American Hospital Association v. Becerra

UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF TEXAS

FORT WORTH DIVISION

AMERICAN HOSPITAL ASSOCIATION,

ET AL.,

Plaintiffs,

v. No. 4:23-cv-01110-P

XAVIER BECERRA, ET AL.,

Defendants.

OPINION & ORDER

Before the Court are cross-motions for summary judgment. ECF Nos.

24, 50. Having considered the motions, briefs, and applicable law, the

Court GRANTS in part and DENIES in part Plaintiffs’ motion (ECF

No. 24) and DENIES Defendants’ motion (ECF No. 50).

BACKGROUND

Congress passed the Health Insurance Portability and

Accountability Act (“HIPAA”) in 1996 because health information

needed more protections and the world needed more acronyms. HIPAA

seeks to “assure that individuals’ health information is properly

protected” while “allowing the flow of health information needed to

provide and promote high quality healthcare.” The Department of

Health and Human Services (“HHS”) enforces this mandate. Violations

are reported to HHS’s Office for Civil Rights (“OCR”), who investigates

reports and recommends corrective action. This case involves HIPAA’s

confidentiality protections (the “Privacy Rule”) for “protected health

information” (“PHI”). More specifically, the case concerns the Rule’s

applicability to one subset of PHI: “individually identifiable health

information” (“IIHI”). HIPAA defines IIHI as information that (1)

“relates to” an individual’s healthcare and (2) “identifies the individual”

or provides “a reasonable basis to believe that the information can be

used to identify the individual.”

Like many decades-old definitions, the Act’s definition of IIHI has

evolved awkwardly with the times. A lot has changed between 1996 and

2024. In 1996, an American with health concerns would likely consult a

library or other repository for things called “books,” which would contain

information potentially relevant to their condition. Thereafter, the

individual would consult something called the “Yellowpages,” which was

a book that listed phone numbers for local clinicians. They would then

call nearby clinics and speak with a human being to inquire about

availability. After a trial-and-error process, the individual would

squeeze in a visit for the (hopefully) near future. Twenty percent of the

population had internet, so those fortunate few could scour the nascent

digital landscape for this information and cut down on required steps.

For the rest, this process could take several days.

Today, an American with health concerns will reach in their pocket,

grab a phone, and with the click of a button connect themselves to more

information than an American in 1996 could access in a lifetime. Based

on their query, algorithms will autopopulate the most relevant resources

first, which an “AI overview” will conveniently distill. After reviewing

WebMD, the individual will ill-advisedly self-diagnose and search for

nearby providers. Based on their location, a list of nearby clinics will

appear, categorized by projected wait time. For the ninety-six percent of

Americans with internet, this process will take roughly ten minutes.

Differences between 1996 and today are further seen in the patients’

clinic experience. For one, folks in 1996 would drive to a physical

location to speak with a healthcare provider; today we just schedule a

telemedicine appointment. And in 1996, the patient’s intake paperwork

and clinician notes would be transcribed on paper and stored in a

Hollinger box, or perhaps transferred to a CD or floppy disk. Most

patients today will fill out a digital intake form, which will be

incorporated with clinician notes in “electronic patient records” (“EPRs”)

maintained in the Cloud or in auxiliary servers/data centers.

By aggregating and storing EPRs digitally, healthcare providers can

securely maintain troves of PHI, most of which can be “de-identified” to

protect patients’ identities. They can then share such data with

technology vendors and other third parties, gaining valuable data-

analytics insights and facilitating better cross-platform collaboration.

HIPAA provides robust protections for PHI in this context, including the

Privacy Rule, along with the Security Rule (requiring “reasonable and

appropriate” administrative safeguards), required SSL encryption,

obligatory Business Associate Agreements (“BAAs”) for outside

providers, and a host of other obligations. Subject to certain restrictions,

providers can provide information that is not IIHI on “unauthenticated

public webpages” (“UPWs”)—websites that don’t require login

credentials or user verification. In doing so, healthcare providers

increase the public’s access to important health-related information.

While the benefits abound, this trend is not without drawbacks. In

recent years, the OCR has received a surge of complaints from citizens

concerned that UPWs might disclose their IIHI. For instance, say a

provider utilizes third-party technology vendors for its UPW. Many

vendors use a page visitor’s IP address to create a more bespoke user

experience (e.g., using user location/maps to populate a menu of nearby

providers or suggest clinics with lower wait times). Every click of the

mouse or swipe of the phone thus increases the relevance of information

the UPW provides. In theory, a third party could connect the dots

between a person’s IP address and the searches performed: if an IP

address corresponds to Person A, and Person A looks up symptoms of

Condition B, one might conclude Person A has Condition B.

IIHI’s broad definition seemed sufficiently malleable to progress with

the times, giving providers a clear rubric for information that can and

can’t be shared. Indeed, inferences aside, the above scenario would never

reveal that Person A affirmatively had Condition B. But HHS thought

otherwise. Accordingly, in 2022, the Department gave the definition a

clandestine facelift. In December of that year, HHS issued a guidance

document (the “Original Bulletin”) to address potential privacy

concerns. Like most guidance documents, the Original Bulletin

reminded covered entities of their obligation to protect IIHI. But it did

more than that, too. In particular, the Original Bulletin appeared to

shoehorn additional information into the IIHI definition. The Original

Bulletin provided several hypotheticals that trigger HIPAA obligations,

including circumstances where an online technology connects (1) an

individual’s IP address with (2) a visit to a UPW addressing specific

health conditions or healthcare providers. HHS says this new rule (the

“Proscribed Combination”) was an example to highlight privacy

concerns; covered entities saw it as an entirely new obligation.

The Plaintiffs here (collectively, “the Hospitals”) are two hospital

associations and a regional healthcare system. Facing new obligations

under the Proscribed Combination, the Hospitals sued to stop

enforcement of the rule.1 As the case boils down to pure questions of law,

both Parties moved for summary judgment. Days before its brief was

due, HHS issued a new guidance document (the “Revised Bulletin”). The

Revised Bulletin softened language from the Original and noted that it

“do[es] not have the force and effect of law” and isn’t “meant to bind the

public in any way.” The Revised Bulletin further suggests the IIHI test

is subjective. That is, the Revised Bulletin insinuates that information

can become IIHI if the individual’s reason for visiting a UPW relates to

their personal healthcare (irrespective of the fact that such information

is unknowable unless a UPW seeks it).

Changes aside, the Revised Bulletin did not change the salient legal

questions. The Hospitals say summary judgment is warranted here

because (1) HHS exceeded its authority in promulgating the Bulletins

and (2) HHS violated the Administrative Procedure Act (“APA”) in doing

so. HHS sees things differently. As a preliminary matter, HHS says the

Court lacks jurisdiction because the Bulletins are not a “final agency

action” subject to judicial review. Even if the Court has jurisdiction,

HHS says the Hospitals’ claim fails on the merits because (1) the

Revised Bulletin is consistent with HIPAA’s definition of IIHI, (2) the

Revised Bulletin is not “arbitrary and capricious” under the APA, and

(3) HHS was authorized to issue the Revised Bulletin and did so with

procedural propriety. Having reviewed the briefs and submissions from

multiple amici, the Court agrees with the Hospitals that the Bulletins

improperly create substantive legal obligations for covered entities.

1The Complaint names three Defendants: the United States of America,

Melanie Fontes Rainer (OCR Director), and Xavier Becerra (HHS Secretary).

See ECF No. 1 at 1. The Court collectively calls them “HHS” or “the

Department” because that’s the most relevant executive entity.

LEGAL STANDARD

Summary judgment is proper where “there is no genuine dispute as

to any material fact and the movant is entitled to judgment as a matter

of law.” FED. R. CIV. P. 56(a). A dispute is “genuine” if, based on the

evidence, “a reasonable jury could return a verdict for the nonmoving

party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A fact

is “material” if it would affect a case’s outcome. Id. Generally, the

“substantive law will identify which facts are material” and “[f]actual

disputes that are irrelevant or unnecessary will not be counted.” Id. In

assessing if summary judgment is warranted, the Court “view[s] all

evidence in the light most favorable to the nonmoving party and draw[s]

all reasonable inferences in that party’s favor.” Cunningham v. Circle 8

Crane Servs., LLC, 64 F.4th 597, 600 (5th Cir. 2023).

