CITIZENS FOR HEALTH; American Association for Health Freedom; American Association of Practicing Psychiatrists; American Mental Health Alliance-USA; American Psychoanalytic Association; National Coalition of Mental Health Professionals and Consumers; New Hampshire Citizens for Health Freedom; Sally Scofield; Ted Koren, DC; Michaele Dunlap, Psy.D.; Morton Zivan, Ph.D.; California Consumer Healthcare Council; Congress of California Seniors; Health Administration Responsibility Project; Daniel S. Shrager; Eugene B. Meyer; Jane Doe; Janis Chester; Deborah Peel, Appellants
v.
*Michael O. LEAVITT, Secretary U.S. Department of Health and Human Services.
No. 04-2550.
United States Court of Appeals, Third Circuit.
Argued March 9, 2005.
Filed October 31, 2005.
COPYRIGHT MATERIAL OMITTED COPYRIGHT MATERIAL OMITTED Robert N. Feltoon, Conrad, O'Brien, Gellman & Rohn, Philadelphia, PA, James C. Pyles [Argued], Powers, Pyles, Sutter & Verville, Washington, DC, Peter D. Winebrake, Trujillo, Rodriguez & Richards, The Penthouse, Philadelphia, PA, for Appellants.
Charles W. Scarborough [Argued], U.S. Department of Justice, Appellate Section, Washington, DC, Mark B. Stern, U.S. Department of Justice, Civil Division, Appellate Staff, Washington, DC, for Appellee.
Stacy A. Fols, Montgomery, McCracken, Walker & Rhoads, Cherry Hill, NJ, for Amicus-appellants The National Association of Social Workers, Inc. and PA Chapter of the National Association of Social Workers.
M. Duncan Grant, Pepper Hamilton, Philadelphia, PA, for Amicus-appellant Program for Psychiatry and the Law at Harvard Medical School.
Jonathan S. Martel, Arnold & Porter, Washington, DC, for Amicus-appellant NARAL Pro-Choice America Foundation.
David P. Felsher, New York, NY, for Amicus-appellants Guenter L. Spanknebel, Leonard Morse, Wayne Glazier, Graham L. Spruiell, and Association of American Physicians and Surgeons, Inc.
Before McKEE, RENDELL and NYGAARD,** Circuit Judges.
RENDELL, Circuit Judge.
Appellant Citizens for Health, along with nine other national and state associations and nine individuals (collectively "Citizens"), brought this action against the Secretary of the United States Department of Health and Human Services ("HHS" or "Agency") challenging a rule promulgated by the Agency pursuant to the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub.L. 104-191, 110 Stat. 1936. Citizens allege that the "Privacy Rule"-officially titled "Standards for Privacy of Individually Identifiable Health Information"-is invalid because it unlawfully authorizes health plans, health care clearinghouses, and certain health care providers to use and disclose personal health information for so-called "routine uses" without patient consent. The relevant part of the specific offending provision of the Privacy Rule reads:
(a) Standard: Permitted uses and disclosures. Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) [relating to psychotherapy notes] and (3) [relating to marketing], a covered entity may use or disclose protected health information for treatment, payment, or health care operations ... provided that such use or disclosure is consistent with other applicable requirements of this subpart.
(b) Standard: Consent for uses and disclosures permitted. (1) A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.
(2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart.
45 C.F.R. § 164.506 (emphasis added). Citizens challenge subsection (a) as authorizing disclosures that, they contend, violate individual privacy rights.
The District Court granted summary judgment to the Secretary on all of Citizens' claims based on its conclusions that the promulgation of the Privacy Rule did not violate the Administrative Procedure Act, that the Secretary did not exceed the scope of authority granted to him by HIPAA, and that, insofar as the Privacy Rule is permissive and does not compel any uses or disclosures of personal health information by providers, it does not affirmatively interfere with any right protected by the First or Fifth Amendments. Because we reason to the same conclusions reached by the District Court, albeit under a slightly different analysis, we will affirm.
I. Background
The objectionable provision is only one aspect of a complex set of regulations that is the last in a series of attempts by HHS to strike a balance between two competing objectives of HIPAA-improving the efficiency and effectiveness of the national health care system and preserving individual privacy in personal health information.
