*1 Barnes, J., concur. Andrews, J., Judgment P. affirmed. July 13, 2006.
Decided Beauchamp, Shamp, for Shamp, M. Robert M. Laura & Brown appellants. Aldridge, Long Langley, McKenna, &
Langley Lee, Carl R. & Bradley, appellees. Phillip for A. CENTER, QUEEN. LLC v. MEDICAL NORTHLAKE
A06A0540. 486) (634 SE2d Ruffin, Judge. Chief against malpractice brought North- action a medical Queen Linda to dismiss Northlake moved Center, LLC and others. Medical lake comply complaint medical record failure to Queen’s requirement denied The trial court § 9-11-9.2. of OCGA release preempted concluding 9-11-9.2 was motion, § Accountability that OCGA Portability 1996, Pub. L. Act of Insurance Health (“HIPAA”), to file a was not Queen and thus No. 104-191 compliance with the release authorization medical record interlocutory appeal, application granted Northlake’s statute. We preempts is one of the issue of whether impression. first argues (1) appeal, form the authorization Northlake
On comply complaint 9-11-9.2; did not with OCGA Queen’s filed with preempt compliance (2) with that statute. We HIPAA does not legal ruling on a the trial court’s de novo review of conduct a question.1 filed with Queen the authorization First, address whether
1. complaint requirements. statutory Georgia’s satisfies her (a) release authorization a medical record § 9-11-9.2 action. in a medical must be filed with form as follows: of the authorization the content The statute describes attorney repre- (b) that the shall The authorization senting to obtain and disclose is authorized the defendant in medical records contained and defense of evaluation to facilitate (3) 535) (2003). Robinson, App. (580 Transp. SE2d Dept. v. 260 Ga. See claims
pertain applicable, plaintiffs or, to the where complaint. decedent whose treatment issue in the This attorney’s right authorization includes the defendant’s plaintiff or, discuss care and treatment where applicable, plaintiffs decedent with all treating physicians. or decedent’s
(c) provide The authorization shall for the release of all except health information information that privileged considered and shall authorize the release ofsuch any physician facility by or health which health care of records or the decedent would be maintained.2 malpractice complaint unaccompanied
A medical such autho- subject rization is to dismissal.3 complaint reprints
The which Queen authorization filed with her entirety text above statute its but does not state that agreeing statutory requirements. Queen is to the fact, the autho adopts opposite position, recipient rization provider may provide that the health care only attorneys, Queen’s
medical records attorneys. expressly to Northlake’s The authorization states that preempts including Queen law, “maintains that [HIPAA] State recipient “you ofOCGA §9-11-9.2”and advises the that are requested not to furnish of such form to anyone, express my without written authorization from me or attor neys.”
The authorization filed with Queen’s does not attorneys that Northlake’s are authorized to “obtain and disclose protected health information contained in medical or records” treating physicians discuss her care and treatment with her in order to “facilitate the evaluation and defense of the claims complaint.” Thus, the authorization clearly satisfy does not Queen’s subject pre would be to dismissal unless the statute is empted. preempts Therefore, must determine whether HIPAA OCGA § 9-11-9.2. integrity
2. The intent of HIPAA is “to ensure the and confiden- tiality patients’ protect against of information and to unauthorized promulgating uses or disclosures of the information.”4 The rules 2 OCGA § 9-11-9.2. 4 (Punctuation omitted.) Id. at (a). In VioxxProducts re Liability Litigation, 230 FRD 473, 477 (E.D. “pro govern HIPAA, the disclosure forth in standards set collectively providers, are care information”
tected health any provi expressly preempts Rule.”6 as “the known provisions HIPAA.7 to the sion of state provider the consent HIPAA, must obtain a health Under disclosing protected using health information.8 before generally the disclosure authorization is Prior written party.9 A to a third valid following elements: must contain description
(i) to be used or disclosed A the information specific meaningful in a the information identifies fashion. person(s), specific
(ii) name or other identification of requested persons, use or to make the or class of authorized disclosure. person(s), specific
(iii) identification ofthe The name or other entity may persons, make to whom the covered class requested use or disclosure. *3 requested
(iv) description purpose or A each use request the “at the individual” disclosure. statement description purpose a when an individual is sufficient not, to, and does or elects not initiates authorization purpose. provide a statement of the
