In Opis Management Resources, LLC v. Secretary, Florida Agency for Health Care Administration, the key litigated issue was whether HIPAA and its implementing privacy regulations preempted a Florida law requiring nursing homes to disclose the medical records of deceased residents to certain individuals who requested them.

During their course of business, the plaintiffs, a group of Florida-based nursing homes, received requests from spouses and attorneys-in-fact for the medical records of deceased nursing home residents. The nursing homes (covered entities under HIPAA) refused to provide the records on the ground that, under HIPAA, the requesting parties were not "personal representatives" of the deceased individuals. Under HIPAA's implementing privacy regulations (the Privacy Rule), covered entities must treat as personal representatives persons having the authority to act on behalf of a deceased individual or his estate.

The Florida Agency for Health Care Administration (agency) issued citations to the nursing homes for violating a Florida state law requiring licensed nursing homes to release a current or former resident's medical records on the request of the resident's spouse, guardian, surrogate or attorney-in-fact, regardless of whether that person was a personal representative under HIPAA.

In response, the nursing homes filed a complaint in federal district court seeking a declaratory judgment that the Florida law was preempted by HIPAA. The court granted the nursing homes' motion for summary judgment, holding that the Florida law was preempted because it:

The agency appealed.

On April 9, 2013, the US Court of Appeals for the Eleventh Circuit issued an opinion affirming the district court's judgment and holding that the Florida law was preempted by HIPAA.

The court noted that one of Congress' objectives in enacting HIPAA was to help protect the confidentiality of patients' personal health information. HIPAA contains an express preemption clause providing that the statute supersedes any contrary provision of state law, except where state law offers even greater privacy protections than HIPAA. Because the Florida law offered less stringent privacy protections than HIPAA and the Privacy Rule, the court held, it frustrated Congress' objectives and was therefore preempted by HIPAA.

The court rejected the agency's argument that the Florida law merely supplemented the class of personal representatives permitted to obtain medical records under HIPAA, concluding that the Florida law's plain language did not:

The agency also argued that HIPAA final regulations, effective March 26, 2013, saved the Florida law from preemption (see Legal Update, Final HIPAA Regulations Change Breach Notification Rules). Under the final regulations, a covered entity may release certain protected health information about a deceased individual to persons who were involved in the individual's care or payment for health care before the individual's death. The court rejected this argument, concluding that the regulation is narrowly drawn with significant restrictions and limitations, including a limitation that the medical records be relevant to the requesting party's involvement. The Florida law, on the other hand, contained no similar limitations.

Finally, the court distinguished Alvista Healthcare Center, Inc. v. Miller, in which the Georgia Supreme Court permitted a widow to obtain medical records of her deceased spouse from a nursing home, finding that the Georgia legislature had specifically amended state disclosure requirements to comply with HIPAA's requirements for personal representatives. By contrast, Florida had not amended its laws to comply with the HIPAA Privacy Rule.

As this case illustrates, HIPAA establishes a "floor" of privacy protections on which state laws can build, if the state law protections are more stringent than the federal HIPAA requirements. The Florida law, however, authorized sweeping disclosures of a deceased individual's protected health information to spouses and others, without the need for authorization, meaning it offered less protection than under HIPAA and the Privacy Rule, and was therefore preempted.