A. HIPAA
HIPAA was passed by Congress in August 1996 to address a number of issues regarding the national health care and health insurance system. The statutory provisions relevant to the issues in this case are found in Subtitle F of Title II.1 Aimed at "administrative simplification," HIPAA Sections 261 through 264 provide for "the establishment of standards and requirements for the electronic transmission of certain health information." § 261,
Section 264 prescribes the process by which standards regarding the privacy of individually identifiable health information were to be adopted. § 264(a),
B. The Privacy Rule
Because Congress did not enact privacy legislation by its self-imposed three-year deadline, the Secretary promulgated the privacy standards contemplated in Section 264 through an administrative rulemaking process. During this process, the Rule went through four iterations: the Proposed Original Rule, the Original Rule, the Proposed Amended Rule, and the Amended Rule.3 The Original Rule required covered entities to seek individual consent before using or disclosing protected health information for routine uses. Standards for Privacy of Individually Identifiable Health Information, 65 Fed.Reg. 82,810 (Dec. 28, 2000) (codified at former 45 C.F.R. pts. 160, 164 (2002)). Before the Original Rule could take effect, however, the Secretary was inundated with unsolicited criticism, principally from health care insurers and providers, warning that the Original Rule's mandatory consent provisions would significantly impact the ability of the health care industry to operate efficiently.4 Standards for Privacy of Individually Identifiable Health Information, 67 Fed.Reg. 14,776, 14,777 (Mar. 27, 2002). He responded by reopening the rulemaking process. Id. at 14,776. The final result was the Amended Rule-the currently effective, codified version of the Privacy Rule, see generally 45 C.F.R. pts. 160 & 164, which is the subject of Citizens' challenge here.5
The Amended Rule retains most of the Original Rule's privacy protections. It prohibits "covered entities"6-defined as health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a transaction covered by the regulations-from using or disclosing an individual's "protected health information"-defined as individually identifiable health information maintained in or transmitted in any form or media including electronic media-except as otherwise provided by the Rule. See 45 C.F.R. §§ 160.103 (defining "covered entities" and "protected health information"), 164.502(a) ("A covered entity may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter."). Covered entities must seek authorization from individuals before using or disclosing information unless a specific exception applies. Id. § 164.508(a)(1) ("Authorization required: general rule. Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section."). Uses and disclosures that the Amended Rule allows must be limited to the "minimum necessary" to accomplish the intended purpose. Id. § 164.502(b).
The Amended Rule departs from the Original Rule in one crucial respect. Where the Original Rule required covered entities to seek individual consent to use or disclose health information in all but the narrowest of circumstances,7 the Amended Rule allows such uses and disclosures without patient consent for "treatment, payment, and health care operations"-so-called "routine uses." Id. §§ 164.506 (providing routine use exception). "Health care operations," the broadest category under the routine use exception, refers to a range of management functions of covered entities, including quality assessment, practitioner evaluation, student training programs, insurance rating, auditing services, and business planning and development. Id. § 164.501. The Rule allows individuals the right to request restrictions on uses and disclosures of protected health information and to enter into agreements with covered entities regarding such restrictions, but does not require covered entities to abide by such requests or to agree to any restriction. Id. § 164.522(a). The Rule also permits, but does not require, covered entities to design and implement a consent process for routine uses and disclosures. Id. § 164.506; see also Standards for Privacy of Individually Identifiable Health Information, 67 Fed.Reg. 53,182, 53,211 (Aug. 14, 2002).
Importantly, the Rule contains detailed preemption provisions, which are consistent with HIPAA Sections 1178(a)(2)(B) and 264(c)(2). These provisions establish that the Rule is intended as a "federal floor" for privacy protection, allowing state law to control where a "provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under [the Privacy Rule]." 45 C.F.R. § 160.203 (emphasis added).8
II. Procedural History
Citizens filed this action on April 10, 2003. In its Amended Complaint, Citizens alleged that the Secretary violated the APA and Sections 261 through 264 of HIPAA in promulgating the Amended Rule, and that, to the extent that the Amended Rule rescinded or eliminated the need for consent for the use and disclosure of individually identifiable health information for "routine uses," the Amended Rule violated privacy rights protected by the Fifth Amendment and free speech rights protected by the First Amendment of the United States Constitution. Citizens for Health v. Thompson,
On Citizens' APA claims, the Court concluded that the Secretary had adequately informed the public regarding the proposed rulemaking, examined the relevant data, responded to public comments, and provided a reasoned analysis that rationally connected the facts with the decision to rescind the consent requirement in the Amended Rule. Id. at *33-43. Regarding Citizens' claims alleging violations of HIPAA, the Court concluded that the changes in the Amended Rule were reasonably related to the legislative purpose of Subtitle F of the Act, and, because the Amended Rule was promulgated before the Original Rule took effect, the Amended Rule did not eliminate any "rights" created under the Original Rule. Id. at *43-46. Finally, regarding Citizens' constitutional claims, the Court concluded that because (1) neither the First Amendment nor the Fifth Amendment places an affirmative obligation on the State to protect individuals' rights from harm by third parties and (2) the Amended Rule is wholly permissive as to whether covered entities seek consent from an individual before using or disclosing personal health information for routine uses, the Amended Rule did not violate individual rights under either Amendment. Id. at *46-50.