(v) expiration expiration or an event that relates to An date purpose or the use . . . the individual or disclosure. (vi)Signature and date. If the authorization the individual signed by personal representative individual, a is (2) (A), 2005) (d) (B) (ii)). (citing La. 42 USC 1320d-2 § 5 includes Protected health information medium, (1) in or that: is whether oral or recorded form plan, authority, provider, public health created a health care or received insurer, clearinghouse; (2) employer, university, or health care life school or past, present, physical future or mental health or condition of an relates to the or individual; past, present, individual; provision of health to an payment provision future for the of health care to an individual. 45 CFR 160.103. 6 &c., (I) (A) (N.J. Super. 2003). A2d Smith v. American Home Products 855 611 7 (a) (1); 1320d-7 45 CFR 160.203. See USC (b)-(c). See 45 164.506 CFR § 9 See 45 164.508. CFR description representative’s authority of such act for to provided.10 individual must also be put right
The authorization must also on to notice his revoke authorization. argues preempt OCGA§ Northlake that HIPAAdoes not possible not it because state law does contravene HIPAA and is comply with HIPAA Queen, both and OCGA 9-11-9.2. on the other preempted hand, contends that the is it statute because does not require necessary that the elements a valid authorization under present an authorization under OCGA 9-11-9.2. analysis two-step
We conduct to determine whether a state law preempted by First, is HIPAA.12 we must decide whether state contrary compliance HIPAA; is, law that whether with both the impossible state and federal rules would be or if the state law is accomplishment purposes “obstacle and execution of the full objectives” contrary of the federal rules.13 If the state exceptions preemp- HIPAA, then we ascertain whether one of the applies.14 tion
*4 Here, we conclude that the authorization set forth in OCGA satisfy § 9-11-9.2 is to HIPAA because it does not requirements First, for valid HIPAA authorization.15 require description statute does not “[a] theof information to be used specific or disclosed that identifies the and mean- ingful way permit discovery It fashion.”16 is worded such a regardless of all ofthe they s records, ofwhether are specific, relevant to the medical case. This is not the meaningful identification of the information to be disclosed as con- templated by Next, HIPAA. does expiration expiration “[a]n date or an event that relates to the purpose finally, individual or the And, use or disclosure.”17 it does not contain notice of a to revoke the authorization.18 urges require Northlake us to read OCGA§ 9-11-9.2 to a HIPAA- compliant because, statute, as a newer it should be conjunction existing require read would, however, law. This us [10] [11] [12] 13 45 CFR 160.202. [15] [14] [17] [16] [18] Id. at See id. at Id. at See In re Diet See id. at Id. at See 45 See 45 CFR 164.508 (c) (1) (i). (c) (1) (v). (c) (1) (i)-(vi). CFR (e) (2) (i). (c) (2) Drug Litigation, 160.203; (i). (c) (1), (2). Law v. Zuckerman, [895] A2d 493, [307] [501] FSupp.2d 705, (N.J. Super. 2005). [709] (A) (D. Md. 2004). 514 HIPAA, but to light section in interpret to Code merely
not in the statute. It found nowhere affirmatively provisions add several we conclude to statutes.19 Because function rewrite is not the court’s exceptions HIPAA and none of contrary is to OCGA by HIPAA.21 preempted it is applies,20 in 45 160.203 contained CFR health forth methods disclosure HIPAA does set HIPAA-compliant no proceedings.22 Where judicial information in re- exists, permitted is either disclosure written authorization “subpoena, response discovery or to a to a court order sponse to sought pursuant If disclosure is process.”23 other lawful request, or process accompa- other lawful not discovery request, or subpoena, order, entity whom the information is court then the from nied . . . satisfactory party must “receive assurance sought [ ] been made that reasonable efforts have seeking qualified is a provide to notice to the or there party” such protective place.24 order case, amicus curiae in this Georgia, Association of as
The Medical necessary is because HIPAA-compliant that no asserts process” contemplated by 45 9-11-9.2 constitutes “lawful OCGA § regula- this (1) (ii). promulgating 164.512 The Final Rule (e) CFR § tion states: to dis- in this are not intended paragraph
[t]he whereby party current an individual who is a rupt practice his or at proceeding put to a and has her condition consenting production prevail issue will not without cases, her In such his or health information.