While the Court may consider any evidence of record, it need only

consider materials cited by the parties. FED. R. CIV. P. 56(c)(1)–(3); see

generally Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986) (noting

summary judgment is proper “if the pleadings, depositions, answers to

interrogatories, and admissions on file, together with the affidavits, if

any, show that there is no genuine issue as to any material fact and that

the moving party is entitled to judgment as a matter of law”). But the

Court need not mine the record for evidence supporting the nonmovant;

the burden falls on the movant to simply show a lack of evidence

supporting the nonmovant’s case. See Malacara v. Garber, 353 F.3d 393,

404–05 (5th Cir. 2003). In this regard, “[s]ummary judgment is

appropriate when ‘the nonmoving party has failed to make a sufficient

showing on an essential element of her case with respect to which she

has the burden of proof.’” Edwards v. Oliver, 31 F.4th 925, 929 (5th Cir.

2022) (quoting Celotex, 477 U.S. at 323).

ANALYSIS

As noted, the Parties contest HHS’s authority to promulgate the

Bulletins and the procedural propriety with which it did. See ECF Nos.

51, 60. But HHS also contests the Court’s jurisdiction. See ECF No. 51

at 25. The Court addresses the jurisdictional challenge first, as “courts

must assess their jurisdiction before turning to the merits.” United

States v. Rodriguez, 33 F.4th 807, 811 (5th Cir. 2022). As explained

below, the Court has jurisdiction over the Hospitals’ challenge.

A. The Court has jurisdiction over the Hospitals’ claim.

HHS says the Court lacks jurisdiction because the Bulletins were not

a “final agency action.”2 See ECF No. 51 at 25. If true, the APA’s judicial-

review provisions don’t apply. See 5 U.S.C. § 704. If Section 704 doesn’t

apply, the Court lacks jurisdiction over the Hospitals’ APA claim. See

Lujan v. Nat’l Wildlife Fed’n, 497 U.S. 871, 882 (1990); Apter v. HHS, 80

F.4th 579, 593 (5th Cir. 2023). While the Court would still have

jurisdiction over the Hospitals’ non-APA claims, see Apter, 80 F.4th at

591, it would be unable to consider their APA arguments. This so-called

“finality requirement” is the hallmark of federal-jurisdiction precedents

under the APA. See U.S. Army Corps of Eng’rs v. Hawkes Co., Inc., 578

U.S. 590, 591 (2016).

The APA has a “basic presumption of judicial review” for “one

‘suffering legal wrong because of agency action.’” Abbott Laby’s v.

Gardner, 387 U.S. 136, 140 (1967) (quoting 5 U.S.C. § 702), abrogated

on other grounds by Califano v. Sanders, 430 U.S. 99 (1977). The APA

defines “agency” as “each authority of the Government of the United

States,” 5 U.S.C. § 551(1), and “agency action” as “the whole or a part of

any agency rule, order, license, sanction, relief, or the equivalent or

denial thereof, or failure to act.” Id. § 551(13). But what is a final agency

action? Federal courts take a “pragmatic approach” to this question,

viewing the finality requirement as inherently “flexible.” Texas v.

EEOC, 933 F.3d 433, 441 (5th Cir. 2019). At base, a final agency action

must create “rights, obligations, or legal consequences,” and those

2Notably, HHS’s arguments solely concern the APA. The Hospitals counter

by arguing “even if the APA were unavailable, this Court at least has the power

to grant injunctive and declaratory relief against HHS for exceeding its

authority under HIPAA.” ECF No. 60 at 15. That opened a can of worms, with

HHS submitting over a half-dozen briefing pages on the appropriate taxonomy

for the Hospitals’ non-APA claims. See ECF No. 51 at 31 (“Plaintiffs cannot

avoid the finality requirement by recasting a garden-variety APA claim as a

non-statutory equitable claim.”); id. at 34 (contending Plaintiffs try to “cast a

plain-vanilla APA claim in the guise of an implied equitable ultra vires claim”).

These arguments ultimately lack bearing for the Court’s analysis, as the Court

has jurisdiction under both the APA and Art. III.

rights/obligations/consequences “must be new.” State v. Rettig, 987 F.3d

518, 529 (5th Cir. 2021) (citations omitted). Courts use a two-part test

to make this call, asking if the challenged action (1) represents “the

consummation of the agency’s decision-making process” and (2)

determines “rights or obligations” for those subject to it. See Bennett v.

Spear, 520 U.S. 154, 178 (1997) (cleaned up).

Here, HHS says the Revised Bulletin “satisfies neither requirement.”

ECF No. 51 at 25. For the first, HHS contends the Revised Bulletin “does

not establish the agency’s final position with respect to any concrete

[HIPAA] requirement.” Id. For the second, HHS argues the Revised

Bulletin “lacks any independent force of law, as it explicitly states that

it is non-binding and any legal consequences would only result after an

administrative proceeding subject to judicial review.” Id. The Hospitals

disagree. On the first point, the Hospitals argue the Revised Bulletin

articulates HHS’s position on an ostensibly new class of IIHI. See ECF

No. 60 at 18. On the second, the Hospitals argue the Revised Bulletin

creates new substantive legal requirements on its face. Id. at 19–22. The

Hospitals persuade.

1. The Proscribed Combination is the consummation of HHS

decision-making.

Relying on its eve-of-brief Revised Bulletin, HHS doesn’t brief

finality for the Original Bulletin. See ECF No. 51 at 25. The Hospitals

say that’s because HHS “cannot meaningfully dispute that the Original

Bulletin was final agency action when this suit was filed.” ECF No. 60

at 16. They’re probably right, but be that as it may, the Revised Bulletin

is the legally operative document. In any event, both Bulletins

consummated HHS decision-making with respect to the Proscribed

Combination.3 An action consummates agency decision-making where it

is not “merely tentative or interlocutory.” Bennett, 520 U.S. at 177–78.

In such circumstances, the action determines the “rights and

3At times the briefs conflate the Revised Bulletin as a whole with the

Proscribed Combination as a subpart therein. This distinction is meaningful.

The Revised Bulletin contains an array of guidance for covered entities, much

of which is both legally and pragmatically sound. The Court’s analysis concerns

only the Proscribed Combination and the Revised Bulletin’s attempt to apply

HIPAA obligations to this ostensibly new IIHI context.

obligations” of covered entities and creates conditions from which “legal

consequences could flow.” La. State v. U.S. Army Corps of Eng’rs, 834

F.3d 574, 579 (5th Cir. 2016). That’s because the agency has asserted its

“final position on the factual circumstances underpinning the Agency’s

orders.” Ak. Dept. of Envt’l Conservation v. EPA, 540 U.S. 461, 483

(2004) (cleaned up).

Here, HHS says the Revised Bulletin does not articulate the

Department’s position “with respect to any concrete circumstances.”

ECF No. 51 at 25. The Court is unsure how HHS reached that

conclusion. As the Hospitals rightly note, the Revised Bulletin clearly

articulates the Department’s position regarding PHI in certain contexts,

including the Proscribed Combination:

The Revised Bulletin’s tweak to the Original Bulletin is

still a definitive position and effectively the same one. As

discussed, the Revised Bulletin retains its rule against the

Proscribed Combination, adding only a subjective-intent

gloss that is immaterial for purposes of APA finality. More

specifically, the Revised Bulletin states that “the mere fact

that an online tracking technology connects the IP address

of a user’s device (or other identifying information) with a

visit to a webpage addressing specific health conditions or

listing health care providers is . . . a sufficient combination

of information to constitute IIHI if the visit to the webpage

is . . . related to’ the individual’s own health. AR 4

(emphasis added; double negative omitted).

ECF No. 60 at 18 (quoting ECF No. 49, Administrative Record (“AR”),

at 4). HHS attempts to characterize the document as a “policy

statement” that simply informs covered entities how HHS will “exercise

a discretionary power.” ECF No. 51 at 51. But whether the Department

chooses to enforce its position, the wording of the Revised Bulletin

“adopts a definitive interpretation of the IIHI definition that governs the

scope of covered entities’ duties.” ECF No. 60 at 54; see generally AR at

4–6. And the words of the Revised Bulletin control, not the Department’s

post hoc rationalizations in its defense.

