; and must be signed, among other granular requirements. Id. at 33063–64. The covered entity “may not use or disclose” if the requester fails a single demand.

HHS understands the attestation requirement imposes a “burden ․ on regulated entities and persons requesting PHI.” 89 Fed. Reg. at 33029. It is a weighty burden: if the covered entity wrongly evaluates the attestation and unwittingly discloses protected PHI, it is “not in compliance” with the 2024 Rule. Id. at 33063. But ultimately, HHS confidently “disagrees that regulated entities are unable to make the required assessments of attestations.” Id. at 33035. HHS admits “the attestation requirement will․ delay law enforcement investigations” that “involve PHI ‘potentially related” ’ to RHC. Id. at 33029. Of course. The attestation requirement imposes bureaucratic barricades to States exercising their lawful public health investigation powers if they request any PHI “potentially related” to RHC. Id. at 33063. Section 1320d-7(b) contemplates more than just a bar on eventual disclosure under these public health laws. Rather, it prohibits HIPAA and its regulations from even being “construed” as raising “delay” for public health investigations and other protected public health laws. 42 U.S.C. § 1320d-7(b); 89 Fed. Reg. at 33029. But HHS freely admits that is what the attestation requirement does.

5. Limiting Principle

Defendants protest this reasoning presents no “limiting principle.” ECF No. 40 at 28. They claim construing “limit” in Section 1320d-7(b) to mean its ordinary meaning “precludes even regulations that require a provider to have a valid basis for reporting child abuse, or that require a provider to take steps to limit the disclosure of PHI to information necessary and material to the report.” Id. To escape that result, Defendants propose the “more sensible reading” of Section 1320d-7(b): “limit” actually means “Congress sought to prohibit rules that would preempt or supersede reporting statutes.” Id. at 28–29 (emphasis added).

The Court has no obligation to “offer[ ] [a] limiting principle.” Bondi v. VanDerStok, 145 S. Ct. 857, 892 (2025) (Thomas, J., dissenting). And it need not adopt Defendants' interpretation of the statute redefining “limit” to mean “preempt or supersede” just to add a limiting principle. Congress did not use the words “preempt or supersede.” It used “invalidate or limit.” 42 U.S.C. § 1320d-7(b). “That textual difference matters.” Corner Post, Inc. v. Bd. of Governors of Fed. Reserve System, 603 U.S. 799, 814 (2024). Thus, those are the words the Court must interpret because Congress “says in a statute what it means and means in a statute what it says there.” Conn. Nat'l Bank v. Germain, 503 U.S. 249, 253–54 (1992). Even more, Congress went further and prohibited any construction that might limit relevant state laws. Section 1320d-7(b) “implies that the Privacy Rule must neither preempt nor regulate the enumerated public health activities.” Evans, supra, at 1215. So Section 1320d-7(b) does at least mean what Defendants propose. But it means even more. The Court may not “impose an extratextual limiting principle” if the “language of the statute itself does not plainly provide such a limiting principle.” Lawson v. FMR LLC, 571 U.S. 429, 472 n.9 (2014) (Sotomayor, Kennedy, & Alito, JJ., dissenting) (quoting Lawson v. FMR LLC, 724 F. Supp. 2d 141, 158 (D. Mass. 2010)).

In any event, Defendants' worries are unfounded, and their examples are inapposite. First, the statute does not preclude “even regulations that require a provider to have a valid basis for reporting child abuse.” ECF No. 40 at 28. That is because such a regulation merely upholds the point of the State's law. It certainly does not limit it. Requiring a covered entity to stay within the bounds of a State's child-abuse reporting law raises no impediments the State itself does not. Texas's mandatory child abuse reporting law is illustrative. It demands a person have “reasonable cause to believe” child abuse is occurring. TEX. FAM. CODE ANN. § 261.101(a) (West 2021) (emphasis added). Even more, Texas imposes criminal and civil penalties for “knowingly mak[ing] a report․ that is false.” TEX. FAM. CODE ANN. § 261.107 (West 2005). Defendants' example highlights exactly how Section 1320d-7(b) is supposed to work: State laws impose the limits—not HHS diktat.

The same is true of their second example. Any regulation that barred a covered entity from disclosing information irrelevant to a report would not limit a State's mandatory reporting law. If that were so, the farcical result would be any regulation promulgated under HIPAA is invalid. But barring disclosure of information irrelevant to a report does not limit the State's law because disclosure of irrelevant information does nothing to aid the report. A State's reporting law demands reports be made. It does not demand they include irrelevant PHI. And even if Section 1320d-7(b) did mean what Defendants fear, state law often provides the limiting principle Defendants desire. Again, Texas law confirms. It enumerates certain information that must be disclosed in a report, including “any other pertinent information concerning the alleged or suspected abuse or neglect.” TEX. FAM. CODE ANN. § 261.104 (West 2023) (emphasis added). And it even imposes detailed rules surrounding the “[c]onfidentiality and [d]isclosure of [i]nformation” in “a report of alleged or suspected abuse.” TEX. FAM. CODE ANN. § 261.201 (West 2023). Again, state law imposes a limiting principle Defendants wrongly fear the ordinary meaning of Section 1320d-7(b) will bar.

* * *

The 2024 Rule can be “construed to invalidate or limit the authority, power, or procedures” of laws that protect child abuse reporting, or “public health investigation or intervention.” 42 U.S.C. § 1320d-7(b). But Congress ordered “[n]othing․ shall be construed” to do just that. Id. (emphasis added). The 2024 Rule does so in several ways. First, it prohibits reporting child abuse if such a report would be based solely on lawful RHC, and it prohibits States from ever considering reproductive health alone as abuse or part of a public health investigation. Second, the 2024 Rule requires covered entities to scrub PHI whenever they receive a lawful PHI request, to determine whether it contains any “health care” information “relating to the reproductive system and to its functions and processes.” 89 Fed. Reg. at 33063. Third, covered entities must scrutinize confusing abortion and gender-identity jurisprudence, legislation, and regulations to decipher whether the RHC was lawful. And finally, covered entities must flawlessly enforce an intricate attestation requirement whenever they receive a request to disclose PHI—no matter the requester's motivation.

HHS may not impose these intricate requirements, impose liability for failure to follow them flawlessly, and then still proclaim no limits exist because PHI disclosure may eventually result. The ordinary meaning of “limit” bars this blinkered reading. “Limit” does not only mean “thwart.” It means to impose restrictions, restraints, or curtailments. The 2024 Rule's very terms and HHS's admissions recognize this is exactly what the 2024 Rule does. Though Theseus conquered the Minotaur and escaped the labyrinth, we remember the myth because the labyrinth imposed “limits.” See CHARLES MILLS GAYLEY, THE CLASSIC MYTHS IN ENGLISH LITERATURE AND IN ART 252–53 (Athenaeum Press 1911).

B. The 2024 Rule Unlawfully Redefines Statutory Terms.

i. Person

Plaintiffs further challenge the 2024 Rule because it advances definitions of “person” and “public health” that are contrary to statute. ECF No. 45 at 35–36. The 2024 Rule defines “person” to be, in part, a “natural person (meaning a human being who is born alive).” 89 Fed. Reg. at 33062. This definition facially excludes unborn humans and explicitly bars doctors and covered entities from acting on behalf of unborn patients. ECF No. 45 at 35. And they claim it conflicts with the Dictionary Act because that Act prohibited its definition from being “construed to ․ deny ․ any legal status or legal right applicable to any member of the species homo sapiens at any point prior to being ‘born alive.” ’ 1 U.S.C. § 8(c).