A.
Act: A Practical Guide to Promote Order
(Punctuation omitted.)
740-742
247 Ga.
Coley, Hoffman,
[20]
[19]
need
controlled substances.
if it is
reporting
surveillance,
monitoring
A state law otherwise
Id.
See
See 45
See
See 45 CFR 164.512
designed
(2004).
Law, supra.
State
related to
necessary
(B).
(ii) (A), CFR §
access to information
App. 392,
v.
and evaluation
disease, injury,
Fielden,
report
164.512
public
Smith, supra
Standards
prevent
[398]
health
515 presume parties ample oppor- will have notice tunity object proceeding in the context of the in which the party.25 individual
Clearly, contemplates process in which disclosures are may object particu- patient limited to relevant and a scope inquiry.26 lar exceed the disclosures that relevant OCGA provides process. herein, 9-11-9.2 no such As discussed it does not any way may limit in health information which by plaintiff might And disclosed. object it offers no mechanism which a completely to the disclosure of even irrelevant information. process” Thus, we cannot find that this statute constitutes “lawful within the context of HIPAA. Judgment Phipps, Johnson, J., Barnes, P. Miller and affirmed. specially.
JJ., J., Bernes, Andrews, J., concur. concurs P. dissents.
Bernes, Judge, concurring specially. judgment majority
I concur in the reached that OCGA preempted by Portability § 9-11-9.2 the Health Insurance Accountability (“HIPAA”). 1996, Act of Pub. L. However, No. 104-191 separately agree analysis, except I write because I with the dissent’s requirement for the discussion theof HIPAA that the written autho- put right rization on notice of the to revoke the authori- (c) (2). zation. See 45 CFR 164.508 Because OCGA 9-11-9.2 does agree authorization, contain notice of the to revoke the I majority preempts with the that HIPAA it. Judge, Presiding dissenting.
ANDREWS,
I respectfully dissent. Assembly 2005, the General amended the Official Code of inserting section, 9-11-9.2, new Code for the purpose improving plaintiffs’ “defendants’ access to health infor- cases____” malpractice p. pp. mation in 2005, medical 1; 4-5, Ga. L. § 4. preempted At issue in this case is whether OCGA 9-11-9.2 is designed protect privacy federal known as Portability Accountability the Health Insurance ofAct 1996 (HIPAA).27 malpractice against
When Queen Linda filed her action (Northlake), provided Northlake Medical Center that Queen was to file a medical authorization with the 25 Reg. 82462, 65 Fed. 82530. 26 Bayne Provost, 234, FSupp.2d (N.D. 2005); Croskey See v. 359 241-243 v. N.Y. BMW of America, (E.D. 2005); North 2005 U. S. Dist. LEXIS 43442 *32-33 Mich. v. Crenshaw MONY Co., FSupp.2d (E) (1) (S.D. 2004). Ins. Cal. Life 104-191, Pub. L. codified in various sections of United States Code. “pro- attorney authorizing complaint Queen’s to obtain Northlake’s physicians or health care facilities health information” tected and defense evaluation Northlake’s facilitate (a) that failure further OCGA§ claim. subjects to dismissal. As the authorization (or attorneys) clearly majority opinion delib- shows, her Queen subject malpractice complaint erately to a dismissal her chose to by filing that was with the a medical authorization motion compliance to the but stated with OCGA not contrary *6 attorney Northlake’s not authorize Queen
that would protected because OCGA 9-11-9.2 health information obtain her by preempted for of Northlake moved dismissal HIPAA. When was (a) complaint Queen § 9-11-9.2 on the basis that under OCGA the complaint, the medical to file the failed requirements preempted agreed of the that HIPAA the trial court Contrary to the and the motion to dismiss.. § 9-11-9.2 denied OCGA majority opinion court, I find that OCGA affirms the trial which by preempted Queen’s and failure 9-11-9.2 was comply entitled Northlake dismissal with OCGA 9-11-9.2 complaint. provide caption body and of OCGA 9-11-9.2 follows:
The protected forms; review of § 9-11-9.2. Medical authorization health information alleging malprac-
(a) damages action for professional by Georgia against of tice licensed the State (d) against 9-11-9.1, Section and in subsection Code listed entity professional corporation legal or other through professional by the licensed health care services Georgia (d) in Code State of and listed subsection Section facility alleged against any 9-11-9.1, health care licensed upon based the or inaction of a health care to be liable action professional in the State of and listed licensed (d) contemporaneously Section subsection Code plaintiff filing complaint, the shall re- with the quired pro- form. Failure to file medical authorization subject shall to dis- vide this authorization missal. attorney provide
(b) that the The authorization shall representing the is authorized to obtain and defendant in health information contained medical disclose investigation, evaluation, and de- records to facilitate set forth in fense of claims and applicable, plaintiff pertain or, where which plaintiffs decedent whose com- treatment is at issue in the plaint. This authorization includes the attor- defendant’s ney’s discuss care treatment of the applicable, plaintiffs or, where decedent with all plaintiffs treating physicians. or decedent’s