The Department further argues the Revised Bulletin does not

consummate HHS decision-making because it is subject to judicial

review. See ECF No. 51 at 25. True, the availability of judicial review

suggests a challenged action was not truly “final” for APA purposes. See

Ak. Dep’t of Envt’l Conservation, 540 U.S. at 483. But HIPAA does not

provide for judicial review of one-off guidance documents like the

Revised Bulletin. Rather, what the Department actually notes is that

“any legal consequences” from violations would “result after an

administrative proceeding subject to judicial review.” ECF No. 51 at 25.

Case law has long rejected the argument that an action is judicially

reviewable merely because subsequent enforcement proceedings would

be. See, e.g., Sackett v. EPA, 566 U.S. 120, 127 (2012) (rejecting identical

argument where “future enforcement proceeding” was subject to judicial

review but the contested provisions “were not subject to further Agency

review” themselves). Most enforcement actions are judicially

reviewable. See id. Thus, if accepted, the Department’s argument would

foreclose APA review for the most egregious executive oversteps until

after penalties were imposed. The Supreme Court’s APA precedents

have rejected that argument time and time again. See, e.g., Hawkes Co.,

578 U.S. at 600 (internal quotation marks and citation omitted) (“As we

have long held, parties need not await enforcement proceedings before

challenging final agency action where such proceedings carry the risk of

serious criminal and civil penalties.”).

In a last-ditch effort to evade review, HHS argues the Revised

Bulletin “is not sufficiently concrete to constitute the consummation of

the agency’s decisionmaking.” ECF No. 51 at 27. The Court agrees the

Revised Bulletin lacks critical detail for HIPAA-covered entities. But

numerous cases have held that guidance documents can’t escape review

merely because they’re poorly written. For all its shortcomings, the

Revised Bulletin unambiguously states the Department’s stance vis-à-

vis the Proscribed Combination as IIHI. See AR at 4–6. And even if

subsequent enforcement actions would be judicially reviewable, the

Hospitals “need not assume such risks while waiting for [HHS] to ‘drop

the hammer’ in order to have their day in court.” Hawkes Co., 578 U.S.

at 600 (quoting Sackett, 566 U.S. at 127). Having found the Revised

Bulletin consummates HHS decision-making vis-à-vis the Proscribed

Combination, the Court must next ask whether it creates new legal

rights, obligations, or consequences. See Rettig, 987 F.3d at 529.

2. The Revised Bulletin imposes new obligations regarding the

Proscribed Combination.

Turning to the “new legal obligations” factor, the Court is

unpersuaded by the Department’s PR campaign for the Bulletins. HHS

argues “[t]he Revised Bulletin is [] not final because it does not create

any new legal rights or obligations.” ECF No. 51 at 27. Rather, HHS

contends the Revised Bulletin “merely reiterates the Privacy Rule’s

longstanding restrictions” and “highlights certain other preexisting

obligations.” Id. Big, if true.

As the Department notes, final agency actions “break[] new ground.”

ECF No. 51 at 27. Simply put, plaintiffs can’t sue the Government

merely because it reminds them of preexisting obligations or of laws

already on the books. Rettig, 987 F.3d at 529; see also Nat’l Pork Prods.

Council v. EPA, 635 F.3d 738, 756 (5th Cir. 2011). Here, the Revised

Bulletin doesn’t frame the Proscribed Combination as a new rule, but as

a way to “ensure [covered entities] are not . . . violat[ing] the Privacy

Rule.” ECF No. 51 at 41. This is a subtle sleight of hand, as it substitutes

one question (whether PHI can be disclosed to tracking technology

vendors) for another (what counts as PHI collected by online tools). See

ECF No. 60 at 19.

To state the obvious, the Hospitals and countless amici are not in

federal court to advocate for their right to disclose IIHI. Rather, they

challenge whether the Proscribed Combination fits that taxonomy. See

ECF No. 1. Much hinges on that distinction. If the Proscribed

Combination isn’t IIHI, the Privacy Rule doesn’t apply. On the other

hand, if the Proscribed Combination constitutes IIHI, covered entities

have a host of legal obligations to ensure HIPAA compliance. And if the

Proscribed Combination is novel, as the Hospitals contend, then these

legal obligations are necessarily new. In this regard, HHS takes a well-

trod path: it’s hard to change the law itself, but with creative lawyering

it’s possible to argue the law always required certain conduct. See, e.g.,

Bostock v. Clayton Cnty., Ga., 590 U.S. 644, 649–50 (2020) (ignoring the

meaning of Title VII when written to argue “sex” incorporates the

conceptually distinct notion of “gender identity”). But the proof is in the

pudding, and the Hospitals point to four compelling signs that the

Revised Bulletin imposes new obligations. See ECF No. 60 at 20.

First, HHS has never issued a pronouncement “construing the IIHI

definition in the [ ] context of information collected by online

technologies—let alone adopting the agency’s new rule on the Proscribed

Combination.” Id.; see AR at 4–7. Second, there’s nothing close to

unanimity between HIPAA-covered entities on this point. Id.; see AR at

347–49; ECF No. 26 at 26. Third, other courts have rejected HHS’s

interpretation. Id.; see ECF No. 51 at 44 (collecting cases). Fourth, like

private-sector entities, “[i]t is undisputed that HIPAA-covered federal

agencies are disclosing IIHI in violation of the Revised Bulletin’s new

rule.” Id.; see ECF No. 51 at 44–45. So the Proscribed Combination

hasn’t been announced before, isn’t standard practice for covered

entities, has been rejected by federal courts, and isn’t followed by the

government.

To be fair, noncompliance doesn’t prove a law doesn’t exist. See ECF

No. 51 at 44–45 (“To the extent any federal agencies are [violating the

Proscribed Combination] . . . the Revised Bulletin reminds them to

protect that information . . . just as it does for regulated entities outside

of the federal government.”). But at some point, one would expect a

degree of compliance if the Proscribed Combination was already law—

as is seen for HIPAA’s numerous other requirements. See ECF No. 37 at

10–11. Indeed, the record reflects ubiquitous non-compliance with the

Proscribed Combination among private and public entities who operate

UPWs. See, e.g., AR at 347–49; ECF No. 26 at 26. Such widespread non-

compliance is persuasive in the absence of any HHS pronouncement

previously articulating the Proscribed Combination. See ECF No. 60 at

20. As a whole, these signs point to one conclusion: HHS tried to tweak

the IIHI definition and got caught. With its hand in the cookie jar, the

Department now backtracks. In doing so, it gaslights covered entities by

arguing the Bulletins restate what the rule has been all along.

Review of the Revised Bulletin confirms the Hospitals’ suspicions.

True, HHS seemed to acknowledge the Original Bulletin went too far,

as the Revised Bulletin confirms that the Proscribed Combination, by

itself, does not constitute IIHI. See AR at 4 (“The mere fact that an

online tracking technology connects the IP address of a user’s device (or

other identifying information) with a visit to a webpage addressing

specific health conditions or listing health care providers is not sufficient

. . . to constitute IIHI.”). And it added an additional example to illustrate

as much. See id. at 6 (discussing a hypothetical student interacting with

a UPW for research purposes).

All else equal, the Revised Bulletin would fix the problem. But as the

Hospitals note, all else isn’t equal:

The agency’s retreat does not go far enough, however, to fix

the rule’s fatal flaws. The Revised Bulletin’s modified rule

for what constitutes IIHI remains essentially the same.

HHS only tweaked the Proscribed Combination to require

that the identifiable individual’s subjective reason for

visiting the health-related public page must be related to

his own health. Specifically, the Revised Bulletin states

(with a double negative removed) that the Proscribed

Combination “is not a sufficient combination of information

to constitute IIHI if the visit to the webpage is not related

to [the] individual’s past, present, or future health,

healthcare, or payment for healthcare.” . . . But this

subjective-motive gloss on the Proscribed Combination is a

distinction without a difference.

ECF No. 60 at 11–12; see also ECF No. 26 at 3–11. For a jargon-heavy

topic like HIPAA, nomenclature matters. Taking a step back, one can

see the Revised Bulletin appears to soften the Department’s stance, see

AR at 4–6, but effectively changes nothing regarding the operative

nomenclature. The Original Bulletin said its IIHI when an online

technology connects (1) an individual’s IP address with (2) a visit to a

UPW addressing specific health conditions or healthcare providers. See

AR at 20–22. The Revised Bulletin says its IIHI when an online

technology connects (1) an individual’s IP address with (2) a visit to a

UPW with the intent to address the visitor’s specific health conditions or

healthcare providers. See ECF No. 51 at 41.