Defendants argue the 2024 Rule's definition of person fits with the Dictionary Act. ECF No. 40 at 32–33. They claim the Dictionary Act uses the exact same definition as the 2024 Rule because both define “person” as only someone “born alive.” See 1 U.S.C. § 8(a); 89 Fed. Reg. at 33062 (a person “means a natural person․ who is born alive”). And they assert the 2024 Rule's exclusion of unborn humans does not “deny ․ any legal status or legal right” because “HIPAA does not itself include any language that could properly be construed as extending” to unborn humans. ECF No. 40 at 32–33; 1 U.S.C. § 8(c). Finally, Defendants aver that every “case interpreting the Dictionary Act has adopted the Department's reading.” Id. at 33 (collecting cases).

The 2024 Rule's definition of person conflicts with the Dictionary Act's prohibition that it “shall [not] be construed to affirm, deny, expand, or contract any legal status or legal right applicable to any [human] at any point prior to being ‘born alive.’ ” 1 U.S.C. § 8(c). Defendants' read of the Dictionary Act is almost correct, but their argument papers over one central issue. The Dictionary Act forbids its definition of “person” from being used to “deny ․ or contract any legal status or legal right applicable to any [human] at any point prior to being ‘born alive.’ ” Id. (emphasis added). That means a “regulation” cannot rely on the Dictionary Act's definition to curtail or deny legal rights to unborn humans. Here is where Defendants misstep. They argue the Dictionary Act only protects unborn rights conferred by HIPAA. ECF No. 40 at 32–33. That reading is belied by the plain text. Rather, Congress wrote “any legal status or legal right.” 1 U.S.C. § 8(c). It did not write “any legal status or legal right that HIPAA confers.” Instead, the Dictionary Act prohibits relying on its definition to “deny, expand, or contract any legal status or legal right” to unborn humans. Id. And those legal statuses or rights may originate in federal and state law.

But the 2024 Rule relies on the Dictionary Act to deny legal status and rights to unborn humans. And in so doing, the 2024 Rule is facially contrary to the Dictionary Act's terms. The 2024 Rule does not hide its attempt to deny these legal statuses and rights. It proclaims its definition of person does “not include a fertilized egg, embryo, or fetus.” 89 Fed. Reg. at 32997. And crucially, “a regulated entity is permitted to disclose PHI about an individual who the regulated entity believes to be a victim of abuse, neglect, or domestic violence only where the individual is a ‘natural person.” ’ Id. (emphasis added). Thus, a medical professional could never make a child abuse report if they suspected an unborn child was being abused or neglected.

In case of confusion, the 2024 Rule reiterates that unborn humans are not persons under the 2024 Rule. Anticipating some States might deem substance abuse during pregnancy to be child abuse, the 2024 Rule permits reporting only “where the individual meets the clarified definition of person.” 89 Fed. Reg. at 32998. In other words, substance abuse while pregnant is not child abuse. But the 2024 Rule does not stop. It states again that its “interpretation prohibits a regulated entity from disclosing PHI in reliance on the permission for reporting ‘child abuse’ where the alleged victim does not meet the definition of ‘person.’ ” Id. at 33004.

And the 2024 Rule explicitly employs the Dictionary Act to justify its definition and prohibitions: “[T]he Department believes that to the extent this clarification [in the definition] prohibits a regulated entity from disclosing PHI to report ‘child abuse’ under [the Privacy Rule's child abuse reporting permission] where the alleged victim does not meet the definition of ‘person,’ it is consistent with ․ 1 U.S.C. 8.” Id.

The 2024 Rule could not have been clearer. Covered entities cannot disclose PHI to report child abuse or neglect of unborn children—no matter their legal status. But States routinely confer “legal status” on unborn children as it relates to child abuse. 1 U.S.C. § 8(c). In fact, twenty-one States explicitly define substance abuse during pregnancy as child abuse or neglect. See LEGIS. ANALYSIS & PUB. POL'Y ASS'N, SUBSTANCE ABUSE DURING PREGNANCY AND CHILD ABUSE OR NEGLECT: SUMMARY OF STATE LAWS 10-113 (2022), https://legislativeanalysis.org/wp-content/uploads/2022/10/Substance-Use-During-Pregnancy-And-Child-Abuse-Or-Neglect-Summary-of-State-Laws.pdf [https://perma.cc/ 28R5-CLY3] (Arizona, Arkansas, Colorado, Florida, Georgia, Illinois, Indiana, Iowa, Louisiana, Massachusetts, Michigan, Minnesota, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Texas, Utah, Virginia, and Wisconsin).

But after the 2024 Rule, covered entities could not disclose PHI to report child abuse for substance abuse during pregnancy. The 2024 Rule flatly forbids it, as shown. And in so doing, it strips unborn humans of any legal status they had under state laws. The 2024 Rule decrees unborn children can never be “victim[s]” of “child abuse” because they do “not meet the definition of ‘person’ ․ consistent with ․ [the Dictionary Act].” 89 Fed. Reg. at 33004.

The Dictionary Act ordains otherwise. It cannot be construed to “deny” “legal status” to unborn humans—even if it does not include them in its definition of “person.” 1 U.S.C. § 8(a), (c). The 2024 Rule's definition of “person” is consistent with the Dictionary Act. But its reliance on that definition to explicitly deny legal status to unborn humans is not. Dupuch-Carron v. Sec'y of Health & Hum. Servs., 969 F.3d 1318, 1328 (Fed. Cir. 2020); Moyle, 603 U.S. at 350 n.3 (Alito, J., dissenting). Thus, the 2024 Rule is contrary to the Dictionary Act.

ii. Public Health

Plaintiffs next challenge the 2024 Rule's interpretation and definition of “public health.” The 2024 Rule defines “public health”—“as used in the terms ‘public health surveillance,’ ‘public health investigation,’ and ‘public health intervention’ ”—to mean “population-level activities to prevent disease in and promote the health of populations.” 89 Fed. Reg. at 33062 (quoting 42 U.S.C. § 1320d-7(b)). Included activities are “identifying, monitoring, preventing, or mitigating ongoing or prospective threats to the health or safety of a population.” Id. However, “public health” as used in 42 U.S.C. Section 1320d-7(b) “does not include” (1) conducting a “criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating health care”; (2) imposing “criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating health care”; and (3) identifying “any person for any of the activities” described above. 89 Fed. Reg. at 33062–63.

Altogether, HHS explains, “while a state might assert that investigating or imposing liability on persons for the mere act of seeking, obtaining, providing, or facilitating health care satisfies the definition of ‘public health,’ their interpretation would not supersede the definition of ‘public health’ in the context of public health surveillance, investigations, or interventions” the 2024 Rule adopts. 89 Fed. Reg. at 33003. And HHS asserts “[p]ublic health surveillance, investigation, and intervention do not include efforts to attach liability to persons for specific acts of seeking, obtaining, providing, or facilitating health care.” Id.