(c) The authorization shall of all release except information that privileged and considered shall authorize the such release of physician facility by information health care health care
records or the decedent would be maintained. part package OCGA 9-11-9.2 were of a of civil
justice response and health care in reforms enacted to a crisis Assembly provision quality discerned General Georgia. As stated in Section 1 of the Act: Assembly presently The General finds that there exists a affecting provision quality crisis of health care Hospitals pro- services this state. and other health care having increasing difficulty in this viders ing state are in locat- liability hospitals provid- and, insurance such when ers are able insurance, to locate such the insurance is extremely costly. potential The result of this crisis is *7 availability a diminution of the of access to health care resulting impact and a services adverse on the and health well-being Assembly ofthe citizens ofthis state. The General justice regu- further finds that certain civil and health care latory provided promote predict- reforms as in this Act will ability improvement provision quality and in the of health liability care services and the resolution of health care thereby promoting provision and claims will in assist liability providers. health care insurance insurance pp. part 2005, 1-2, Ga. L. Act, 1.As this reform promotes by requir- efficient resolution ofmedical claims ing complaint to file a written medical authorization form with the attorney immediately allows defendant’s to plaintiffs] protected “obtain and disclose [the
contained in medical records to facilitate the evalua- tion, and defense of the claims and in (b).By stating OCGA§ 9-11-9.2 that the authorization —” attorney’s right plaintiffs includes the defendant’s to discuss the plaintiffs treating physicians, medical and treatment with the physicians and that it authorizes or health care to facilities release plaintiffs protected encour- the statute also conducting ages form a means of informal as use of the authorization Although nothing (b), (c). discovery. in the statute § 9-11-9.2 parte physicians engage requires the defen- in with éx discussions discovery, promotes attorney part the statute ex informal dant’s timely parte resolution of and cost-efficient to facilitate discussions claims. meaning operation construing OCGA§ we
presume Assembly enacted the statute with knowl- that the General existing edge law. “Newer statutes are reference with existing harmony in with laws because construed in connection legislature presumed full enacted all statutes are knowledge existing and with reference to condition law harmony they in and in with the it; are be construed connection Dougherty County existing Bd. Tax Lamad Ministries v. law.” (602 845) (2004). App. 798, Assessors, SE2d When OCGA 268 Ga. existing Georgia provided although enacted, that, law § 9-11-9.2 was right right patient privacy records, her his or has a patient places it is to the extent that is not absolute and “waived injuries' at the nature and extent ofhis issue his care treatment or (a); proceeding.” Orr civil OCGA 24-9-40 v. or criminal 548) compare App. (292 (1982); Sievert, 677, SE2d 678-680 Ga. 492) (535 (2000). King As State, 272 Ga. SE2d v. 789-794 existing Georgia provided explained Orr, the law that: patient places his treatment at in a Once care and issue proceeding, longer upon no remains restraint civil there concerning a doctor in the release of medical information complaint. patient parameters To hold within the to restrain a doctor who otherwise would allow opinions possesses the most relevant information and inquiries giving responding as to such information such opinions authorization, order, court without a written subpoena. 679-680.Accordingly, when OCGA § Ga.App. Orr, 9-11-9.2was existing provided by filing that, a medical
enacted malpractice complaint, privacy waived (cid:127)— necessity without of waiver medical records *8 — placed the extent the medical authorization written extent and treatment or the nature and medical care plaintiffs injuries issue the civil action. at Assembly that, enacted OCGA It follows when General necessity existing Georgia under law to § there was no plaintiff require that file a written medical authorization with the plaintiffs privacy rights complaint to establish a waiver necessity, however, was such a under relevant medical records. There privacy existing implement in HIPAA. To HIPAA stan- federal law promul- respect regulations to health were dards with gated Regulations, under title of Federal which are Code “Privacy Privacy collectively Rule known as the HIPAA Rule.” The protects “individually information,” defines and identifiable health specifically throughout this the Rule and then refers to information “protected type CFR § as health information.” 45 160.103. attorney
health a defendant’s to obtain authorized pursuant “protected qualifies about a to OCGA§ 9-11-9.2 HIPAAPrivacy § health information” under the Rule. 45 CFR 160.103.