III. Jurisdiction and Standard of Review
The District Court had jurisdiction under 28 U.S.C. § 1331, and we have jurisdiction to review the final decision of the District Court under 28 U.S.C. § 1291. We exercise plenary review over the District Court's grant of summary judgment, applying the same test as the District Court. Goodman v. Mead Johnson & Co.,
IV. Discussion
On appeal, Citizens reassert the claims they made before the District Court, that the Secretary, by promulgating the Privacy Rule, (1) unlawfully infringed Citizens' fundamental rights to privacy in personal health information under due process principles of the Fifth Amendment of the United States Constitution; (2) unlawfully infringed Citizens' rights to communicate privately with their medical practitioners under the First Amendment of the Constitution; (3) contravened Congress's intent in enacting HIPAA by eliminating Citizens' reasonable expectations of medical privacy; and (4) violated the APA by arbitrarily and capriciously reversing a settled course of behavior and adopting a policy that he had previously rejected.
Before addressing Citizens' claims on the merits, we note that we raised the issue of justiciability at oral argument, and asked the parties for separate briefing on this issue. Our concern was that, in their complaint, the party plaintiffs do not recount specific instances of violations of their privacy rights traceable to the regulation, but, instead, complain of the regulation's general effect. After reviewing the parties' responses to our questions, however, we are satisfied that these specific instances do, in fact, exist, notwithstanding the general allegations in the complaint.9 We therefore proceed to address each of Citizens' claims in turn.
A. Fifth Amendment Substantive Due Process Claim
In discussing Citizens' Fifth Amendment claim, the District Court noted that substantive due process bars the government from depriving individuals of life, liberty, or property without due process of law, but it does not "`impose an affirmative obligation on the State to ensure that those interests do not come to harm through other means.'" Citizens for Health,
We begin our analysis with the premise that the right to medical privacy asserted by Citizens is legally cognizable under the Due Process Clause of the Fifth Amendment, although, as Citizens themselves concede, its "boundaries ... have not been exhaustively delineated." (Appellants' Br. at 12.)10 Whatever those boundaries may be, it is undisputed that a violation of a citizen's right to medical privacy rises to the level of a constitutional claim only when that violation can properly be ascribed to the government. The Constitution protects against state interference with fundamental rights. It only applies to restrict private behavior in limited circumstances. Because such circumstances are not present in this case, and because the "violations" of the right to medical privacy that Citizens have asserted, if they amount to violations of that right at all, occurred at the hands of private entities, the protections of the Due Process Clause of the Fifth Amendment are not implicated in this case. We will accordingly affirm the District Court's finding that the Secretary did not violate Citizens' constitutional rights when he promulgated the Amended Rule.
"The Constitution structures the National Government, confines its actions, and, in regard to certain individual liberties and other specified matters, confines the actions of the States. With a few exceptions, ... constitutional guarantees of individual liberty and equal protection do not apply to the actions of private entities." Edmonson,
At first glance, the posture of this case seems different from that of most state action cases. The issue of state action usually arises where plaintiffs assert that their rights have been violated by private parties who, they claim, are acting on behalf of the state. E.g., Jackson v. Metro. Edison Co.,
As noted above, the District Court touched on the state action issue when it applied DeShaney's holding that due process does not impose an affirmative obligation on the State to protect individuals' interests in life, liberty, or property from harm inflicted by private actors. See
In this case, DeShaney helps resolve a preliminary question: Was the Secretary obliged to prohibit any and all disclosures without consent in order to protect privacy rights across the board? We think the District Court appropriately relied on DeShaney to answer that question in the negative. But DeShaney does not reach the specific question before us: Is the nonconsensual use or disclosure of individual health information by private parties, as permitted by the Amended Rule, legally attributable to the Secretary? We conclude that it is not.
