[Med-privacy] State Privacy Protections and Civil Suits Concerned with HIPAA Law

[pmarshall]

 H I P A A / LAW: Legal Q/A

*** State Privacy Protections: How Do They Relate to
    Civil Suits Concerned with HIPAA Law? ***

By Steve Fox, Esq., Pepper Hamilton LLP

Last month, we discussed one of the questions raised by the Justice Depar=
tment's subpoenas to Planned Parenthood affiliates and hospitals nationwi=
de in connection with lawsuits aimed at determining whether the so-called=
 "Partial Birth Abortion Ban" is constitutional: when you receive a subpo=
ena for protected health information ("PHI") in civil litigation, do you =
abide by state law, HIPAA, or both? In the article, we noted that there w=
as an ongoing debate on whether state privacy protections for PHI apply i=
n civil suits aimed entirely at resolving matters of federal law.

To illustrate that ongoing debate, we described the Northern District of =
Illinois' decision in National Abortion Federation v. Ashcroft, 2004 U.S.=
 Dist. LEXIS 1701 at *8 (N.D. Ill. February 6, 2004). In that case, the C=
ourt found that where state privacy laws offer more protections for PHI t=
han HIPAA, state privacy laws apply even in cases that do not involve sta=
te law. The Seventh Circuit Court of Appeals has since reviewed the Natio=
nal Abortion Federation v. Ashcroft decision and determined that more str=
ingent privacy protections under state law do not necessarily apply to ca=
ses involving purely federal questions.

In a somewhat complicated decision, the Seventh Circuit stated, "Although=
 the issue is not free from doubt, we agree with the government that the =
HIPAA regulations do not impose state evidentiary privileges on suits to =
enforce federal law." Northwestern Memorial Hosp. v. Ashcroft, Case No. 0=
4 C 5 at 3-4 (7th Cir. March 26, 2004). However, the Court went on to say=
 that where it is possible to apply the state's privacy law protections w=
ithout frustrating the implementation or intent of federal law, then fede=
ral courts should use the state privacy law out of respect for the state.=
 See id. at 15 ("[The doctrine of] comity 'impels federal courts to recog=
nize state privileges where this can be accomplished at no substantial co=
st to federal substantive and procedural policy.'") (citation omitted). T=
he Court also held that because the privacy rights intruded upon by discl=
osure of the records were significant and the probative value of the medi=
cal records was small, the subpoenas were too burdensome and did not need=
 to be complied with. Consequently, the Seventh Circuit upheld the ultima=
te decision of the Northern District of Illinois and prevented the disclo=
sure of the patients' PHI.

What does this mean for covered entities who receive subpoenas for protec=
ted health information in connection with a case aimed at answering quest=
ions involving only federal law? If you receive such a subpoena, then you=
 should be prepared to produce the records if the requesting entity has m=
et all of the requirements of 45 C.F.R. =A7 164.512(e). As last month's a=
rticle noted, the requirements of HIPAA apply in all cases, no matter whe=
ther the cases involve questions of state law or federal law.

However, based on the Seventh Circuit's decision in Northwestern Memorial=
 Hosp. v. Ashcroft, covered entities who receive subpoenas for PHI in civ=
il cases involving only federal law (known as "federal question" cases) m=
ust decide whether to oppose producing the PHI on the grounds that state =
privacy laws protect the PHI from disclosure. Covered entities may argue =
that state privacy law privileges apply to PHI in civil federal question =
cases where (1) the state privacy laws are more stringent than HIPAA (as =
the previous article stated) and (2) enforcing the state privacy laws wou=
ld not unduly interfere with the federal government=92s policies for the =
protection and proper disclosure of PHI.

If you receive a subpoena in a civil federal question case, and the entit=
y seeking the PHI has complied with the requirements of 45 C.F.R. =A7 164=
=2E512(e), then you should consult with counsel about whether to claim th=
at the subpoenaed PHI is nevertheless protected from disclosure by state =
privacy laws. In addition (unless you are located in the Seventh Circuit,=
 which encompasses Indiana, Illinois and Wisconsin), you should determine=
 whether federal courts in your jurisdiction have answered the question o=
f the applicability of state privacy laws to federal question cases.

Since, as the Seventh Circuit acknowledged, this issue is "not free from =
doubt," courts in various jurisdictions may reach different conclusions o=
n this point. Assuming, however, that state privacy laws do not apply, th=
e decision on whether to attempt to assert their protections in a federal=
 question case will depend on the specific circumstances of the case and =
the interaction between your state's privacy laws and the aims of federal=
 procedure and policy under those circumstances.

[....]

------------------------------
Steve Fox, Esq., is a partner at the Washington, DC, office of Pepper Ham=
ilton LLP. Disclaimer: This information is general in nature and should n=
ot be relied upon as legal advice.

[HIPAAlert]