Plaintiffs argue this interpretation of “public health” in 42 U.S.C. Section 1320d-7(b) is an overbroad arrogation of power beyond HHS's reach. ECF No. 45 at 37 (“This redefinition is a power grab, by which HHS is usurping the prerogative of states to protect public health using their traditional police power ․”). Instead, Plaintiffs argue, it is “the purview of states, not HHS, to decide what constitutes child abuse, which deaths will be recorded, and how to investigate threats to public health. HIPAA gives HHS no authority to do so.” Id. at 39. Rather, they claim, Section 1320d-7(b) limits HIPAA's ability to define away States' public-health definitions and thereby preempt whatever state law they please through HIPAA's regulations. Id. By redefining “public health” to exclude certain activities, Plaintiffs contend the 2024 Rule “says HIPAA's preemption provision overrides state public health reporting procedures that HHS says aren't really about public health.” Id. at 37 (emphasis in original). In their view, Congress deferred to the States to decide what constitutes “public health” and what does not.

Defendants argue HHS “correctly defined” public health. ECF No. 40 at 34, They argue “public health” deals with “population-level activities to prevent disease in and promote the health of populations,” instead of the individual imposition of criminal or civil liability. Id. at 33 (quoting 89 Fed. Reg. at 33062). They note public health-related matters and “criminal investigations” are distinguishable under longstanding doctrines. Id. at 34; see also 89 Fed. Reg. at 33001 (asserting “there is a widely recognized distinction between public health activities․ and criminal investigations”). Defendants downplay the redefinition's effect and claim “the 2024 Rule simply clarifies that efforts to investigate or impose liability on specific persons ․ do not themselves constitute any of the enumerated ‘public health’ activities” in Section 1320d-7(b). In any event, Defendants assert both “specific” and “general” grants of authority to define “public health” through the 2024 Rule. ECF No. 40 at 30 (citing 42 U.S.C. §§ 1320d-2 note; 1320d-3(b)(1); 1302(a)).

Though Congress granted Defendants broad authority, it is not broad enough to cover HHS's redefinition of HIPAA preemption provisions. The Supreme Court foreclosed a broad, general authority grant from extending so far. In Gonzalez v. Oregon, the Supreme Court held that an agency-authority delegation to promulgate standards does not entail “the authority to decide the pre-emptive scope of the federal statute” unless Congress expressly delegated same. 546 U.S. 243, 263 (2006) (citing Adams Fruit Co. v. Barrett, 494 U.S. 638, 649–50 (1990)); see also Thomas W. Merrill, Preemption and Institutional Choice, 102 Nw. U. L. REV. 727, 768–69 (2008). The Attorney General in Gonzalez attempted to harness the Controlled Substances Act to preempt, through interpretive guidance, Oregon's law permitting assisted suicide. Gonzalez, 546 U.S. at 248–49. To do so, he exercised his power to deregister or register physicians who prescribe controlled substances. Id. at 258. He explained the registration of any physician who prescribed controlled substances for assisted suicide was potentially “inconsistent with the public interest and therefore subject to possible suspension or revocation.” Id. at 254 (quoting 66 Fed. Reg. 56608 (2001)).

But the Supreme Court explained it was “not enough that the terms ‘public interest,’ [and] ‘public health and safety,’․ are used in the part of the statute over which the Attorney General has authority. The statutory terms ‘public interest’ and ‘public health’ do not call on the Attorney General, or any other executive official, to make an independent assessment of the meaning of federal law.” Id. at 263. Though the Attorney General may have regulatory power delegated, it did not extend to “decid[ing] what the law says.” Id. at 264. Permitting him that power would mean he “could authoritatively interpret ‘State’ and ‘local laws.’ ” Id. But of course, that would only present “obvious constitutional problems”—especially since the Controlled Substances Act “explicitly contemplate[d] a role for the States ․ as evidenced by its pre-emption provision.” Id. at 251. Instead, “[w]hen Congress chooses to delegate a power of this extent, it does so not by referring back to the administrator's functions but by giving authority over the provisions of the statute he is to interpret.” Id. at 265.

Here, Congress gave HHS no authority “to decide the pre-emptive scope of” Section 1320d-7(b) by redefining what “public health” may include because “[n]o such delegation ․ is evident in the statute.” Id. at 263 (alteration in original) (quoting Adams Fruit Co., 494 U.S. at 650). The text and structure of Section 1320d-7 confirm this reading. Section 1320d-7 is a clear preemption provision. See 42 U.S.C. § 1320d-7 (“Effect on state law.”); id. § 1320d-7(a) (HIPAA regulations “shall supersede any contrary provision of State law”). It provides for a few exceptions that, if met, mean HIPAA regulations do not preempt the specified laws.

Two of these anti-preemption provisions are relevant. The first states HIPAA regulations “shall not supersede a contrary provision of State law” if they are necessary to prevent fraud and abuse, deal with state regulation of insurance and health plans, concern state reporting on health care delivery or costs, or address controlled substances. Id. § 1320d-7(a)(2).

And the second is the now-familiar public health exception, which prohibits HIPAA regulations from being “construed to invalidate or limit the authority, power, or procedures established under any law providing for” certain public health-related goals. Id. § 1320d-7(b). Notably, this second anti-preemption provision protects “any law”—not just state laws. See Evans, supra, at 1199 (“Congress's choice of the phrase ‘any law’ in § 1320d-7(b) must be presumed deliberate” because the provisions that “sandwich[ ]” Section 1320d-7(b) each “use[ ] the phrase ‘State law” ’).

For this first anti-preemption provision, Congress explicitly granted HHS the authority to determine its scope—notwithstanding the general authority grants Defendants cite. Congress wrote HIPAA regulations do not “supersede a contrary provision of State law, if the provision of State law is a provision the Secretary determines” meets one factor from a list Congress pronounced. Id. § 1320d-7(a)(2), (a)(2)(A) (emphasis added). That is a specific grant of authority to HHS “to decide the pre-emptive scope of the federal statute.” Gonzalez, 546 U.S. at 263 (citing Adams Fruit Co., 494 U.S. 638, 649–50).

But Congress gave HHS no such grant of authority over Section 1320d-7(b)'s public health anti-preemption provision. Section 1320d-7(a)(2)—where Congress did give HHS the ability to decide the preemptive scope—reveals HHS lacks that authority for Section 1320d-7(b). Without a specific authority grant to decide the scope of Section 1320d-7(b)'s anti-preemptive effect, HHS cannot independently “assess[ ]” “the meaning of federal law.” Gonzalez, 546 U.S. at 263. And just like Gonzalez, “[i]t is not enough that the term[ ]․ ‘public health’․ [is] used in the part of the statute over which” HHS has authority to issue regulations. Id.

“[S]omething like a super-strong clear statement is required before agencies can issue legislative regulations that preempt state law on their own authority.” Merrill, supra, at 768. HHS lacked that clear statement here, even though Congress granted HHS that clear statement over a different provision. Congress demonstrated it can issue these sorts of clear statements. It did not do so for Section 1320d-7(b). Nevertheless, the 2024 Rule attempts to define the scope of the anti-preemption provision. It wrests a certain category of behavior from States via regulation because HHS deemed them insufficiently related to “public health.” It decrees “public health” as used in Section 1320d-7(b) can never mean conducting investigations related to the act of “seeking, obtaining, providing, or facilitating health care” or imposing liability for the same. 89 Fed. Reg. at 33062–63. It admits a “state might assert” that such activity could fall under its “public health” surveillance or investigation laws. 89 Fed. Reg. at 33003. But no matter. Because HHS dictates they do not. Defendants would like to reframe this rewrite as a “clarifi[cation].” ECF No. 40 at 34. But wholly excising certain activities from the definition of “public health” in a statute—the scope of which HHS lacks authority to circumscribe—is more than a clarification. It is “independent[ly] assess[ing] ․ the meaning of federal law.” Gonzalez, 546 U.S. at 263.