Subjective intent aside, the Revised Bulletin only compounds the

conundrum for covered entities. Indeed, covered entities must modify

their behavior the same way under both Bulletins. A user’s intent in

visiting a UPW is unknowable. Thus, because HIPAA doesn’t mandate

clairvoyance, covered entities must act as if the Original Bulletin

controls, i.e., as if the Proscribed Combination is per se IIHI. And the

record is clear that covered entities have not been doing that. See AR at

347–49; ECF No. 26 at 26. Accordingly, the Proscribed Combination

calls for a change to the status quo, a change only effectuated by new

conduct from covered entities. If the Privacy Rule always applied in this

context, that’s news to countless covered entities in both the private

sector and the federal government. See id.; see also ECF No. 60 at 20.

Recognizing the Proscribed Combination has not been followed, the

Department says “it may be prudent” for covered entities to take

measures that “prevent disclosures of non-IIHI.” Id. at 41. Why?

Because that’s the only way to stop “violation[s] of the Privacy Rule.”

ECF No. 51 at 41. Break that down to see through the euphemism. The

Department says certain actions “may be prudent” . . . “to ensure” . . .

compliance with “the Privacy Rule.” But the Privacy Rule is a mandatory

legal obligation. See 45 C.F.R. § 164.102. Thus, it’s not just “prudent” to

take actions to comply with it; its legally required. While it may be

prudent, it’s prudent the same way it’s “prudent” to drive the speed

limit. No reasonable juror could read the Revised Bulletin otherwise. See

Liberty Lobby, 477 U.S. at 248. That leads to the second Bennett factor.

3. The Revised Bulletin imposes legal obligations regarding the

Proscribed Combination.

Having found the Proscribed Combination imposes new obligations,

the Court must next ask if those obligations are legal. See Bennett, 520

U.S. at 178. HHS says they aren’t, for three reasons. First, the Revised

Bulletin says they aren’t. See ECF No. 51 at 28; see also AR at 11 (stating

the document “do[es] not have the force and effect of law”). Second, the

Revised Bulletin “merely expresses its view of what the law requires,”

rather than articulating legal obligations per se. Id. Third, to the extent

the Revised Bulletin creates legal consequences, they only come “after

an investigation by OCR and a separate administrative enforcement

proceeding.” See ECF No. 51 at 26. These arguments don’t persuade.

The first argument fails because substance trumps titles. True, the

Revised Bulletin ostensibly waives any “force and effect of law.” See AR

at 11. But courts have long rejected a “magic words” approach that

ignores the content of a law because it contains such a caveat. See, e.g.,

Azar v. Allina Health Servs., 587 U.S. 566, 575 (2019) (collecting cases)

(“[C]ourts have long looked to the contents of the agency’s action, not the

agency’s self-serving label.”). Indeed, this is the Department’s argument

against the Hospitals’ non-APA claims. See ECF No. 51 at 33. The

Department says the Hospitals “recast[] a garden-variety APA claim as

a non-statutory equitable claim.” Id. at 31 (cleaned up). HHS thus asks

the Court to look beyond titles to substance there while endorsing the

opposite approach here. The Court is disinclined to do so.

The Department’s first argument also renders the Revised Bulletin

internally conflicted. On one hand, the document tells covered entities

how to act vis-à-vis PHI in a new online context. See AR at 4. On the

other, HHS bookends this guidance with the caveat that the Revised

Bulletin should not “bind the public in any way.” AR at 11. So the

Revised Bulletin tells covered entities how to act and then tells them not

to base how they act on what it says. This tension is the natural

byproduct of such “force-of-law waivers” on documents which, by their

very nature, are designed to inform conduct. Substance trumps titles.

See Texas v. Becerra, 89 F.4th 529, 535, 541 (5th Cir. 2024) (rejecting

the title “reminder” when an HHS document “set out HHS’s legal

position—for the first time—regarding how [the law] operates”). And the

substance of the Revised Bulletin dictates how covered entities must

conduct their affairs regarding the Proscribed Combination.

The Department’s second argument fails because HHS (through

OCR) enforces HIPAA. See 42 U.S.C. § 1320d-5; 45 C.F.R. §§ 160.306,

160.308, 160.312, 160.314, 160.402. When an authority “expresses its

view of what the law requires,” see ECF No. 51 at 28, the governed must

behave accordingly. That’s why the Department’s reliance on Luminant

Generation Co. v. EPA, 757 F.3d 439 (5th Cir. 2014) is misguided. The

Fifth Circuit has stressed Luminant’s applicability to non-compliance

notices issued to a single company. See Becerra, 89 F.4th at 539. If an

enforcement body “expresses its view” to Company A, Company B should

probably pay attention. But the notice to Company A isn’t legally

operative as to Company B. See id.

Here, unlike Luminant, HHS has informed “[its] staff and all

[covered entities] what sort of policy is unlawful.” Id. at 539 (citation

omitted). The Revised Bulletin says UPW visits “do not result in a

disclosure of PHI to tracking technology vendor[s] if the visit is not

related to an individual’s past, present, or future health, health care, or

payment for healthcare.” AR at 6. Put differently, such visits do “result

in a disclosure of PHI” if the visit is “related to an individual’s past,

present, or future health, health care, or payment for healthcare.” See

id. This categorical applicability undermines the Department’s

argument. Indeed, in the very act of “expressing its view,” HHS

articulated its stance on this new category of IIHI to all covered entities.

And nothing in the Revised Bulletin could be read to suggest otherwise.

The Department’s third argument fails because it’s wrong. Even if

an OCR investigation and enforcement action would be required for

legal consequences, that fact does not rob the Revised Bulletin of legal

effect. Rather, the Department’s position reeks of Benthamite legal

positivism, essentially equating the substance of a “legal obligation”

with the State coercion needed to enforce it.4 An ordinance banning

skateboards in the park doesn’t become law only when a joyriding perp

is apprehended. Much to Texans’ chagrin, speed limits are still speed

limits long before blue lights flash. And the Proscribed Combination is

still a legal obligation even if “any legal consequences require an

administrative enforcement proceeding . . . subject to judicial review.”

ECF No. 51 at 28.

The Fifth Circuit’s analysis in EEOC makes this clear. Here, HHS

issued a guidance document stating the Proscribed Combination

violates the Privacy Rule. See ECF No. 60 at 37. There, the EEOC issued

a guidance document stating blanket bans on hiring individuals with

criminal records violate Title VII. See EEOC, 933 F.3d at 437–38. The

Privacy Rule doesn’t change here; Title VII didn’t change there. See id.

The change in both is what constitutes a violation. EEOC pointed to

4See generally David B. Lyons, Logic & Coercion in Bentham’s Theory of

Law, 57 CORNELL L. REV. 335, 338 (1971) (describing the logical predicate to

Bentham’s juridical theory: that “a legal system is equivalent to a set of

commands which are essentially coercive”).

three considerations to determine if a “guidance document” constitutes

legal action: (1) mandatory language, (2) restrictions on the agency’s

discretion to adopt a different view, and (3) the creation of safe harbors

from legal consequences. See 933 F.3d at 441–43. Applied here, each

indicates the Revised Bulletin creates legal obligations.

To start, the Proscribed Combination is worded in mandatory

language. A document can be “mandatory” if “it either appears on its

face to be binding[] or is applied by the agency in a way that indicates it

is binding.” Texas v. United States, 809 F.3d 134, 171 (5th Cir. 2015).

Before discussing PHI in the UPW context, the Bulletins remind covered

entities they must “comply with the HIPAA Rules.” AR at 8. Fair

enough. But HHS then tells covered entities they “must meet” certain

conditions to comply with HIPAA in the previously unaddressed context

of the Proscribed Combination. See id. The problem isn’t the mandatory

language itself, but its use in a new context.

The Revised Bulletin also limits HHS to a particular position

regarding the Proscribed Combination, thus restricting its discretion to

adopt a different view. See EEOC, 933 F.3d at 441–43. Sure, the Revised

Bulletin says it isn’t “meant to bind the public in any way.” See AR at

11; ECF No. 51 at 28. But “whether the agency action binds the agency

indicates whether legal consequences flow from the action.” EEOC, 933

F.3d at 445. And the Revised Bulletin clearly binds HHS. See AR at 5.