To answer this question, we must determine "whether there is a sufficiently close nexus between the State and the challenged action of the regulated entity [-the private party-] so that the action of the latter may fairly be treated as that of the State itself." Jackson,
The Supreme Court provided guidance as to what satisfies the Constitution's state action requirement in Adickes v. S.H. Kress & Co.,
The first inquiry, then, is whether the Amended Rule can fairly be read to "require," "compel," or "command" routine use disclosures without consent. We conclude that it cannot. The fact that subsection (b) of the Rule expressly permits covered entities to obtain consent belies such an interpretation. See 45 C.F.R. § 164.506(b)(1) ("A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.") (emphasis added). Thus, the Amended Rule does not directly "provide a mantle of authority that enhance[s] the power of" health care providers and other entities, Tarkanian,
Citizens argue that the Amended Rule's grant of "regulatory permission" to make the challenged uses and disclosures, see, e.g., 67 Fed.Reg. at 53,209, 53,211, 53,212 (discussing Amended Rule), indirectly provides the requisite "mantle of authority". To demonstrate a link between the Amended Rule and private parties' use and disclosure of Citizens' health information without their consent, Citizens point to two sources: (1) changes in the privacy policies of covered entities, and (2) evidence that some entities have begun ignoring applicable state privacy laws. On the first point, Citizens have identified at least one covered entity that has adopted a blanket policy of refusing all requests for restrictions on uses and disclosures of health information since the promulgation of the Amended Rule.13 They further assert that some covered entities have simply ignored applicable, more restrictive, state laws in making such uses and disclosures.14
Our reading of the case law discussed below, however, leads us to the conclusion that the fact that a private party changed its behavior in response to a law does not give the law the coercive quality upon which the state action inquiry depends unless the law itself suddenly authorized something that was previously prohibited. Citizens' argument assumes (1) that covered entities were previously prohibited from making nonconsensual uses or disclosures for routine uses and (2) that the Amended Rule's "authorization" somehow permits uses or disclosures that were previously "unauthorized". But there is no authority for either proposition. Citizens have not shown that federal law prohibited nonconsensual uses or disclosures of health information before the Rule was promulgated.15 And the preemption provisions of HIPAA and the Amended Rule expressly provide that any state statutes that prohibited such uses and disclosures before the Amended Rule was promulgated remain in effect.16 Because there is no indication that the nonconsensual uses and disclosures permitted by the Amended Rule were prohibited before the Rule went into effect, we have difficulty understanding how the Amended Rule "authorizes" covered entities to take action that they could not have otherwise taken. In the words of the Tarkanian test, Citizens have not shown how, by promulgating the Amended Rule, the Secretary "enhanced the power" of the covered entities to use or disclose health information without patients' consent; covered entities had this power already.
By way of analogy, assume that Congress were to pass legislation permitting private cinema operators, at their discretion, to search all moviegoers for any reason, without any showing of probable cause or reasonable suspicion. Although the Fourth Amendment would preclude the federal government from conducting such a search, private cinema operators are not bound by the Fourth Amendment, and absent any other law prohibiting it, private cinema operators were already "permitted" to conduct such a search before the new legislation took effect. To the extent that this new legislation changes the legal landscape at all, then, it only codifies a power that cinema operators had already. The codification does not transform the private exercise of the codified power into "state action." Similarly, although the codification itself is clearly government action, it seems insufficient to endow a moviegoer's challenge to a search by a cinema operator with constitutional significance given that the codification has neither enhanced nor diminished the individual moviegoer's rights.
None of the cases that Citizens or amici cite supports the view that a government authorization of conduct that was already legally permissible satisfies the constitutional state action requirement. It is true that these cases find state action based on the enactment of statutes that permit private parties to infringe the constitutional rights of others.17 But the laws that the Supreme Court has struck down in these cases allowed private parties to take some action (usually discrimination based on race) where they would otherwise have been prohibited from doing so. In other words, the Court found that the state, by enacting these laws, had "empowered" private parties to act in ways that would have been prohibited but for the enactment of the law. As we explained above, that is not the case here.
