Judge Repeals Abortion Privacy Protections
The Biden-era HIPAA expansion was just struck down by Judge Matthew Kacsmaryk
Remember just last week when I warned we were about to see a major push toward criminalization? Well, here we are: A federal judge has struck down major abortion privacy protections—repealing a rule that prevented health care providers and insurers from sharing reproductive health information with law enforcement.
U.S. District Judge Matthew Kacsmaryk—the anti-abortion asshole who tried to kill access to mifepristone in 2023—ruled yesterday that the Department of Health and Human Services under Biden overstepped when they expanded HIPAA to shield abortion patients’ records.
“HHS lacked clear delegated authority to fashion special protections for medical information produced by politically favored medical procedures,” Kacsmaryk wrote. Politically favored medical procedures??
I’m struck by how little coverage there’s been of this story, because it’s a big fucking deal. The privacy rule was adopted after the end of Roe to stop zealous prosecutors from digging into the private medical records of abortion patients—especially those who left their anti-choice state for care.
For example, if a Texas woman travels to New Mexico for an abortion, the rule would prevent her doctors from sharing her identity or health records with law enforcement (or bounty-hunting anti-abortion activists). That’s important! Because while conservative politicians say they have no interest in targeting abortion patients, their actions say otherwise.
In 2023, Abortion, Every Day reported that 19 Republican attorneys general were pressuring HHS to give them access to the medical records of women who got out-of-state abortions. And in 2024, Texas Attorney General Ken Paxton sued the Biden administration over the HIPAA expansion, claiming it “would unlawfully restrict state law enforcement investigations.” (Today’s ruling stems from a separate suit.)
And we can’t forget this: When Trump took office, his administration quietly started scrubbing information about the privacy rule from government websites! That was a pretty clear signal that the White House planned to roll back the protections, or wait for a judge like Kacsmaryk to do it for them.
Now, to be clear: This ruling doesn’t mean abortion patients have no HIPAA protections. They do. And obviously, we don’t want women avoiding medical care out of fear that their data will be shared. But we still have to be clear-eyed about what’s happening here. Because even under HIPAA, patient privacy isn’t entirely safe—especially in a post-Roe world.
Providers and insurers can still disclose private medical information if there’s a criminal investigation. Sometimes providers will even share that information without a subpoena or court order because they’re afraid, or don’t realize they can say no to law enforcement. Worst of all, some healthcare professionals will turn patients in over their pregnancy outcomes in spite of HIPAA, because of their own biases or politics.
All of which is to say—this rule meant something. It gave healthcare providers and insurers clear guidance and legal grounds to refuse law enforcement requests for private records.
But the anti-abortion movement needs this kind of data in order to punish women: Just ask Indiana AG Todd Rokita, who’s been fighting to make women’s abortion reports public records—or the Republicans pushing new ‘reporting’ laws that force doctors to interrogate patients about why they ended a pregnancy. Data collection and the erosion of medical privacy are a central part of conservative strategy.
Of course, they’ll never admit that. Instead, GOP leaders and legislators insist they’re trying to protect women, and that they need abortion records in order to prosecute rape or abuse cases.
That argument falls apart once you see the kind of data they’re actually after: Republican attorneys general aren’t making narrow, case-specific requests tied to a particular crime; more often, they’re going on political fishing expeditions.
Remember what happened with Vanderbilt University Medical Center? Tennessee AG Jonathan Skrmetti made broad demands for records under the guise of investigating billing fraud. The hospital responded by turning over the private medical records of more than 100 patients.
How long do you think it’ll be before Missouri’s attorney general uses ‘trafficking’ as a pretext to demand that Illinois clinics hand over every record of a patient under 18? I give it under a year.
I’ll have more on this ruling and what it means tomorrow. In the meantime, catch up on conservatives’ war on privacy and data by reading past coverage from Abortion, Every Day:
I knew it was kazmaryk before the story loaded. What an asshole.
I thought SCOTUS ruled that judge shopping was not allowed. There was some discussion around limiting or ending judge shopping. Is there any update that you're aware of on that topic? I just ask because obviously it's gonna be this guy if they have their choice!