There is no “may” or “might” to it; the Revised Bulletin expressly states

that the Privacy Rule applies to the Proscribed Combination. See id.

Given the Revised Bulletin’s clarity, HHS can say the document isn’t

“meant to bind the public” all it wants. See ECF No. 51 at 13, 24, 28; AR

at 11. By prescribing certain conduct to ensure covered entities are not

violating the Privacy Rule, see ECF No. 51 at 41, the Revised Bulletin

shows its cards. HHS will consider the Proscribed Combination (with

the subjective-intent caveat) a violation. See id. And the second Bennett

factor is met where, as here, the agency action “alter[s] the legal regime

to which the action agency is subject.” Bennett, 520 U.S. at 178; see also

Hawkes Co., 578 U.S. at 598 (quoting Bennett, 520 U.S. at 178) (finding

finality where “[t]he definitive nature of [the agency action] gives rise to

‘direct and appreciable legal consequences’”).

The Court in Bennett addressed cases which reached the opposite

conclusion. See id. (discussing Franklin v. Massachusetts, 505 U.S. 788

(1992) and Dalton v. Specter, 511 U.S. 462 (1994)). The Court’s non-

finality finding in Franklin “was premised on the observation that the

[action] carried ‘no direct consequences’ and served ‘more like a tentative

recommendation.’” Id. (quoting Franklin, 505 U.S. at 798). Here, the

Revised Bulletin applies the Privacy Rule to the Proscribed

Combination, a change with “direct consequences.” And applying the

Privacy Rule to the Proscribed Combination isn’t “a tentative

recommendation” because the Privacy Rule isn’t optional. See 45 C.F.R.

§ 164.102.

Similarly, the Court found the actions in Dalton were not final

because they were “in no way binding” and the president “had absolute

discretion to accept or reject them.” Bennett, 520 U.S. at 178 (quoting

Dalton, 511 U.S. at 469–71). Here, notwithstanding the Revised

Bulletin’s “force-of-law” waiver, the document applies the Privacy Rule

(which is binding) to the Proscribed Combination. AR at 11. And because

the Privacy Rule is mandatory, any “discretion” afforded to covered

entities amounts to a Hobson’s choice. Thus, “affected private parties

are reasonably led to believe that failure to conform will bring adverse

consequences.” EEOC, 933 F.3d at 442. And the Revised Bulletin gives

HHS no discretion to adopt a different view.

Finally, the Revised Bulletin enumerates legal safe harbors for

covered entities. “Another indication that an agency’s action binds it and

thus has legal consequences or determines rights and obligations is

whether the document creates safe harbors protecting private parties

from adverse action.” Id. at 442. The Revised Bulletin explains precisely

how covered entities must treat the Proscribed Combination—namely,

as if it’s IIHI—to ensure they aren’t violating HIPAA. See AR at 1–17;

see also ECF No. 51 at 13 (noting the Revised Bulletin “provide[s]

additional clarity to regulated entities . . . about what types of

disclosures to tracking technologies might reveal IIHI, [and] offer[s]

advice about ways regulated entities can use tracking technologies and

also comply with the Privacy Rule”). If covered entities fail to comply,

HHS is bound by its position. Because the Department’s hands are tied,

the Revised Bulletin is as discretionary as compliance with the Privacy

Rule itself. In other words, it’s mandatory. Cf. Franklin, 505 U.S. at 798;

Dalton, 511 U.S. at 469–71.

It’s also worth noting that the moniker “guidance document” changes

nothing. See EEOC, 933 F.3d at 446 (finding a guidance document

created legal obligations where it “commit[ed] the agency itself to a view

of the law that, in turn, force[d] the plaintiff either to alter its

consequences, or expose itself to potential liability”); Becerra, 89 F.4th

at 535 (same, for a rule mischaracterized as a “reminder”).5 One could

query why executive rules and regulations are so abstruse they require

numerous “guidance documents” to ensure compliance. Nevertheless,

guidance documents play an important role for entities subject to a

regulatory regime. See EEOC, 933 F.3d at 446. But they can also serve

as a Trojan horse for bureaucrats changing the rules of the game. Here,

to the extent the Revised Bulletin provides “guidance” on the Proscribed

Combination, it provides guidance regarding mandatory legal

obligations. See id. To hold otherwise, as the Hospitals note, would allow

HHS to brandish a “sword of Damocles” above their heads. See ECF No.

60 at 21–22; see also Sackett v. EPA, 566 U.S. 120, 127 (2012) (noting

such situations force regulated parties to alter their conduct or “wait for

the Agency to drop the hammer”). A rose by any other name is still a

rose, and a law by any other title is still a law.

* * *

Try as it might, HHS cannot plausibly argue the Revised Bulletin

“expresses a reasonable—and, indeed, correct—explanation” of conduct

5HHS pushes back on the Hospitals’ appeals to Becerra, a case which found

a different HHS guidance document was a reviewable final action. See ECF

No. 51 at 29–30 (discussing Becerra, 89 F.4th at 541). As HHS notes, “central

to the court’s analysis” was a “sea-change” in the law brought about by the

Supreme Court’s ruling in Dobbs v. Jackson Women’s Health Org., 597 U.S.

215 (2022). See id. Given that change to the legal landscape, the document did

more than restate the Department’s position, it articulated a stance “regarding

how EMTALA operates post-Dobbs.” Becerra, 89 F.4th at 541. While this case

is different, the Hospitals’ appeals to Becerra are still well received because

what catalyzed the new position is irrelevant. What matters in each case is

whether the challenged document “sets out HHS’s legal position—for the first

time—regarding how [the relevant statute] operates.” Id.

“HIPAA Rules have long required.” ECF No. 51 at 48. While it does

“reiterate[] the Privacy Rule’s longstanding restriction on the use and

disclosure of PHI,” see id. at 27, it does more than that, too. In particular,

it shoehorns a novel category of information into the inelastic

definitional contours of “IIHI.” And because “[l]egal consequences [] flow

from the Guidance, [] it determines rights and obligations.” EEOC, 933

F.3d at 446. In doing so, the Revised Bulletin is redolent of other

“guidance documents” that imposed substantive legal obligations.

Becerra, 89 F.4th at 541. This Court knows a law when it sees one, and

the Proscribed Combination is a law. Thus, the Revised Bulletin is a

“final agency action” subject to judicial review. See 5 U.S.C. § 704;

Bennett, 520 U.S. at 178. The Court now turns to the merits of the

Hospitals’ challenge.

B. The HHS lacked authority to promulgate the Proscribed

Combination.

The Court’s finding that the Revised Bulletin imposes new legal

obligations establishes jurisdiction under the APA but changes nothing.

There’s nothing wrong with imposing new legal obligations—executive

agencies do that all the time. And the Court is not a tribunal to discuss

the soundness of a given policy. See Nuziard v. Minority Bus. Dev.

Agency, ___ F. Supp. 3d ___, 2024 WL 965299, at *5–6 (N.D. Tex. Mar.

5, 2024) (Pittman, J.). Rather, judicial review exists to ensure executive

agencies promulgate new policies within the boundaries set by the

Constitution and their enabling statute. See generally Ak. Dep’t of Envt’l

Conservation, 540 U.S. at 496–97. The APA provides an analytical

framework to make this determination. See Chrysler Corp. v. Brown,

441 U.S. 281, 316 (1979).

The Hospitals argue the Proscribed Combination is both

substantively and procedurally improper. See ECF No. 25. The briefs

devolve into wide-ranging multiple-theatre combat on this point, but the

Court’s analysis need not. At base, the Hospitals argue the rule is

improper because (1) HHS allegedly exceeded its authority in

promulgating the Bulletins and (2) HHS allegedly violated the APA

when doing so. See ECF No. 25 at 24–42. Their arguments under the

APA are twofold, as the Hospitals contend (1) the Proscribed

Combination is arbitrary and capricious and (2) the Proscribed

Combination was promulgated without notice and comment. See id. at

35–42. As explained below, the Court need not address the Parties’

contentions regarding HHS’s “arbitrary and capricious” rationale or its

failure to conduct notice and comment because the Proscribed

Combination facially violates HIPAA’s unambiguous definition of IIHI.