The Supreme Court's decision in Reitman v. Mulkey,
The United States Supreme Court affirmed the judgment of the California Supreme Court. The Court rejected petitioners' argument that the state court's reasoning was flawed because it meant that the mere repeal of a statute that prohibited private racial discrimination could be said to "authorize" or "encourage" discrimination simply because it permitted that which was formerly proscribed, pointing out that the challenged state action in case was not "the mere repeal" of prior anti-discrimination laws. Id. at 376,
Private discriminations in housing were now not only free from [the previously enacted anti-discrimination statutes] but they also enjoyed a far different status than was true before the passage of those statutes. The right to discriminate, including the right to discriminate on racial grounds, was now embodied in the State's basic charter, immune from legislative, executive, or judicial regulation at any level of the state government. Those practicing racial discriminations need no longer rely solely on their personal choice. They could now invoke express [state] constitutional authority, free from censure or interference of any kind from official sources.
Id. at 380-81,
The Reitman Court elaborated on this principle by referring to its ruling in Nixon v. Condon,
the Court was faced with a statute empowering the executive committee of a political party to prescribe the qualifications of its members for voting or for other participation, but containing no directions with respect to the exercise of that power. This was authority which the committee otherwise might not have had and which was used by the committee to bar Negroes from voting in primary elections. Reposing this power in the executive committee was said to insinuate the State into the self-regulatory, decision-making scheme of the voluntary association; the exercise of the power was viewed as an expression of state authority contrary to the Fourteenth Amendment.
Reitman,
The Amended Rule has not enhanced covered entities' power, under federal or state law, to use or disclose confidential health information without patients' consent. The Rule does not "compel" or "command" or "require" that private entities use information without patients' consent. See Adickes,
The fact that covered entities are construing the "may use" language as constituting a new federal seal of approval, and may be ignoring state laws regarding protections to be afforded to such information, is regrettable and disquieting. That routine requests for privacy are apparently being ignored by covered entities is even more unfortunate. But our task here is to determine the constitutionality of the Amended Rule, not the propriety of covered entities' actions under state or common law. Because, for all of the reasons stated above, the covered entities' actions that Citizens challenge do not implicate the federal government, we reject Citizens' Fifth Amendment claim.
B. First Amendment Claim
Citizens' First Amendment claim is that the Amended Rule infringes individuals' right to confidential communications with health care practitioners, i.e., a right to refrain from public speech regarding private personal health information. Citizens argue that the effect of the Amended Rule is to chill speech between individuals and their health care practitioners because the possibility of nonconsensual disclosures makes individuals less likely to participate fully in diagnosis and treatment and more likely to be evasive and withhold important information. Further, because the Rule applies to "health information ... whether oral or recorded in any form or medium ...," 45 C.F.R. § 160.103, Citizens argue that the Rule is a content-based regulation reviewable under strict scrutiny.
We believe that a First Amendment claim is an ill-suited challenge to the Amended Rule. Cf. South Carolina Med. Ass'n v. Thompson,
C. Claims Alleging Violations of HIPAA
In claims based on HIPAA's statutory language, Citizens argue (1) that the Secretary exceeded the regulatory authority delegated by HIPAA because the Act only authorizes the Secretary to promulgate regulations that enhance privacy and (2) that the Amended Rule impermissibly retroactively rescinded individual rights created by the Original Rule and disturbed Citizens' "settled expectations" in the privacy of their health information. We find the District Court's analysis of these statutory claims to be cogent. Citizens argue that the Secretary has eliminated their reasonable expectations of medical privacy retroactively and prospectively and that such action is inconsistent with Congress's intent in enacting HIPAA. However, Citizens' argument that the controlling policy underlying HIPAA is medical privacy and that the Amended Rule wholly sacrifices this interest to covered entities' interests in efficiency and flexibility ignores the Act's stated goals of "simplify[ing] the administration of health insurance," HIPAA pmbl.,
We also agree with the District Court's finding that the Amended Rule does not retroactively eliminate rights that Citizens enjoyed under the Original Rule or under various laws or standards of practice that existed before the Amended Rule went into effect. Because the Original Rule was amended before its compliance date, "[c]overed entities were never under a legal obligation to comply with the Original Rule's consent requirement." Id. at *45-46. Citizens, therefore, never enjoyed any rights under the Original Rule at all. Nor does the Amended Rule retroactively eliminate Citizens' reasonable expectations based on state law, standards of medical ethics and established standards of practice because the Amended Rule does not disturb any preexisting, "more stringent" state law privacy rights. See id. at *45-46. See also Standards for Privacy of Individually Identifiable Health Information, 67 Fed.Reg. 53,182, 53,212 (Aug. 14, 2002) ("State laws that are more stringent [than the Privacy Rule] remain in place. In order not to interfere with such laws and ethical standards, this Rule permits covered entities to obtain consent. Nor is the Privacy Rule intended to serve as a `best practices' standard. Thus, professional standards that are more protective of privacy retain their vitality." (emphasis added)). Accordingly, we reject Citizens' second HIPPA claim as well, and will affirm the grant of summary judgment to the Secretary on these claims.