Section 1320d-7(b) “explicitly contemplates a role for the States” by protecting their enumerated public health laws. Gonzalez, 546 U.S. at 251. HHS wrote the 2024 Rule to discard the States' role in characterizing their own public health laws. Indeed, some States do define their public health laws to cover activities the 2024 Rule bars. See, e.g., IND. CODE § 16-34-2-5 (2023) (requiring all abortions reported to the State in part “to monitor all abortions performed in Indiana to assure the abortions are done only under the authorized provisions of law”). The 2024 Rule unlawfully redefines “public health” because it lacks a clear congressional delegation that permits HHS to define the scope of Section 1320d-7(b)'s anti-preemption provision. It even lacks clear authority to “give meaning to a particular statutory term” in Section 1320d-7(b). Loper Bright, 144 S. Ct. at 2263. With only a general authority to promulgate regulations under HIPAA, the 2024 Rule cannot redefine the statute itself. See Util. Air Regul. Grp. v. EPA, 573 U.S. 302, 328 (2014) (“[A]n agency may not rewrite clear statutory terms to suit its own sense of how the statute should operate.”).

III. Excess of Statutory Authority

A. HHS Lacked Authority to Promulgate Special Protections for RHC Information.

Finally, HHS cannot invoke “modest words,” “vague terms,” or “subtle device[s]” to justify special protection for politically controversial medical care now returned to the States. West Virginia v. EPA, 597 U.S. 697, 723 (2022) (alteration in original) (quoting Whitman v. Am. Trucking Ass'ns, Inc., 531 U.S. 457, 468 (2001)).

Plaintiff's argue the major-questions doctrine holds that HIPAA did not grant HHS the power to promulgate special protections for politically favored medical procedures. ECF No. 45 at 40–42. Instead, HIPAA only permitted protection for “patient information and privacy generally, for all kinds of health care.” Id. at 40. But, Plaintiffs note, “HHS's use of HIPAA's generic text to gerrymander rules targeting highly politically charged procedures such as abortion and gender transitions raises even greater concerns about the agency's authority.” Id. Without clear congressional authorization to “create different tiers of health care generally, or to do so for controversial issues like abortion, medicalized gender transition, and other sorts” of RHC, the 2024 Rule cannot stand. Id. at 42.

Defendants argue the major-questions doctrine is “inapplicable.” ECF No. 40 at 34. Defendants believe heightened protections for RHC information “does not involve a public controversy of vast economic and political significance.” Id. at 35 (emphasis and internal quotation omitted). Nor does the 2024 Rule constitute “transformative” or “radical” change or a “wholesale restructuring” of HHS's authority. Id. (quoting West Virginia, 597 U.S. at 716). Instead, Defendants claim the 2024 Rule springs clearly from HHS's authority to “promulgate rules concerning permissible ‘uses and disclosures’ of PHI. Id. (quoting 42 U.S.C. § 1320d-2 note).

i. Major-Questions Doctrine Standards

HHS lacked clear delegated authority to fashion special protections for medical information produced by politically favored medical procedures. The major-questions doctrine counsels that “in certain extraordinary cases, both separation of powers principles and a practical understanding of legislative intent make [courts] ‘reluctant to read into ambiguous statutory text’ the delegation claimed to be lurking there.” West Virginia, 597 U.S. at 723 (quoting Util. Air, 573 U.S. at 324).

Such cases arise when an agency attempts “to make major policy decisions itself.” Id. Major policy decisions include those that implicate “vast economic and political significance.” Nat'l Fed'n of Indep. Bus. v. OSHA, 595 U.S. 109, 117 (2022) (quoting Ala. Ass'n of Realtors v. HHS, 594 U.S. 758, 764 (2021)). An indicator an agency is attempting to make a major policy decision itself arises if the “history and breadth of the authority” the agency has previously exercised mismatches the new authority asserted. West Virginia, 597 U.S. at 721 (quoting FDA v. Brown & Williamson Tobacco Corp., 529 U.S. 120, 159 (2000)). And if the agency's claimed power would “effec[t] a fundamental revision of the statute, changing it from [one sort of] scheme of․ regulation into an entirely different kind,” then the agency may also be attempting to regulate outside its delegated authority on a major policy issue. Biden v. Nebraska, 600 U.S. 477, 502 (2023) (alterations and omissions in original) (quoting West Virginia, 597 U.S. at 728).

Marks of a matter's political significance may include: “earnest and profound debate across the country,” not “confined to the halls of Congress,” or topics “that are personal and emotionally charged.” Biden v. Nebraska, 600 U.S. at 503, 504 (internal quotations omitted). Major questions of political significance have included broad student loan cancellation, pandemic eviction moratoriums, the disposal of nuclear waste, and diversity requirements on corporate boards. See, e.g., West Virginia, 597 U.S. 697; Biden v. Nebraska, 600 U.S. 477; Ala. Ass'n of Realtors v. HHS, 594 U.S. 758; Texas v. Nuclear Regul. Comm'n, 78 F.4th 827, 844 (5th Cir. 2023), cert. granted, 145 S. Ct. 117 (2024), rev'd on other grounds, Nuclear Regul. Comm'n v. Texas, No. 23-1300, 2025 WL 1698781 (U.S. June 18, 2025) (explaining that an example of a major question is one that “has been hotly politically contested for over a half century”); All. for Fair Bd. Recruitment v. Sec. & Exch. Comm'n, 125 F.4th 159, 181 (5th Cir. 2024) (“These rules came in response to ‘the social justice movement,’ as an attempt to increase ‘diversity and inclusion’ across ‘public companies.’ We can think of few more politically divisive issues in the Nation.” (internal citation omitted)).

Additionally, a major question may arise if a Federal agency “intrudes into an area that is the particular domain of state law.” Ala. Ass'n of Realtors, 594 U.S. at 764. These sorts of regulations “significantly alter the balance between federal and state power.” Id. Thus, when an agency regulates a major policy issue in an area “primarily the States” regulate, a major question may arise. All. for Fair Bd. Recruitment, 125 F.4th at 182 (citing West Virginia, 597 U.S. at 742 (Gorsuch, J., concurring) (suggesting that the major-questions doctrine helps protect federalism)).

Thus, altogether, if an agency claims power to issue a regulation of “vast economic and political significance” that may also be outside how it has typically exercised its authority, courts ‘ “hesitate before concluding that Congress’ meant to confer such authority.” Id. (quoting Brown & Williamson Tobacco Corp., 529 U.S. at 159–60).