1. The Proscribed Combination falls outside the statutory definition

of IIHI.

[A]n agency literally has no power to act . . . unless and until

Congress confers power upon it.” La. Pub. Serv. Comm’n v. FCC, 476

U.S. 355, 374 (1986). HIPAA is extraordinarily expansive, so Congress

gave HHS broad authority to promulgate rules and regulations to

effectuate its mandates. See CHRIS D. LINEBAUGH & EDWARD C. LIU,

CONG. RSCH. SERV., LSB10797, PROTECTION OF HEALTH INFORMATION

UNDER HIPAA AND THE FTC ACT: A COMPARISON 1–5 (2022); see

generally Mourning v. Fam. Pubs. Serv., Inc., 411 U.S. 356, 376 (1973)

(noting the objective in delegating such broad authority “is to relieve

Congress of the impossible burden of drafting a code explicitly covering

every conceivable future problem”). But the Department’s authority isn’t

absolute, and the Proscribed Combination goes too far.

That HHS lacked authority to promulgate the Proscribed

Combination is unsurprising, as our nation’s bureaucratic apparatus

would give Hobbes’ Leviathan a run for its money. Indeed, few are the

facets of modern life untouched by the federal government’s

administrative machinery, which is as sophisticated as it is complex.

We’ve drifted from the founders’ intent,6 but that’s not the only problem.

Another, as Hobbes and the founders foresaw, is the tendency of large

6See, e.g., THE FEDERALIST NO. 45 (James Madison) (Clinton Rossiter ed.,

1961) (“The powers delegated by the Constitution to the Federal Government

are few and defined [and should be] . . . exercised principally on external objects

such as war, peace, negotiation, and foreign commerce.”) (emphasis added);

Letter from Thomas Jefferson to Thomas Cooper (Nov. 29, 1802), available at

NATIONAL ARCHIVES, https://founders.archives.gov/documents/Jefferson/01-

39-02-0070 (“The path we have to pursue is so quiet that we have nothing

scarcely to propose [to Congress]. A noiseless course, not meddling with the

affairs of others, unattractive of notice, is a mark that society is going on in

happiness.”).

bureaucracies to self-perpetuate, emboldened by each successive ultra

vires action. As the old saying goes, “give an inch, they’ll take a mile.”

And HHS has taken a mile. See ECF No. 25 at 24 (“[T]he threshold

problem with the Bulletin is also the most fundamental: The Bulletin’s

new rule exceeds HHS’s authority under HIPAA.”).

HHS may enforce the Privacy Rule as it pertains to IIHI. See 45

C.F.R. § 160.103; 42 U.S.C. § 1320d(6). As noted, IIHI is unambiguously

defined as PHI that (1) “relates to” an individual’s “past, present, or

future physical or mental health or condition,” the individual’s receipt

of “health care,” or the individual’s “payment for” healthcare; and (2)

“identifies the individual” or provides “a reasonable basis to believe that

the information can be used to identify the individual.” 42 U.S.C.

§ 1320d(6). Put another way, PHI becomes IIHI if two conditions are

met:

(1) the PHI relates to the individual’s “past, present, or

future physical or mental health or condition,” their receipt

of healthcare, and/or their payment for healthcare; and

(2) the PHI “identifies” the individual or could reasonably

“be used to identify” them.

See id. The definition is inclusive, meaning information must satisfy

both the “relates to” clause and the “identifies” clause to be classified as

IIHI. Id.; see also ECF No. 25 at 25 (“Accordingly, even where

information relates to some individual’s health, healthcare, or payment

for healthcare, a covered entity may disclose the information so long as

it cannot reasonably be used to identify that particular individual.”)

(collecting examples). The Proscribed Combination fails both on its face.

i. The Proscribed Combination fails the “relates to” prong.

As noted, the Revised Bulletin repackages the Original with a

subjective-intent gloss. See AR at 6. But HHS cannot require covered

entities to perform the impossible. Thus, even if a UPW’s metadata could

identify a particular individual, “[t]hat information cannot become IIHI

based solely on the visitors’ subjective motive for visiting the page.” ECF

No. 60 at 38. The Hospitals’ brief discusses two hypotheticals to

illustrate this point:

Even assuming (without conceding) that such information

may provide a reasonable basis for identifying the persons

who visited the webpage—say, that John Smith visited a

page for booking dialysis appointments, or Mary Jones

visited a page about the onset of Alzheimer’s disease—that

establishes nothing. There are many generic reasons why

they may have visited such pages, entirely unrelated to the

health, healthcare, or payment for healthcare of any

particular individual (e.g., they could be public-health

researchers or hospital employees). In addition, even if

their visits were related to some individual’s healthcare

needs, they could have been acting for family members,

friends, or countless other third parties. And their IP

addresses provide no reasonable basis to determine

otherwise. Without contesting any of this, HHS baldly

asserted that the Proscribed Combination is “indicative” of

the visitor’s own health status or treatment, [] but any such

inference drawn from internet metadata falls far short of

what the IIHI definition requires, as courts have

recognized.

ECF No. 25 at 11–12. HHS refutes this argument by noting such

information could be “indicative” of Mr. Smith’s and Ms. Jones’s PHI.

See ECF No. 51 at 41–42. But that’s not enough. Indeed, as the Hospitals

contend, “[t]his conclusory rationale would eviscerate the express limits

on the IIHI definition.” ECF No. 25 at 26.

HHS says it’s “common sense” that “some users who visits these

webpages . . . are doing so to learn information about their own medical

conditions, to inquire about specific medical practices or providers for

the purpose of obtaining healthcare, to actually obtain an appointment

with a particular provider, or for other reasons related to their own

healthcare.” ECF No. 41 at 40. The Court does not disagree. Indeed, the

Court wouldn’t disagree if HHS argued most people visit for those

reasons. But that’s not what HIPAA requires. In any event, Congress

only included the “reasonable basis” qualifier for the identification

prong. See 45 C.F.R. § 160.103; accord 42 U.S.C. § 1320(6). The Bulletins

took that qualifier and ran with it, inserting it into the first prong and

adding an atextual “indicative” gloss to boot.

The “indicative” gloss aside, unambiguous legislative text must

control. As it pertains to IIHI, the text says what it says and doesn’t say

what it doesn’t say. The IIHI definition explicitly states the PHI in

question must “relate[] to” a listed category of information. See 42 U.S.C.

§ 1320d(6). You don’t have to read tea leaves to divine what that means.

Congress could have said “may relate to.” It could have said “might

relate to.” It could have said “relates to or is indicative of.” It didn’t.

Thus, without knowing a particular query relates to a category of

information in Section 1320d(6), metadata from a UPW search cannot

constitute IIHI. See 45 C.F.R. § 160.103; 42 U.S.C. § 1320(6). To hold

otherwise would empower HHS and other executive entities to take

increasingly expansive liberties with the finite authority granted to

them. The Court is disinclined to set that precedent here.

ii. The Proscribed Combination fails the “identifies” prong.

The Proscribed Combination fares no better on the “identifies”

clause. The Department acknowledges that “tracking technologies on

[UPWs] may collect identifying information from users who are not

visiting the webpage for their health care needs.” ECF No. 51 at 41.

Nevertheless, it notes “identifying information about users who are

visiting the webpage for their healthcare needs constitutes IIHI.” Id.

The Hospitals don’t disagree with the foundational premise. See ECF

No. 60 at 49–50 (“Under the Revised Bulletin, the information that is

actually collected and transmitted in not itself [PHI] (the metadata

showing the mere fact that an identifiable individual visited a health-

related page, but not the reason for the visit), and the information that

might actually be [PHI] is not collected and transmitted at all (whether

the individual’s reason for visiting the page was related to his own

health).”). The issue is that the Proscribed Combination does not and

cannot identify an individual or the individual’s PHI without an

unknowable subjective-intent element—an element not countenanced

by the controlling statutory text.

