HIPAA Regulatory Alert
Court rejects privacy suit related to HIPAA
Decision reinforces status quo
A federal appeals court has rejected a challenge by patient advocacy groups to a rule promulgated under HIPAA that eased a prior regulation to permit health care entities to use and disclose individually identifiable health information for routine uses without obtaining prior consent. The advocacy groups had argued the more permissive rule violated their substantive due process rights, the First Amendment, the Administrative Procedure Act, and HIPAA itself. But the Third Circuit Court of Appeals rejected these arguments, saying that HIPAA may be implemented in a manner that places reasonable limits on the privacy protections available under that law. The court expressly said the objective of protecting patients' privacy must be balanced against the statute's other legitimate goals.
In an analysis for Sidley Austin LLP, attorney Alan Raul said that while the advocacy groups argued that elimination of the consent requirement for routine uses violated their privacy rights in violation of the Fifth Amendment's due process clause, the court found that the alleged privacy violations were attributable to private entities and not to the federal government. Raul said the court reasoned that the groups were not challenging the protection of health information by the government itself, but rather were concerned about use and disclosure of their health information by third parties such as pharmacies and private health care entities.
The court also was not persuaded by evidence that some covered entities had relied on the amended rule to change their privacy policies, Raul said. In the court's view, "the fact that a private party changed its behavior in response to a law does not give the law the coercive quality upon which the state action inquiry depends unless the law itself suddenly authorized something that was previously prohibited."
Since Citizens for Health and the other plaintiffs were not able to demonstrate that pre-HIPAA law prohibited covered entities from using or disclosing information for routine uses without consent, the court concluded that the amended rule neither authorized previously prohibited conduct nor enhanced the ability of these entities to engage in the challenged conduct.
The court's reasoning in rejecting a First Amendment argument was similar in that it found that any potential chilling effect on communications between patients and health care practitioners could be attributed not to any government action but rather to decisions by private entities regarding the manner in which they would use or disclose health information.
The advocacy groups also contended the amended rule violated HIPAA itself because the statute permits the Department of Health and Human Services to enact only those regulations that enhance privacy and not any regulations that detract from it. And they argued that the amended rule conflicted with Congress' intent in that it disturbed individuals' reasonable expectations of privacy in their medical information.
But the court rejected the contention that medical policy is the controlling policy underlying HIPAA, saying such a one-dimensional view ignores HIPAA's other goals of administrative simplification and improving health system efficiency and effectiveness. According to the court, the goal of protecting privacy must be balanced against these other equally important objectives.
Raul tells HIPAA Regulatory Alert he does not expect the case will be pursued any further, especially since HIPAA does not permit private actions, but limits compliance to criminal cases by the government against violators.
"This was a complex legal challenge to a complicated federal regulation and a decision that upholds the government's authority to issue such regulations," he says.
The decision makes no change to the status quo for the average patient, Raul says, and should not result in transformation of any practices that affect individuals. "Had the decision gone the other way," he says, "there would have been a major change to the status quo."
Download the decision at www.ca3.uscourts.gov/opinarch/042550p.pdf.
A federal appeals court has rejected a challenge by patient advocacy groups to a rule promulgated under HIPAA that eased a prior regulation to permit heatlh care entities ...You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content