To cure that hesitation, courts require “something more than a merely plausible textual basis for the agency action is necessary.” Id. at 723. Instead, an agency must identify a ‘ “clear congressional authorization’ for the power it claims.” Id. (quoting Util. Air, 573 U.S. at 324). That clarity must appear because “[e]xtraordinary grants of regulatory authority are rarely accomplished through ‘modest words,’ ‘vague terms,’ or ‘subtle device[s].’ ” Id. (quoting Whitman, 531 U.S. at 468), That is not how Congress typically delegates—nor how textualism typically works. See id. (“Nor does Congress typically use oblique or elliptical language to empower an agency to make a ‘radical or fundamental change’ to a statutory scheme.” (quoting MCI Telecommunications Corp., 512 U.S. at 229)); see also Biden v. Nebraska, 600 U.S. at 508 (Barrett, J., concurring) (“[T]he major questions doctrine is a tool for discerning—not departing from—the text's most natural interpretation.”); Louis J. Capozzi III, In Defense of the Major Questions Doctrine, 100 NOTRE DAME L. REV. 509, 545 (2025) (explaining the major-questions doctrine “is just good textualism”).

The major-questions doctrine “ensures that the national government's power to make laws that govern us remains where Article I of the Constitution says it belongs—with the people's elected representatives.” Nat'l Fed'n of Indep. Bus., 595 U.S. at 124 (Gorsuch, J., concurring). And it “safeguards federalism by preventing presidential lawmaking from displacing state laws.” Capozzi, supra, at 537–38. The Constitution vests Congress with “[a]ll legislative [p]owers.” U.S. CONST. art. I, § 1. Of course, Congress often delegates it to agencies.

But political accountability demands that agencies exercise their delegations somewhat like Congress might legislate should the same question present. The major-questions doctrine aids that goal. It prevents agencies from invoking ‘ “broad congressional delegations of authority” ’ from ‘ “one time period’ ” as a “source of authority ․ to take later action' that would not currently ‘receive legislative support’ and address problems the original Congress did not contemplate or consider.” Capozzi, supra, at 555 (quoting Jonathan H. Adler & Christopher J. Walker, Delegation and Time, 105 IOWA L. REV. 1931, 1936 (2020)). Agencies skirt political accountability when they “rely on vague, old statutes to solve the pressing problems of the day” to promulgate regulations “that were never considered by the people's elected representatives—which should trouble those committed to representative government.” Capozzi, supra, at 558. Thus, the major-questions doctrine works against agencies squelching the people's voice on weighty issues where their voice matters.

ii. The 2024 Rule Triggers the Major-Questions Doctrine.

In the Fifth Circuit, three “indicators” each “independently trigger” the major-questions doctrine: “(1) when the agency ‘claims the power to resolve a matter of great political significance’; (2) when the agency ‘seeks to regulate a significant portion of the American economy’;․ and (3) when an agency ‘seeks to intrude into an area that is the particular domain of state law.’ ” Mayfield v. U.S. Dep't of Lab., 117 F.4th 611, 616 (5th Cir. 2024) (emphasis added) (quoting West Virginia, 597 U.S. at 743–44 (Gorsuch, J., concurring)).

Here, two indicators are triggered. First, the 2024 Rule regulates in an area of “great political significance.” Mayfield, 117 F.4th at 616. And second, the 2024 Rule “intrude[s] into an area that is the particular domain of state law.” Id. The Court takes each in turn.

Harnessing HIPAA to create special protections for politically favored medical procedures is a matter of “great political significance.” Id. Matters involving RHC, particularly abortion and gender-transition operations, are quintessential matters of great political significance. They meet all the tests courts have laid out. They produce “earnest and profound debate across the country.” Biden v. Nebraska, 600 U.S. at 504 (quoting West Virginia, 597 U.S. at 732). Those debates are not “confined to the halls of Congress,” but they do become “personal and emotionally charged.” Id. at 503 (internal quotation omitted). And in the case of abortion, they have “been hotly politically contested for over a half century.” Nuclear Regul. Comm'n, 78 F.4th at 844.

Indeed, few issues command as much political controversy as abortion and gender-identity-related procedures. See Dobbs, 597 U.S. at 223 (“Abortion presents a profound moral issue on which Americans hold sharply conflicting views.”); id. at 337 (Kavanaugh, J., concurring) (“Abortion is a profoundly difficult and contentious issue ․”); see also Louisiana v. EEOC, No. 2:24-CV-629, 2025 WL 1462583, at *12 (W.D. La. May 21, 2025) (“Given the political, social, and religious significance of the abortion issue in this country․ [the] EEOC must point to clear congressional authorization for the power it claims.” (internal quotation omitted)); Kansas v. U.S. Dep't of Educ., 739 F. Supp. 3d 902, 924 (D. Kan. 2024) (holding a final rule relating to gender identity acceptance “clearly decide[d] major questions”); Texas v. HHS, No. 6:24-CV-348, 2025 WL 818155, at *5 (E.D. Tex. Mar. 13, 2025) (holding a final rule related to gender identity and foster care “addresses both a matter of great political significance and intrudes into an area that is the domain of state law” (citing Texas v. Cardona, 743 F. Supp. 3d 824, 879 (N.D. Tex. 2024) (also holding a final rule related to gender identity a major question because of “the enormous social and political significance associated with transgenderism and gender-identity issues”))).

People of good faith vehemently disagree on both these issues. They lie at the center of what it means to be human, the relationship between biology and psychology, and how the human person interfaces with the world. These issues transcend politics, implicating anthropology, philosophy, and concepts of self. See Ryan T. Anderson & Robert P. George, Physical Interventions on the Bodies of Children to “Affirm” their “Gender Identity” Violate Sound Medical Ethics and Should Be Prohibited, PUB. DISCOURSE (Dec. 8, 2019), https:// www.thepublicdiscourse.com/2019/12/58839/ [https://perma.cc/5XSJ-M2K3]; O. CARTER SNEAD, WHAT IT MEANS TO BE HUMAN: THE CASE FOR THE BODY IN PUBLIC BIOETHICS (2020) (arguing, in part, that expressive individualism has created atomized wills separated from the body and resetting that mindset has enormous implications for public policy and bioethics). The 2024 Rule creates special rules for information about these politically favored procedures that implicate fundamental and hotly debated questions. Accordingly, it triggers the major-questions doctrine because HHS is regulating on a matter of great political significance.

Next, the 2024 Rule still triggers the third indicator because it “seeks to intrude into an area that is the particular domain of state law.” Mayfield, 117 F.4th at 616 (quoting West Virginia, 597 U.S. at 744 (Gorsuch, J., concurring)). “There is no question that state and local authorities possess considerable power to regulate public health.” Nat'l Fed'n of Indep, Bus., 595 U.S. at 121. The 2024 Rule does not directly regulate public health. But, as shown above, it does place limitations on the States' ability to regulate their public health regimes. And the 2024 Rule is designed to halt state-level “chill[ing]” of abortion and related procedures. 89 Fed. Reg. at 32978. But Dobbs returned the “issue of abortion” entirely to “the people and their elected representatives.” Dobbs, 597 U.S. at 292. And the “authority to regulate abortion” went back to “the people and their elected representatives,” too. Id. In another wording, the “question of abortion” is in the hands of “the people and their elected representatives.” Id. at 339 (Kavanaugh, J., concurring). Dobbs left no doubt: the regulatory realm of abortion lies no more with unrepresentative courts or agencies—it lies with the people. And when an agency tiptoes its way back into abortion-related matters, the major-questions doctrine demands it clearly show that “the people and their elected representatives” gave them unquestionable authority to do so. Id. at 292. Thus, the 2024 Rule “seeks to intrude” into an area Dobbs left in “the particular domain of state law” and representative democracy. Mayfield, 117 F.4th at 616.