D. APA Claims
Lastly, Citizens challenge the rulemaking process under the APA, contending that (1) the Secretary's rulemaking was arbitrary and capricious, in violation of 5 U.S.C. § 706(2)(A), and (2) the Secretary failed to provide adequate notice of the rescission of the consent requirement of the Original Rule, a violation of 5 U.S.C. § 553(b)(3). Citizens argue that the Secretary acted arbitrarily and capriciously by failing to adequately explain the rescission of the consent requirement, ignoring earlier findings, and failing to respond to public comments.
We dispose of Citizens' argument that the Secretary did not provide adequate notice to the public of his intention to rescind the consent requirement first. On this point, the District Court correctly pointed out that the APA requires a notice to provide either "the terms or substance of the proposed rule" or "a description of the subjects and issues involved." Citizens for Health,
We also reject Citizens' claim that the Secretary acted arbitrarily and capriciously in promulgating the Amended Rule. Citizens argue that the Secretary acted arbitrarily and capriciously in promulgating the Amended Rule by improperly reversing a "settled course of behavior" established in the Original Rule and adopting a policy that he had previously rejected. When an agency rejects a "settled course of behavior," however, it need only supply a "reasoned analysis" for the change to overcome any presumption that the settled rule best carries out the policies committed to the agency by Congress. Motor Vehicle Mfrs. Ass'n v. State Farm Mut. Auto. Ins. Co.,
Here, the Secretary examined the relevant data, see Citizens for Health,
In sum, the Secretary's decision to respond to the unintended negative effects and administrative burdens of the Original Rule by rescinding the consent requirement for routine uses and implementing more stringent notice requirements was explained in a detailed analysis that rationally connected the decision to the facts. "Normally, an agency rule would be arbitrary and capricious if the agency has relied on factors which Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so implausible that it could not be ascribed to a difference in view or the product of agency expertise." Id. at *43. The Secretary has not failed in any of these respects, and, hence, we agree with the District Court's analysis and conclusion that the Secretary's decision was reasonable given the findings and that the Secretary did not act arbitrarily and capriciously in violation of the APA. Accordingly, we will affirm the grant of summary judgment to the Secretary on these claims.
V. Conclusion
For the reasons set forth above, we will AFFIRM the judgment of the District Court.
Notes:
Notes
Amended Per Court's Order dated 2/4/05 Pursuant to F.R.A.P. 43(c)(2)
Since the date of argument Judge Nygaard has assumed senior status
HIPAA Title II, Subtitle F comprises sections 261 through 264. Section 261, codified at 42 U.S.C. § 1320d note, states the purpose of the Subtitle. Section 262 amends Title XI of the Social Security Act, 42 U.S.C. § 1301et seq., to add Part C, "Administrative Simplification," with sections 1171-1179, codified at 42 U.S.C. §§ 1320d to 1320d-8. Section 263 amends the Public Health Service Act at 42 U.S.C. § 242k(k). Section 264, discussed infra, is codified at 42 U.S.C. § 1320d-2 note. See South Carolina Med. Ass'n v. Thompson,
Section 264(c)(2) is cross-referenced in HIPAA § 1178, which provides that HIPAA generally preempts provisions of state law except,inter alia, where a provision of state law, "subject to section 264(c)(2) of the Health Insurance Portability and Accountability Act of 1996, relates to the privacy of individually identifiable health information." § 1178(a)(2)(B),
The District Court explored the regulatory history of the Privacy Rule in detailSee Citizens for Health v. Thompson,
According to the Secretary, some of the "more significant examples and concerns" that commenters raised in connection with the Original Rule were that the prior consent requirement for routine disclosures would bar pharmacists from filling prescriptions and searching for potential drug interactions before patients arrived at the pharmacy, it would interfere with the practice of emergency medicine in cases where it would be difficult or impossible to obtain patient consent before treatment, and it would delay the scheduling of and preparation for hospital procedures until the patient provided the required consent. Standards for Privacy of Individually Identifiable Health Information, 67 Fed.Reg. 53,182, 53,209 (Aug. 14, 2002)
The Amended Rule took effect on April 14, 2003, the same date that had been set for compliance with the Original Rule. 45 C.F.R. § 164.534
The statutory language, as well as the Rule, limits the applicability of the provisions of the Rule to "covered entities"See HIPAA § 262(a) (amending § 1172(a) of the Social Security Act) (codified at 42 U.S.C. § 1320d-1).