Although Privacy there are various under the circumstances Rule required where no authorization is use or written disclosure of “protected applies information,” health none of those circumstances Accordingly, enacted, in this case. HIPAA when OCGA 9-11-9.2 was Privacy required Rule that a written be ob- provider tained from the plaintiffs “protected for a health care to disclose the attorney
health information” the defendant’s 164.508. (a); Moreover, under the 45 CFR §§ statute. 164.502 exceptions, Privacy certain preempted contrary the HIPAA Rule made clear that it compli- law,
state defined as situations where requirements impossible, ance with both state federal would be accomplishment or where the state law “stands as an obstacle to the objectives” purposes and execution of full of HIPAA. 45 CFR 160.202; §§ 160.203. above,
As stated when OCGA§ was enacted in presume Assembly knowledge that the that, General had existing Georgia existing Privacy required law, the Rule “protected written authorization for disclosure of health information” pursuant that, to OCGA 9-11-9.2 and unless OCGA 9-11-9.2 required HIPAA-compliant authorization, written the statute would preempted by App. Ministries, HIPAA. Lamad Ga. 801. ample apply presumption There is reason to this and conclude Assembly requirements the General considered the HIPAA when it necessity First, enacted OCGA 9-11-9.2. because there was no for a existing Georgia law, written authorization under it stands reason Assembly required that the General had HIPAA in mind when it written Second, authorization under OCGA 9-11-9.2. OCGA§ 9-11- “protected 9.2 twice uses the term health information” to refer to the pursuant (b), (c). information to be disclosed written autho- above, rization. As the HIPAA protects “individually Rule defines identifiable health repeatedly information,” and thereafter refers this information “protected fact, the term information.” 45 CFR 160.103. *9 Privacy forth the core elements Rule which sets the the section of “Except HIPAA-compliant that: written authorization a entity subchapter, required by permitted this covered or otherwise protected may an without not use or disclose information (a) §CFR 164.508 under this section.” 45 that is valid authorization provisions supplied). de- (emphasis Third, of the OCGA scribing required the authorization are consistent written the under HIPAA as set of a valid written authorization core elements nothing prevents (c), the statute in 45 164.508 forth CFR incorporating the those elements in authorization. the Rule as follows: forth in core elements are set Those description (i) to be used or disclosed A of the information meaningful specific the in a that identifies fashion. person(s),
(ii) specific the or identification of The name other requested persons, make the use or or of authorized to class disclosure. person(s),
(iii) specific ofthe The name or other identification entity may persons, the the covered make or class of to whom requested use or disclosure. requested
(iv) description purpose A of use or of each request “at individual” The disclosure. statement description purpose is a sufficient when individual to, not, does elects not initiates the authorization and provide or purpose. a statement of expiration expiration
(v) that An date or an event relates purpose the use or disclosure. The the individual study,” “none,” or “end of the research similar statement language for a is sufficient if authorization is use research, in- health information for disclosure of cluding of a creation and maintenance research repository. database or research
(vi)Signature date. If the authorization ofthe individual and representative signed by personal individual, authority representative’s description to act for the of such provided. individual must also be (c) (1). elements, In addition to the above core
45 CFR 164.508 Privacy requires give notice of the Rule that the authorization (2). writing. (c) CFR 164.508 to revoke the authorization 45 are consistent with all OCGA 9-11-9.2 under the above core elements. The written specifically meaningfully identifies the information statute by stating it is disclosed investigation, evaluation, and defense [s] “facilitate pertain claims (b). fairly plaintiff....”