Defendants attempt to frame the question differently. They claim the 2024 Rule is only about “private medical information.” ECF No. 40 at 35. The 2024 Rule itself defies such generality. It explicitly responded to the “changing legal landscape” Dobbs wrought. 89 Fed. Reg. at 32978. HHS explained Dobbs opened “far-reaching implications” for RHC that “increase[d] the likelihood that an individual's PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect.” Id. at 32978. HHS even worried Dobbs might dissuade women from seeking abortion-related providers, and it used HIPAA to shield against abortion-restrictive States. See supra, Background, § III. Because Dobbs could “chill an individual's willingness” to seek abortions or other contentious RHC, HHS promulgated the 2024 Rule. 89 Fed. Reg. at 32978. To protect abortion and other RHC procedures from state restrictions, HHS invoked HIPAA “to limit the circumstances in which provisions of the Privacy Rule permit the use or disclosure of an individual's PHI about” RHC. Id. As HHS acknowledges, the 2024 Rule exceeds being about “private medical information” alone. It inaugurates a new use for HIPAA: establishing special protection of information about politically preferred procedures.

iii. HHS Lacked a Clear Authority Statement from Congress.

Defendants fail to show HHS has clear congressional authority to use HIPAA in this new way. They consistently point to two provisions. First, 42 U.S.C. Section 1320d-2 note directs the Secretary to promulgate “standards with respect to․ [t]he uses and disclosures of [PHI] that should be authorized or required.” 42 U.S.C. Section 1320d-2 note. This authority pairs with Congress's permission to “review th[ose] standards” and “adopt modifications to the standards (including additions to the standards), as determined appropriate.” Id. § 1320d-3(b)(1). Second, the Secretary has general authority to “make and publish such rules and regulations ․ as may be necessary to the efficient administration of the functions with which [the Secretary] is charged under [HIPAA].” Id. § 1302(a). Defendants argue the “2024 Rule falls well within these authorities.” ECF No. 40 at 30.

These delegations epitomize the “cryptic,” “implicit,” and “oblique or elliptical” delegations disallowed under the major-questions doctrine. West Virginia, 597 U.S. at 721, 722, 723 (internal quotations omitted). The first provision does grant power to promulgate standards for the uses and disclosures of PHI. But the text does not confer authority to create differing standards for some PHI and not for others. The text permits the Secretary to promulgate standards concerning the “uses and disclosures of such information that should be authorized or required.” 42 U.S.C. § 1320d-2 note. “[S]uch information” refers to an earlier provision identifying it as “individually identifiable health information.” Id. This text does not distinguish between certain types of information. It only identifies one category of information the regulations may protect: “individually identifiable health information.” Id. Defendants read that to mean HHS is free to make distinctions between sorts of information. But the text cannot justify such distinctions.

Defendants protest that nothing forbids them from requiring higher protections for “highly sensitive forms of protected health information.” ECF No. 40 at 30. True enough. But that is not the test. Instead, Defendants must identify a “clear congressional authorization.” West Virginia, 597 U.S. at 723 (internal quotation omitted). They cannot. Because none appears in HIPAA's plain text. Yes, Defendants' proffered authority offers a “plausible textual basis” for distinguishing between types of protected health information. Id. (emphasis added). And if Defendants offered that authority to distinguish between types of health information in a way that did not trigger the major-questions doctrine, they may not have an authority problem. For example, HIPAA regulations have long protected a certain type of record, psychotherapy notes, at a higher level than routine health information. See ECF No. 40 at 31 (citing 89 Fed. Reg. at 32977–78, 32986–87). Yet that is the only example of heightened protections for some types of information but not others. Defendants cannot show the “history and breadth of the authority has ever been used to enact distinctions between information sourced from routine health procedures versus information sourced from politically favored health procedures. West Virginia, 597 U.S. at 721. HIPAA has no history of weaponization to achieve protections for politically favored medical procedures—psychotherapy notes notwithstanding.

The second provision fares no better because it is more general than the first. 42 U.S.C. § 1302(a). Thus, it presents the same problems for Defendants. It does not demonstrate a “clear congressional authorization” to harness HIPAA to protect information sourced from politically favored medical procedures.

* * *

In sum, HIPAA confers authority to promulgate regulations protecting “individually identifiable health information.” 42 U.S.C. § 1320d-2 note. But it confers no authority to distinguish between types of health information to accomplish political ends like protecting access to abortion and gender-transition procedures. Thus, HHS lacks the authority to issue regulations that enact heightened protections for information about politically favored procedures. “[T]he people and their elected representatives” remain free to enact their preferred protections for such procedures. Dobbs, 597 U.S. at 292. And HIPAA and its regulations cannot preempt any state laws that enact “more stringent” protections. See Pub. L. No. 104-191, § 264, 110 Stat. 1936, 2033–34 (1996).

But until the people speak through their representatives, agencies must fall silent on issues of abortion or other matters of great political significance. Thus, HHS lacked the authority to promulgate the 2024 Rule.

IV. Remaining Arguments

Plaintiffs raise other arguments challenging the 2024 Rule, including that it is arbitrary and capricious. However, the 2024 Rule imposes limits and unlawfully redefines terms contrary to law, and it regulates issues of great political significance that are traditionally left to the States without clear congressional authorization. Thus, the Court “does not consider the parties' remaining arguments regarding arbitrary and capricious rulemaking.” Tenn. Walking Horse Nat'l Celebration Ass'n v. U.S. Dep't of Agric., No. 2:24-CV-143, 2025 WL 360895, at *4 (N.D. Tex. Jan. 31, 2025) (citing Natl Ass'n of Priv. Fund Managers v. Sec. & Exch. Comm'n, No. 4:24-CV-250, 2024 WL 4858589, at *8 (N.D. Tex. Nov. 21, 2024)); see also Inhance Techs., L.L.C. v. EPA, 96 F.4th 888, 893 (5th Cir. 2024) (“[Plaintiff] makes several other arguments for why we should vacate the [agency action]. Because we agree that the [agency] exceeded its statutory authority․ we do not reach those arguments.”). Judicial restraint counsels, “if it is not necessary to decide more, it is necessary not to decide more.” PDK Lab'ys Inc. v. U.S. Drug Enf't Agency, 362 F.3d 786, 799 (D.C. Cir. 2004) (Roberts, J., concurring in part and in the judgment).

V. Vacatur Is the Appropriate Remedy

Judicial restraint is germane when considering the appropriate relief as well. Defendants argue “vacatur of the Rule would be improper.” ECF No. 70 at 9. First, they claim vacatur is not “required” to remedy an APA violation. Id. Second, they assert vacatur is not always universal, but instead, a court may vacate only as to Plaintiffs. Id. at 10.Third, they argue if “party-specific” remedies can provide full relief, then “any broader relief would contradict constitutional and equitable limitations on this Court's remedial authority.” Id. at 10–11. Fourth, they argue that vacating the 2024 Rule would hinder review in other courts. Id. at 12. Fifth, they remind the Court of the remand-without-vacatur remedy. Id. at 12–13. And finally, Defendants contend more-limited injunctive relief would salve Plaintiffs' harms arising from the 2024 Rule's limits on state law reporting requirements. Id. at 13.