Health care providers who had indirect treatment relationships with an individual and those who created or received health information in the course of treating inmate patients were exempt from the Original Rule's consent requirement. 65 Fed.Reg. 82,462, 82,810. In addition, the Original Rule allowed providers to proceed without consent in situations where they had a legal obligation to provide treatment and attempts to obtain consent had failed,e.g., in emergency situations, or where a provider's attempts to obtain explicit consent were thwarted by a substantial communication barrier, but the provider could properly infer such consent from the circumstances. Id.
The regulations define the following terms with the following meanings:
"More stringent" means, in the context of a comparison of a provision of State law and a standard, requirement, or implementation specification adopted under [the Privacy Rule], a State law that meets one or more of the following criteria:
(1) With respect to a use or disclosure, the law prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under this subchapter, except if the disclosure is:
(i) Required by the Secretary in connection with determining whether a covered entity is in compliance with this subchapter; or
(ii) To the individual who is the subject of the individually identifiable health information.
(2) With respect to the rights of an individual, who is the subject of the individually identifiable health information, regarding access to or amendment of individually identifiable health information, permits greater rights of access or amendment, as applicable.
(3) With respect to information to be provided to an individual who is the subject of the individually identifiable health information about a use, a disclosure, rights, and remedies, provides the greater amount of information.
(4) With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission, as applicable.
(5) With respect to recordkeeping or requirements relating to accounting of disclosures, provides for the retention or reporting of more detailed information or for a longer duration.
(6) With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information.
"Relates to the privacy of individually identifiable health information" means, with respect to a State law, that the State law has the specific purpose of protecting the privacy of health information or affects the privacy of health information in a direct, clear, and substantial way. "State law" means a constitution, statute, regulation, rule, common law, or other State action having the force and effect of law.
C.F.R. § 160.202
To satisfy Article III's justiciability requirement, "plaintiffs must demonstrate that they have suffered an injury-in-fact, that the injury is causally connected and traceable to an action of the defendant, and that it is redressable."The Pitt News v. Fisher,
With respect to the "traceability" prong of the justiciability requirement, we conclude that Citizens' alleged injury is traceable to the promulgation of the Privacy Rule for two reasons. First, notices that plaintiffs received from covered entities such as Kaiser Permanente, Eckerd Drugs and Genovese Drugs, and Blue Cross/Blue Shield of Delaware explain the entities' intent to use and disclose plaintiffs' health information without consent (i.e., the sources of the alleged injury at the heart of this case) using language lifted directly from the Privacy Rule itself. Second, plaintiff's statement in her affidavit that her ability to restrict the use and disclosure of her health information changed after April 14, 2003, the Privacy Rule's effective date, Citizens for Health,
We emphasize that, as justiciability is a "threshold" matter, The Pitt News,
We express no opinion here on the scope of the federal constitutional right to medical privacy, or on whether the injury asserted by Citizens, if it were directly attributable to a state actor, would amount to a constitutional violation. Citizens assert in their brief that "the right ... to not have [ones'] personal and identifiable health information made public or disclosed to numerous government employees in routine situations is a fundamental right implicit in the concept of ordered liberty and deeply rooted in the Nation's history." (Appellants' Br. at 20.) But the question of the scope of the constitutional right to privacy in one's medical information is largely unresolvedSee, e.g., Whalen v. Roe,
In a due process claim brought under the Fifth Amendment, the "State" in the state action analysis is the federal governmentSee Malloy v. Hogan,
To be sure, Citizens and amici curiae have referred to other actions on the part of the federal government besides the promulgation of the Amended Rule that they believe violate the Fifth Amendment in their arguments before this court. For instance, they argue in their briefs that, as the supervisor of a number of federal programs that qualify as "health plans" under HIPAA-including Medicare, Medicaid, and the Indian Health Services Programs-under the Amended Rule, HHS could make disclosures of protected health information as a covered entity. (Amici Supp. Br. at 6.) However, Citizens here challenge the Secretary's promulgation of the Privacy Rule, not specific disclosures by HHS or any of the federal agency "health plans" that it supervises. Whether a challenge to such specific disclosures would satisfy the Constitution's state action requirement thus remains outside the scope of this appeal
(See Appellants' Br. at 26 (quoting Kaiser Permanente's Notice of Privacy Practices ("You may request that we limit our uses and disclosures of your [personal health information] for treatment, payment, and health care operations purposes. However, by law, we do not have to agree to your request. Because we strongly believe that this information is needed to appropriately manage the care of our members/patients, it is our policy to not agree to requests for restrictions.")).)
