Enter to open, tab to navigate, enter to select
HIPAA Does Not Preempt Florida's Pre-litigation Requirements: Eleventh Circuit
Practical Law Legal Update 0-584-3566 (Approx. 5 pages)
HIPAA Does Not Preempt Florida's Pre-litigation Requirements: Eleventh Circuit
by Practical Law Employee Benefits & Executive Compensation
| Published on 15 Oct 2014 • USA (National/Federal) |
In Murphy v. Dulay, the US Court of Appeals for the Eleventh Circuit held that a Florida law requiring prospective medical malpractice plaintiffs to execute an authorization form permitting the release of health information was not preempted by the Health Information Portability and Accountability Act of 1996 (HIPAA).
In Murphy v. Dulay, the US Court of Appeals for the Eleventh Circuit held that a Florida law requiring prospective plaintiffs in medical malpractice cases to execute a pre-litigation authorization form permitting the release of protected health information was not preempted by the Health Information Portability and Accountability Act of 1996 (HIPAA) (No. 13–14637, (11th Cir. Oct. 10, 2014)).
Background
Florida Presuit Requirements
The plaintiff in this case, a Florida resident who received medical care that he considered to be unsatisfactory, sought to sue his doctor for medical malpractice in Florida state court. Before he could file a lawsuit, however, the plaintiff was required to comply with Florida's presuit requirements, which include:
- A 90-day notice of the intent to bring a malpractice lawsuit.
- A written authorization form (under a related law that became effective in 2013) for the release of protected health information.
According to the Eleventh Circuit, the Florida legislature intended to make this presuit authorization form consistent with HIPAA and, by statute, the form was to be construed consistent with HIPAA's privacy requirements. In characterizing the form, the court noted that it:
- Could not be a condition for continued treatment, payment, enrollment or eligibility for health plan benefits.
- Required a plaintiff to include lists of health care providers who had treated the plaintiff for the injury underlying a lawsuit, as well as health care providers who treated a plaintiff over the last two years. A plaintiff could exclude health care providers who had no information potentially relevant to the injury.
- Permitted the attorney of a doctor-defendant to conduct ex parte interviews of a plaintiff's treating physician.
- Warned plaintiffs that the information disclosed under the form might be re-disclosed by the recipient and might not be protected by HIPAA at that point.
Lawsuit and Outcome
The plaintiff filed a lawsuit in federal district court seeking a declaration that ex parte communications with his doctors would violate his HIPAA privacy rights. The plaintiff argued that HIPAA expressly preempts the state-law presuit authorization requirement, and sought a declaratory judgment to this effect. He also sought an injunction against forced compliance with the authorization requirement. The State of Florida intervened to defend the authorization requirement.
The district court granted the plaintiff's request for declaratory and injunctive relief, holding that the Florida authorization form was not voluntary and would result in disclosure of the plaintiff's HIPAA-protected information without his consent. The court enjoined the doctor-defendant from obtaining the patient's health information through ex parte interviews unless he complied with HIPAA or the plaintiff otherwise consented.
The doctor-defendant and the State of Florida appealed. On appeal, the Eleventh Circuit vacated the district court's declaratory judgment and injunction, and remanded to the district court to enter judgment in favor of the defendants on the preemption claim.
HIPAA Preemption Analysis
The Eleventh Circuit held that the state-law presuit authorization was compliant with HIPAA and its implementing regulations, did not conflict with federal law and was therefore not preempted by HIPAA. HIPAA's preemption rule provides that HIPAA's requirements preempt any "contrary" provision of state law. In addition, HIPAA's regulations provide that a state law is contrary to HIPAA if:
- It would be impossible for a CE or BA to comply with both the state and federal requirements.
- The state law is an obstacle to accomplishing HIPAA's full purposes and objectives.
The Eleventh Circuit noted that the text of the state law required presuit authorizations to meet HIPAA's requirements, and that a presuit authorization must be construed consistent with HIPAA's regulations.
Presuit Authorization Did Not Violate HIPAA
The Eleventh Circuit rejected several arguments advanced by the plaintiff as to why he believed that the presuit authorization violated HIPAA's requirements. First, the court disagreed with the plaintiff's assertion that the presuit authorization required was irrevocable, and therefore in conflict with HIPAA's requirement that an authorization be revocable. The court noted that the state law plainly contemplated a plaintiff's ability to revoke a required authorization (though, as a consequence, a plaintiff's presuit notice would be deemed retroactively void) The court reasoned that the HIPAA regulations do not require an authorization to be revoked free of adverse consequences.
Second, the court rejected the plaintiff's argument that the presuit authorization violated HIPAA by requiring disclosure of a list of health care providers to whom the presuit authorization did not apply. The Eleventh Circuit did not view this requirement as lacking any purpose (as the plaintiff had argued) because:
- The disclosure actually protected a plaintiff's privacy by informing the defendant of which providers the defendant could not contact.
- The HIPAA regulations do not require that the scope of an authorization be limited to a specific, legitimate purpose (that is, it was not problematic if the authorization permitted disclosure of information that might be irrelevant to an individual's medical malpractice claim).
Third, the court disagreed that the presuit authorization failed to meet HIPAA's specificity requirement, which requires that an authorization describe the information to be used or disclosed in enough detail so that it is known which information the authorization references. The Eleventh Circuit rejected this argument because the presuit authorization specifically authorized the release of health information held by health care providers who the plaintiff identified, including those who had examined, evaluated or treated the plaintiff in connection with the injury, and those who had done so in the two years before the injury. According to the Eleventh Circuit, HIPAA only requires that authorizations be specific, not narrow.
Fourth, the court rejected the plaintiff's argument that the presuit authorization required a compound authorization that is not permitted under HIPAA. The fact that the presuit authorization was required to be sent out with a presuit notice did not create an impermissible compound authorization under HIPAA.
Mandatory Nature of Presuit Authorization
The Eleventh Circuit rejected the plaintiff's argument than the presuit authorization, which is mandatory for medical malpractice litigation in Florida, is unlawful because HIPAA requires authorizations to be voluntary. Among other reasons, according to the Eleventh Circuit:
- HIPAA does not expressly contain a voluntariness requirement regarding authorizations.
- Requiring a HIPAA authorization as a condition for having access to a state's judicial system was not necessarily more coercive than an existing process under which state Medicaid agencies require an individual's HIPAA authorization as a condition of enrolling an individual as a Medicaid recipient.
Practical Impact
As the Eleventh Circuit notes in its preemption analysis, the federal HIPAA rules include numerous requirements addressing when individual authorizations are required, including an exception under which authorizations are not needed for disclosures involving judicial and administrative proceedings. In addition, the final omnibus HIPAA regulations (2003) included rules addressing when compound authorizations are permitted in the research context. For a discussion of these rules, see Practice Note, HIPAA Privacy Rule: Authorizations.