to the read, plaintiffs The statute cannot be majority opinion contends, as the to authorize disclosure health information unrelated to claims the medical malpractice complaint. reading Moreover, 9-11-9.2 in har- *10 mony existing Georgia with law makes clear that the General As- sembly expansive reading given by did not intend the to the statute majority opinion. (a); App. Orr, the OCGA 24-9-40 162 Ga. at 678- persons elements, to 680. As disclosing other core the statute identifies the receiving purpose and the describes the for which the disclosed information is As used. to the core requiring expiration element an date or event that relates to the purpose provision disclosure, use the the statute that the investigation, evaluation, information is disclosed to “facilitate the and defense of the claims and set forth in the com- — plaint provides expiration .. .” an event the resolution or by complaint. Finally, dismissal ofthe civil action commenced the the clearly plaintiffs signature statute calls for the on a written autho- contemporaneously rization which takes effect on date it the filed complaint. provisions with the Because the OCGA 9-11-9.2 are contrary consistent with and not to the core elements of a HIPAA- compliant finding authorization, there no basis that HIPAA preempts the CFR 160.202; statute. 45 §§ 160.203.
Although says nothing about the additional requirement right HIPAA of notice of authorization, the to revoke the prevent revoking required the statute not does from the complaint. authorization it after has been filed with the The HIPAA Privacy provides may Rule that an individual revoke authoriza- writing any except physician entity time, tion in at where the or other disclosing protected pursuant health information to the authoriza- dealing tion taken thereon, has action in reliance other cases provided obtaining with authorizations as a condition of insurance coverage. (b) (5). exceptions right §CFR 164.508 These to the preclude plaintiff revoking revoke would not the authorization pendency during complaint prevent the disclosure infor- previously pursuant not mation ever, disclosed the authorization. How- right aif exercises the under HIPAA to revoke an by required complaint § 9-11- with the filed authorization equivalent the failure would be 9.2, revocation subject the medical and would authorization (a). Giving pursuant notice of to OCGA 9-11-9.2 to dismissal action HIPAA-compliant right for disclosure authorization to revoke a giving clear to the individual information makes stopped can be ofinformation that additional disclosure authorization any the date or event on which time revocation before at plaintiff required expire. OCGA 9-11-9.2 A would filing maintaining as condition file a medical authorization to the right stop complaint additional disclosure has notice of dismissing any at time expiration thereby accelerating event for the authorization. right circumstances, notice of the to dismiss Under expire the authorization to at equivalent time and cause right to revoke the authorization of notice are consistent of OCGA time. Because requirement Rule for notice of to the HIPAA and not preempt authorization, to revoke does §§ statute. CFR 160.202; 160.203. July 13, 2006.
Decided Johnson, Sanders, Reinhardt, Daniel S. Michael E. Troutman Weinberg, Hudgins, Dial, Maxwell, Wheeler, Gunn & Alan M. JohnM. appellant. Hawkins, for *11 Tate, Tate, Miller, & L. Gold-
Carter & Mark A. Nall Robert Kopelman, appellee. Benjamin TV, stucker, S. Persons Richard Willing- Monyak, Willingham, Love, Peters, & Allen S. Gilleland Monyak, Nasrallah, Robertson, ham, & Matthew G. Robert P. Bodoh Nasrallah, curiae. amici RITE-AID CORPORATION et al. v. DAVIS.
A06A0682.
(634 480) SE2d Barnes, Judge. Company Corporation of the State of Rite-Aid Insurance reversing superior Pennsylvania appeal the decision court’s order compensation against appellate Barbara of the workers’ division superior reinstated the decision of administra- court Davis. tive compensation (“ALJ”), judge who found Davis entitled catastrophic injury. follow, we affirm. the reasons that For