Citizens noted in their Reply Brief:
As Plaintiffs noted at oral argument before the District Court, covered entities in Pennsylvania and Delaware are using and disclosing Plaintiffs' health information without consent under the authority granted by the Amended Rule despite a Delaware law that prohibits such disclosures without "informed consent of the individual" and a Pennsylvania law that deems it "unprofessional conduct" and a licensure violation for a licensed health professional to "depart from or fail[ ] to conform to an ethical or quality standard of the profession."
(Appellants' Reply Br. at 6 n.7 (citations omitted).) We note that, to the extent that these contentions are accurate, Citizens are free to pursue these covered entities directly under state law. That private entities are violating Citizens' state statutory rights does not in any way imply that the Secretary has violated Citizens' constitutional rights.
Citizens rely on Federal Rule of Evidence 501 and the recognition of common law evidentiary privileges establishing special treatment for such information to establish that the uses and disclosures "authorized" by the Rule were prohibited before its promulgation. (Appellants' Reply Br. at 15.) But the Rule of Evidence and the common law of privilege are just evidentiary rules. They are not Acts of Congress or regulations that prohibit disclosure outside of court proceedings or otherwise provide Citizens with some affirmative "right" against disclosure of their information by private parties without their consent
Citizens contend that a number of otherwise "more stringent" state laws provide exceptions for disclosures that are "authorized" or "permitted" by federal law. (See Appellants' Reply Br. at 13-14 & n.9.) Whether or not that is the case, the fact remains that the Secretary has repeatedly emphasized that the Privacy Rule defers to states that impose stringent consent requirements. See, e.g., Standards for Privacy of Individually Identifiable Health Information, 67 Fed.Reg. 53,182, 53,212 (Aug. 14, 2002) ("The Privacy Rule provides a federal floor of privacy protection. State laws that are more stringent remain in force."); Notice of Proposed Rulemaking, Standards for Privacy of Individually Identifiable Health Information, 64 Fed.Reg. 59,918, 59,997 (Nov. 3, 1999) ("We recognize that many State laws require patients to authorize or consent to disclosures of their health information for treatment and/or payment purposes. We consider individual authorization generally to be more protective of privacy interests than the lack of such authorization, so such State requirements would generally stand...."). We take the Secretary's assurances that the Privacy Rule leaves pre-existing state law privacy rights in place at face value, particularly in light of the express non-preemption provisions for "more stringent" state laws in HIPAA and the Privacy Rule. As such, we do not read the Rule to "authorize" or "permit" disclosures that state laws would otherwise prohibit. Cf. Fidelity Fed. Sav. & Loan Ass'n v. de la Cuesta,
(Amicus Br. of Texas Civil Rights Project at 11-14 (citingReitman v. Mulkey,
The Court reiterated this reasoning at the conclusion of the majority opinion:
Here we are dealing with a provision which does not just repeal an existing law forbidding private racial discriminations. [The amendment] was intended to authorize, and does authorize, racial discrimination in the housing market. The right to discriminate is now one of the basic policies of the State. The California Supreme Court believes that the [amendment] will significantly encourage and involve the State in private discriminations. We have been presented with no persuasive considerations indicating that these judgments should be overturned.
Reitman,