But Defendants' arguments fail in light of the Fifth Circuit's clear stance on the default remedy for unlawful agency actions challenged under the APA. To be sure, the Supreme Court “will have to address” the “serious questions” about vacatur and universal injunctions. United States v. Texas, 599 U.S. 670, 686, 701–02 (Gorsuch, Thomas & Barrett, JJ., concurring) (whether the APA authorizes vacatur is not “open and shut” with “[t]houghtful arguments and scholarship” on both sides). The Supreme Court may issue an opinion clarifying the proper scope of injunctive relief, though likely not the scope of vacatur. See Trump v. CASA, Inc., No. 24A884 (U.S. argued May 15, 2025).

But for now, Fifth Circuit precedents govern this Court. The Fifth Circuit has consistently held that “vacatur under [Section] 706(2) [is] a remedy that affects individuals beyond those who are parties to the immediate dispute.” Braidwood Mgmt., Inc. v. Becerra, 104 F.4th 930, 951 (5th Cir. 2024), cert. granted, No. 24-316, 2025 WL 65913 (U.S. Jan. 10, 2025), and cert. denied sub nom. Braidwood MGMT. Inc. v. Becerra, No. 24-475, 2025 WL 76462 (U.S. Jan. 13, 2025). Vacatur “empowers courts to set aside—i.e., formally nullify and revoke—an unlawful agency action.” Data Mktg. P'ship, LP v. U.S. Dep't of Lab., 45 F.4th 846, 859 (5th Cir. 2022) (quoting Jonathan F. Mitchell, The Writ-of-Erasure Fallacy, 104 VA. L. REV. 933, 950 (2018)). And it operates nationwide because it “operates on the status of agency action in the abstract.” Braidwood, 104 F.4th at 951. That contrasts with an injunction, “which operates in personam.” Id. The Fifth Circuit “repeatedly described” vacatur as the default “remedy for unlawful agency action.” Id. at 952 (citing cases). It does not require consideration of the equities because it is not “a remedy familiar to courts sitting in equity.” Id.; see also id. (“[W]e do not read our precedent to require consideration of the various equities at stake before determining whether a party is entitled to vacatur.”). Because the “default rule is that vacatur is the appropriate remedy,” this Court finds no reason to depart from longstanding Fifth Circuit precedent. Data Mktg., 45 F.4th at 859.

Defendants' arguments are unconvincing.

First, while vacatur is not always required to remedy an APA violation, it is the “default” remedy. Braidwood, 104 F.4th at 252 (internal quotation omitted). Thus, the burden falls on Defendants to demonstrate why alternative remedies are more appropriate. Defendants highlight Cargill v. Garland, but it does not hold that vacatur is not the default remedy. 57 F.4th 447 (5th Cir. 2023). Cargill instead underscored vacatur is the default remedy. 57 F.4th at 472 (“[V]acatur of an agency action is the default rule in this Circuit.”). Rather, Cargill only remanded to the district court to determine the appropriate remedy because there had been no briefing on the issue. Id. Vacatur is not always required but is typically imposed.

Second, vacatur is universal in scope, no matter Defendants' view. Braidwood explicitly holds it is. See 57 F.4th at 952. Vacatur “has nationwide effect, is not party-restricted, and affects persons in all judicial districts equally.” Id. (internal quotations omitted). Defendants muster only Texas v. United States to argue otherwise. 126 F.4th 392 (5th Cir. 2025). But Texas v. United States adjudicated a nationwide injunction and discussed universality issues related thereto—not vacatur. See id. at 420–22. It only curtailed the vacatur's effectiveness because it limited the scope of injunctive relief. Id. at 422. Nowhere does it state that “vacatur․ may properly be tailored to redress only a plaintiffs particular injuries.” ECF No. 70 at 10.

Third, Defendants' concerns that vacatur “would contradict constitutional and equitable limitations on this Court's remedial authority” may have generalized theoretical purchase, but they fail in light of Fifth Circuit precedent. As shown, the Fifth Circuit views vacatur as operating “on the status of agency action in the abstract.” Braidwood, 104 F.4th at 951. Further, it is not “a remedy familiar to courts sitting in equity,” so it is not subject to many of the typical equitable constraints. Id. at 952. Vacatur has “potency and [is] particularly broad.” Id. It is not the same as injunctive relief and thus implicates fewer of the constitutional concerns universal injunctive relief implicates. Until the Supreme Court holds otherwise, the Court must faithfully apply binding Fifth Circuit precedent.

Fourth, vacatur would not necessarily prevent review in other courts. Courts can and do continue to review agency action despite another court's vacatur. And even if they did not, the Court should not raise “basic principles of comity” above particularized and binding Fifth Circuit precedent. ECF No. 70 at 12. Rather, whether vacatur should be permitted to “trench” upon other courts' review is yet another issue the Supreme Court has yet to resolve. Id.; see also United States v. Texas, 599 U.S. at 702–03 (arguing, in part, that vacatur's potential to “stymie the orderly review of important questions” is a question the Supreme “Court will have to address․ sooner or later”). This Court is not cold to Defendants' concerns. But it need not, and should not, venture into uncharted legal territory and promulgate new law that implements Defendants' theoretical arguments when the Supreme Court is currently deciding similar issues and when binding Fifth Circuit precedent already provides the answer.

Fifth, Defendants claim the Court should consider remand without vacatur. Again, “[v]acatur is the default remedy for violations under [Section] 706(2).” Texas v. United States, 126 F.4th at 418. “Remand without vacatur is limited to ‘rare cases.’ ” Id. (quoting Chamber of Com. v. Sec. Exch. Comm'n, 88 F.4th 1115, 1118 (5th Cir. 2023)). To justify remand without vacatur, two conditions must be met. “First, there must be a ‘serious possibility’ that the agency will be able to correct the rule's defects on remand,” and second, “vacating the challenged action would produce ‘disruptive consequences.’ ” Chamber of Com., 88 F.4th at 1118 (quoting Texas v. United States, 50 F.4th 498, 529 (5th Cir. 2022)). The remedy is not available when an unlawful agency action “suffers from a fundamental substantive defect that the [agency] could not rectify on remand.” Texas v. United States, 126 F.4th at 418 (quoting Rest. L. Ctr. v. U.S. Dep't of Lab., 120 F.4th 163, 177 (5th Cir. 2024)).

Here, it is inappropriate. As shown, the 2024 Rule is unlawful under the APA in several ways. Defendants do “not address how [they] would correct any of the Rule's defects on remand.” Id. at 419. But it is far from clear how Defendants could alleviate the 2024 Rule's substantial unlawfulness even if this Court did remand. Instead, remand without vacatur is best suited for when “there is at least a serious possibility that the agency will be able to substantiate its decision given an opportunity to do so.” Texas v. United States, 50 F.4th at 529 (quoting Tex. Ass'n of Mfrs. v. U.S. Consumer Prod. Safety Comm'n, 989 F.3d 368, 389–90 (5th Cir. 2021)). Often, remand without vacatur makes the most sense if the agency action is unlawful under arbitrary-and-capricious review because failures under that standard may relate to an agency's insufficient explanations and substantiations. It makes less sense when a final agency action is unlawful because it is contrary to law or in excess of statutory authority. Unless Defendants could fundamentally alter how the 2024 Rule functioned, remand without vacatur is ineffectual. The Court cannot envision how remand would aid the 2024 Rule's unlawfulness, and Defendants offer no way they would correct the 2024 Rule should it be remanded.