As the Hospitals rightly note, “IIHI is limited to information that is

related to a specific person’s health and [is] reasonably capable of being

used to identify that person—such as, for example, unredacted patient

records or billing statements.” ECF No. 25 at 13–14. The Department

acknowledges that the Proscribed Combination does not, in itself,

“identify” the individual searcher and their condition. See ECF No. 51

at 41. But the Department nevertheless insists the Proscribed

Combination is proper, emphasizing the “reasonably” caveat appended

to this prong. See id.; see also 42 U.S.C. § 1320d(6)(B) (noting PHI can

become IIHI if it provides “a reasonable basis” to believe the information

“can be used to identify the individual”).

Appeals to this “reasonable basis” language cannot save the

Proscribed Combination. To be fair, reasonableness is in the eye of the

beholder. It’s a lax standard, and HHS should be afforded deference in

determining what’s “reasonable” in most circumstances. See, e.g., United

States v. Mead Corp., 533 U.S. 218, 227 (2001); United States v. Morton,

467 U.S. 822, 834 (1984); Chevron, USA, Inc. v. Nat. Res. Def. Council,

Inc., 467 U.S. 837, 843–44 (1984). But such deference does not give HHS

interpretive carte blanche to justify whatever it wants irrespective of

violence to HIPAA’s text. And “reasonable basis” must mean something.

And whatever it means, it assuredly does not include information that,

at most, supports an “inference” of identification. The Court agrees with

its numerous sister courts who have reached that conclusion.7

The Department’s problems run even deeper on this point. The IIHI

definition applies to information that “is created or received by a health

care provider, health plan, employer, or health care clearinghouse.” 42

U.S.C. § 1320d(6). It’s uncontested that information in the Proscribed

Combination is user-generated, though it is “received” by one or more of

the above entities. However, upon receiving the relevant metadata, the

recipient could not “reasonably use” the data to identify an individual or

7See, e.g., Smith v. Facebook, Inc., 745 F. App’x 8, 9 (9th Cir. 2018) (“Put

simply, the connection between a person’s browsing history and his or her own

state of health is too tenuous to support Plaintiffs’ contention that the

disclosure requirements of HIPAA . . . apply.”); Kurowski v. Rush Sys. for

Health, 683 F. Supp. 3d 836, 843 (N.D. Ill. 2023) (“By contrast, [Plaintiff’s]

allegations are far too vague to allow an inference to be drawn that [Defendant]

was actually disclosing IIHI as it is unambiguously defined by HIPAA, rather

than just metadata.”); Hartley v. Univ. of Chi. Med. Ctr., No. 22-c-5891, 2023

WL 7386060, at *2 (N.D. Ill. Nov. 8, 2023) (citing Smith, 745 F. App’x at 9)

(rejecting argument that metadata as discussed in the Revised Bulletin could

be IIHI because plaintiff couldn’t show “any particular health or treatment

information disclosure specific as to them that [Defendant] allegedly made to

any third-party whether within the portal or not”).

their health condition. That’s because, as the Department concedes,

there’s a missing ingredient of subjective intent. See AR at 4. And that

information is not received. Put simply, “[t]hat information cannot

become IIHI based solely on the visitors’ subjective motive for visiting

the page, which is not information that the Revised Bulletin requires

the healthcare provider or third-party vendor to receive at all.” ECF No.

60 at 38. Thus, even after multiple speculations, the Proscribed

Combination could never fit HIPAA’s definition of IIHI.

Giving HHS the benefit of the doubt, suppose a UPW visitor’s query

related to someone’s healthcare. Suppose further that their query

related to their healthcare. Without knowing information that’s never

received—i.e., the visitor’s subjective motive—the resulting metadata

could never identify that individual’s PHI. Simply put, Identity (Person

A) + Query (Condition B) ≠ IIHI (Person A has Condition B). If a

covered entity’s UPW greets visitors with a dropdown box requesting

their subjective motive for visiting the page, that would be one thing.

The Department can and should remind covered entities that the

Privacy Rule would apply in those circumstances. But absent such an

admittedly bizarre scenario, the Proscribed Combination cannot become

IIHI as unambiguously defined.

The above conclusion is far from novel. Indeed, covered entities have

long been allowed to disclose PHI that does not identify the particular

individual. See 45 C.F.R. § 164.514(a) (noting that, after “de-

identification,” PHI “is not [IIHI]”). The Department now seeks to

reverse that, ignoring the inherently de-identified nature of relevant

metadata and insisting such information should be treated as IIHI. See

ECF No. 51 at 41. Thus, if enforced, the Proscribed Combination would

turn provisions like 45 C.F.R. § 164.514(a) on their head. Federal courts

have already recognized as much. See supra n.7.

To conclude, the law is clear that “[h]ealth information that does not

identify an individual and with respect to which there is no reasonable

basis to believe that the information can be used to identify the

individual is not [IIHI].” See 45 C.F.R. § 164.514(a). At summary

judgment, the Court must give HHS every reasonable benefit of the

doubt. Cunningham, 64 F.4th at 600. Having done so, the closest the

Proscribed Combination gets to IIHI is a speculative inference

extrapolated from (but unsubstantiated by) collected metadata. Because

the Proscribed Combination facially exceeds HIPAA’s unambiguous

text, the Court need not consider the Parties’ other APA arguments.

* * *

No matter how sound the Proscribed Combination may be as a

matter of policy, it is improper as a matter of law. Thus, for the above

reasons, the Court must GRANT the Hospitals’ request for declaratory

relief. ECF No. 1 at 22. The Court now turns to their additional requests

for vacatur and a permanent injunction.

C. Vacatur is the more appropriate equitable remedy under

the circumstances of this case.

The Hospitals ask the Court to declare the Proscribed Combination

unlawful, vacate it, and permanently enjoin its enforcement. See id.

Having granted declaratory judgment, the Court now takes up their

requests for equitable relief. In doing so, “[t]he Court notes that

Plaintiffs don’t get [injunctive relief] just because they got a declaratory

judgment.” Nuziard, 2024 WL 965299, at *44 (collecting cases). As

explained below, vacatur is the more appropriate remedy here.

1. The Department should not be enjoined from enforcing the

Proscribed Combination.

The Hospitals seek an injunction to mitigate the risk that they are

penalized for noncompliance with an unlawful law. See ECF No. 1 at 22.

But an injunction “is not a remedy which issues as of course.”

Harrisonville v. W.S. Dickey Clay Mfg. Co., 289 U.S. 334, 337–38 (1933).

Indeed, injunctions have long been considered a “drastic and

extraordinary remedy.” Monsanto Co. v. Geertson Seed Farms, 561 U.S.

139, 165 (2010). To warrant injunctive relief, the Hospitals must show:

(1) that [they have] suffered an irreparable injury; (2) that

remedies available at law, such as monetary damages, are

inadequate to compensate for that injury; (3) that,

considering the balance of hardships between the plaintiff

and defendant, a remedy in equity is warranted; and (4)

that the public interest would not be disserved by a

permanent injunction.

eBay, Inc. v. MercExchange, LLC, 547 U.S. 388, 391 (2006). And they

must “clearly carry[] the burden of persuasion on all [four] elements.”

Bluefield Water Ass’n, Inc. v. City of Starkville, Miss., 577 F.3d 250, 253

(5th Cir. 2009). They fail to do so. Specifically, they win on factors two

through four, but lose on factor one.

To start with the wins, the Hospitals show inadequacy of legal

remedies. See eBay, 547 U.S. at 391. Because they sue the government,

money damages are off the table. See Wages & White Lion Invs., LLC v.

FDA, 16 F.4th 1130, 1142 (5th Cir. 2021). That’s a win for factor two.

eBay, 547 U.S. at 391. And factors three and four “merge when the

Government is the opposing party.” Nken v. Holder, 556 U.S. 418, 435

(2009). As applied to the Parties themselves, the Court “looks to the

relative harm to both parties if the injunction is granted or denied.” Def.

Distrib. v. U.S. Dept’ of State, 838 F.3d 451, 460 (5th Cir. 2016). A denied

injunction leaves the Hospitals in limbo to face potential enforcement of

an invalid law. A granted injunction merely stops HHS from enforcing

one improper subset of a guidance document issued three months ago.

On balance, private hardships favor the Hospitals—public interests

even more so. The importance of digital healthcare information has

grown by orders of magnitude since the COVID-19 pandemic. See ECF

No. 35 at 31–32. As thoroughly detailed in amicus briefs, the Proscribed

Combination would “undermine[] the joint efforts of Hospitals and the

Government to modernize healthcare.” Id. at 31 (cleaned up). If

enforced, the Proscribed Combination would have a profound chilling

effect on providers’ use of technology vendors to facilitate critical UPWs.