Further, far more disruption existed in Texas v. United States than here, and the Fifth Circuit still found remand without vacatur inappropriate. 50 F.4th at 530 (explaining the potential disruptive effects of holding DACA unlawful but recognizing the district court's stay of its vacatur helped alleviate some of them). For vacatur's disruptive effects, Defendants only highlight that some regulated entities “may wish to continue operating under the Rule” and they would have to “unwind” some policy and practice changes. ECF No. 70 at 13. Such mild disruptions to wishes and compliance-oriented policy changes do not satisfy the second factor for remand without vacatur. Thus, remand without vacatur is inappropriate because Defendants do not satisfy either factor to attain this “rare” remedy. Texas v. United States, 126 F.4th at 418 (internal quotation omitted).

Finally, Defendants suggest “less burdensome remedies.” ECF No. 70 at 13. They contend Plaintiffs' injuries are limited to a “particular context,” where state reporting laws and the 2024 Rule collide. Id. And they prefer the Court craft an injunction limited to those scenarios. But, as discussed, Plaintiffs' injuries extend further than a state-federal conflict. And the 2024 Rule is unlawful in more ways than just the unlawful limits placed on state reporting laws. Vacatur is the “default” remedy, and it “operates on the status of agency action in the abstract.” Braidwood, 104 F.4th at 951, 952. This agency action is unlawful. Defendants present no compelling reasons to deviate from Fifth Circuit precedent on vacatur.

VI. Severability

Defendants argue if vacatur is the appropriate remedy, the Court should sever and preserve the 2024 Rule's lawful provisions. A two-prong test guides whether some portions of an agency action may remain. First, “[w]hether the offending portion[s] of a regulation [are] severable depends upon the intent of the agency.” Texas v. United States, 126 F.4th 392, 419 (5th Cir. 2025) (alterations in original) (quoting MD/DC/DE Broads. Ass'n v. FCC, 236 F.3d 13, 22 (D.C. Cir. 2001)). Second, a court must evaluate “whether the remainder of the regulation could function sensibly without the stricken provision[s].” Id. (alteration in original) (quoting MD/DC/DE Broads. Ass'n, 236 F.3d at 22). A court should adhere to a severability clause in the absence of extraordinary circumstances. Id.

The 2024 Rule has a severability clause. It states if “any provision of [the 2024 Rule] is held to be invalid or unenforceable ․ the provision shall be severable from this part and shall not affect the remainder thereof.” 89 Fed. Reg. at 33066. HHS elsewhere reaffirmed it intended the provisions of the 2024 Rule not held unlawful should remain. See id. at 33048. Defendants highlight one portion of the 2024 Rule HHS intended to remain. The 2024 Rule implemented modifications to the Notice of Privacy Practices regulations to reflect changes Section 3221(i) of the Coronavirus Aid, Relief, and Economic Security Act required. Pub. L. No. 116-136, 134 Stat. 281 (Mar. 27, 2020); see also Confidentiality of Substance Use Disorder (SUD) Patient Records, 87 Fed. Reg. 74216 (Dec. 2, 2022). HHS specifically intended these provisions to sever if other provisions of the 2024 Rule are held unlawful. See 89 Fed. Reg. at 33048 (“[T]he changes this final rule makes to the NPP requirements in 45 CFR 164.520 ․ shall remain in full force and effect to the extent that they are not directly related to a provision in this rulemaking that is held to be invalid or unenforceable such that notice of that provision is no longer necessary.”).

Plaintiffs agree. They note they have challenged every substantive portion of the 2024 Rule because the “entire 2024 Rule focuses on special rules” for RHC. ECF No. 91 at 20. And indeed, the five substantive portions that the 2024 Rule adds to the Code of Federal Regulations all implement the 2024 Rule's special, heightened protections for RHC that HHS lacked the authority to promulgate. See, e.g., ECF No. 91 at 20–21; see also 89 Fed. Reg. at 33062-64. But Plaintiffs recognize HHS intended the portions of the 2024 Rule modifying the Notice of Privacy Practices requirement to be severable and that they “derived from a separate proposed rule addressing substance-use-disorder records.” Id. at 22. Thus, “Plaintiffs would not object to final judgment severing these changes to § 164.520—and only these changes—while vacating the rest of the 2024 Rule.” Id. at 23.

But some provisions modifying the Notice of Privacy Practices directly implement unlawful provisions of the 2024 Rule. HHS did not intend for these provisions to remain because they are “directly related to a provision in this rulemaking that is held to be invalid or unenforceable, such that notice of that provision is no longer necessary.” 89 Fed. Reg. at 33048. These modifications to the Notice of Privacy Practices appear, by Plaintiffs' and the Court's best reading, in Code of Federal Regulations Section 164.520(b)(1)(ii)(F), (G), and (H) as shown at 89 Fed. Reg. 33065. Each of these paragraphs implements provisions of the 2024 Rule that are unlawful, “such that notice of the provision is no longer necessary.” 89 Fed. Reg. at 33048. The remainder of the changes to Section 164.520 in 89 Fed. Reg. 32976 are not “directly related” to the 2024 Rule's unlawful provisions. 89 Fed. Reg. at 33048. Thus, HHS intended them to sever.

These remaining modifications could function sensibly without the remainder of the 2024 Rule. There is “no indication” otherwise. Tenn. Walking Horse Nat'l Celebration Ass'n v. U.S. Dep't of Agric., 765 F. Supp. 3d 534, 552 (N.D. Tex. 2025). Regulated entities could implement these changes to their Notices of Privacy Practices without including the provisions that directly relate to the 2024 Rule's unlawful parts. These new requirements even have a different compliance deadline. See 89 Fed. Reg. at 32976. Thus, they meet both elements of the severability standard. Neither party highlights other provisions of the 2024 Rule that do not relate to the unlawful elements of the 2024 Rule and thus deserve to be severed.

Accordingly, 45 C.F.R. Section 164.520 is severed and not vacated except 45 C.F.R. Section 164.520(b)(1)(ii)(F), (G), and (H), which are vacated because HHS did not intend they remain.

CONCLUSION

Plaintiffs' Motion is GRANTED. Defendants' Motion is DENIED as moot. The 2024 Rule's modifications to 45 C.F.R. parts 160 and 164 as promulgated and explained at 89 Fed. Reg. 32976–33066 are VACATED. The modifications to 45 C.F.R. Section 164.520 are severed and shall stand. But 45 C.F.R. Section 164.520(b)(1)(ii)(F), (G), and (H) are VACATED.

SO ORDERED.

FOOTNOTES

1.   See DEP'T OF HEALTH & HUM. SERVS., MARKING THE 50TH ANNIVERSARY OF ROE: BlDEN-HARRIS Administration Efforts to Protect Reproductive Health Care 3 (2023), https://perma.cc/ NMH4-656E; HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care, DEP'T OF HEALTH & HUM. SERVS. (June 29, 2022), https://perma.cc/UT87-BWNU. Following the change in presidential administration, these pages are no longer available on HHS's sites.

MATTHEW J. KACSMARYK UNITED STATES DISTRICT JUDGE