See id. While healthcare providers can “host websites and patient

portals without using any third-party analytics . . . it serves nobody to

have websites that patients do not know and cannot navigate

effectively.” Id. at 33.

To be fair, the OCR has seen a surge of complaints from citizens

concerned about IIHI in this context. See AR at 1–17. But as noted

above, metadata shared with third-party vendors can only reveal

sensitive PHI if an unknown subjective intent is communicated. In the

pre-Revised Bulletin status quo, healthcare providers have been

“constantly vigilant to protect the confidentiality of their patients’

[IIHI].” ECF No. 37 at 10. Indeed, “HIPAA compliance is woven deep

into hospital operations, with implications for every way in which

hospitals interact with patients or patients’ medical information.” Id. at

10–11. The Proscribed Combination fails to improve upon these current

privacy protections while jeopardizing the dissemination of important

healthcare information to the masses. See id. at 14–20.

In most cases, the avoidance of improper laws is “the highest public

interest at issue.” Def. Distrib., 838 F.3d at 460. That interest is

implicated here. See supra pp. 25–26. But it’s the penultimate interest

for this case given the significant public-health considerations discussed

above. See Roman Catholic Diocese of Brooklyn v. Cuomo, 492 U.S. 14,

19–20 (2020) (noting public health is paramount in injunctive-relief

analyses). Yet despite these decisive victories, the Hospitals must

“clearly carry[] the burden of persuasion on all elements” to obtain a

permanent injunction. Bluefield Water Ass’n, 577 F.3d at 253. And they

fail to do so for factor one.

An irreparable injury is a sine qua non for injunctive relief. See id.

As noted, the Hospitals can’t get damages here. See Wages & White Lion

Invs., 16 F.4th at 1142. That ordinarily indicates a harm is irreparable.

See Sampson v. Murray, 415 U.S. 61, 90 (1974) (“The key word in in this

consideration is irreparable. Mere injuries, however substantial, . . . are

not enough. The possibility that adequate compensatory or other relief

will be available at a later date . . . weighs heavily against a claim of

irreparable harm.”). But hiding in plain sight is the “or other relief”

language in Murray. See id. As explained below, other relief can remedy

the Hospitals’ injury—namely, a declaratory judgment coupled with

vacatur. Thus, the Hospitals do not show a permanent injunction is the

only remedy that could address their injury. Because they fail to make

that showing, they do not carry their burden in seeking such an

“extraordinary and drastic” remedy. Monsanto, 561 U.S. at 165. The

Court must DENY their request accordingly. See ECF No. 1 at 22.

2. The Proscribed Combination should be vacated.

As discussed, the Hospitals seek both a permanent injunction and

vacatur. See id. While it’s not impossible to get both, the Court must

always consider the “least severe” equitable remedy to resolve a

plaintiff’s harm. See Nuziard, 2024 WL 965299, at *44–49 (collecting

cases); see generally O’Donnell v. Harris Cnty., 892 F.3d 147, 155 (5th

Cir. 2018) (noting an equitable remedy must be “narrowly tailored to the

injury it is remedying”). And while this Court doubts the APA intended

to authorize vacatur, see Nuziard, 2024 WL 965299, at *41–44, the Fifth

Circuit’s “ordinary practice is to vacate unlawful agency action.” Data

Mktg. P’ship, LP v. U.S. Dep’t of Lab., 45 F.4th 846, 859 (5th Cir. 2022).

The Proscribed Combination is unlawful. See supra pp. 25–26; see

also 5 U.S.C. § 706 (empowering courts to “set aside” unlawful agency

actions). Between alternatives, vacatur is less severe on HHS but still

remedies the Hospitals’ harm. See Texas v. United States, 40 F.4th 205,

219 (5th Cir. 2022) (citing Monsanto, 561 U.S. at 165) (“There are

meaningful differences between an injunction, which is a ‘drastic and

extraordinary remedy,’ and vacatur, which is ‘a less drastic remedy.’”).

While plaintiffs need more than a perfunctory analysis to justify

vacatur, the controlling doctrinal framework is more forgiving than it is

for an injunction. See id. Vacatur is also less severe as applied to the

relevant agency. See id. Thus, the Court endorses the Fifth Circuit’s

standard practice here. See Data Mktg. P’ship, 45 F.4th at 859. The

Hospitals say vacatur is warranted because the continued presence of

an unlawful rule on the books will undermine any effectual relief the

Court could render. See ECF No. 59 at 58. The Court agrees, especially

considering “vacatur does nothing but re-establish the status quo absent

unlawful agency action.” Texas, 40 F.4th at 220. As such, “[a]part from

the constitutional or statutory basis on which the court invalidated an

agency action, vacatur neither compels nor restrains further agency

decision-making.” Id.

The Hospitals point to a recent case where this Court exercised its

equitable discretion to deny vacatur in favor of an injunction. See ECF

No. 59 at 57–58 (discussing Nuziard, 2024 WL 965299, at *43–44). In

Nuziard, the Court denied vacatur under Section 706 “[b]ecause a

declaratory judgment an injunction [were] more clearly authorized . . .

and [would] remedy Plaintiff’s injuries.” 2024 WL 965299, at *43.

Central to that determination was a desire to issue the least restrictive

equitable remedy. See id. That consideration supports the opposite

conclusion here. Nuziard involved the implementing legislation of a

nationwide executive agency. See id. The plaintiffs challenged a race-

based benefits presumption that was baked into the very fabric of the

agency. See id. Thus, vacatur doubts aside, an injunction was less severe

in that case and would result in less flux for interested parties. An

injunction stopped the agency from implementing the unconstitutional

racial presumption. Because the presumption was built into the agency’s

structure, vacating every provision containing the presumption would

be an administrative fiasco and would effectively implode the agency.

See id.

The inverse is true here. Without minimizing the Proscribed

Combination’s consequences, this case involves a straightforward

challenge to a single rule issued in a single guidance document. See ECF

No. 1. Because the Proscribed Combination is not central to HHS and

its implementing legislation, vacatur will have less drastic consequences

here that it did in Nuziard. Indeed, the Court can envision numerous

solutions that would reduce regulatory flux while ensuring IIHI is

protected moving forward. Thus, because the Fifth Circuit prefers

vacatur for unlawful agency actions, see See Data Mktg. P’ship, 45 F.4th

at 859, and because no case-specific considerations indicate the Court

should deviate from that practice, the Court must GRANT the

Hospitals’ request for vacatur under 5 U.S.C. § 706. ECF No. 1 at 22.

CONCLUSION

It’s easy for eyes to glaze over at a thirty-page opinion discussing the

administrative esoterica accordant with HIPAA compliance. But this

case isn’t really about HIPAA, the Proscribed Combination, or the

proper nomenclature for PHI in the Digital Age. Rather, this is a case

about power. More precisely, it’s a case about our nation’s limits on

executive power. In the grand scheme, the Revised Bulletin is one small

guidance document among countless others issued by HHS and other

executive entities. But a wise Man once said that “one who is faithful in

a very little is also faithful in much, and one who is dishonest in a very

little is also dishonest in much.” Luke 16:10 (ESV). While the Proscribed

Combination may be trivial to HHS, it isn’t for covered entities diligently

attempting to comply with HIPAA’s requirements. And even small

executive oversteps can compound over time, resulting in larger

transgressions down the road. Accordingly, for the reasons above, the

Court GRANTS in part and DENIES in part the Hospitals’ Motion

for Summary Judgment. ECF No. 24.

The Court GRANTS the Hospitals’ request for declaratory judgment

and DECLARES that the Proscribed Combination, as set forth in the

HHS Bulletin of March 18, 2024, is UNLAWFUL, as it was promulgated

in clear excess of HHS’s authority under HIPAA. See La. Pub. Serv.

Comm’n, 476 U.S. at 374. While the Court DENIES the Hospitals’

request for a permanent injunction, it GRANTS their request for

vacatur and ORDERS that the Proscribed Combination be

VACATED.8

SO ORDERED on this 20th day of June 2024.

8 Such vacatur is not intended to, and should not be construed as, limiting

the legal operability of other guidance in the germane HHS document.