Health Law Daily Wrap Up, HIPAA—11th Cir.: HIPAA preempts Florida privacy laws, state was wrong to issue citations to nursing homes for refusing to release protected information, (Apr 10, 2013)

By Jenny M. Burke, JD MS

Nursing facilities in the state of Florida were right to refuse to release medical records of deceased residents of nursing homes to certain specified individuals, because the state law requiring release is preempted by the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. sec. 1320d to d-9, and its implementing regulations (OPIS Management Resources, LLC v Secretary Florida Agency for Health Care Administration, April 9, 2013, Black, S). The Appellate court agreed with the district court that sec. 400.145 of the Florida Statutes impedes the purpose and objectives of HIPAA and the Privacy Rule in keeping an individual’s protected health information confidential. The Florida state agency was therefore wrong to issue citations to the nursing facilities for refusing to comply with the Florida statute, because they were in compliance with HIPAA.

Compliance question. Nursing facilities filed their complaint in court after being fined by the Florida Agency for Health Care Administration (the Florida state agency) for violating the Florida statutes. The nursing facilities received requests from spouses and attorneys for the medical records of deceased nursing home residents, but the facilities refused to disclose the records because the parties requesting them were not “personal representatives” under the relevant provisions of HIPAA. The Florida state agency issued citations to the nursing facilities for violating Florida law by refusing to release the records, and the facilities filed this complaint.

HIPAA defined. HIPAA was enacted to address concerns about the confidentiality of patients’ individually identifiable health information. Its preemption clause provides that the statute “shall supersede any contrary provision of State law,” and although there are some specific exemptions listed, there is not one that applies in this situation. HHS promulgated privacy regulations addressing individuals’ rights to individually identifiable health information, procedures for exercising such rights, and the uses and disclosures of such information, known as the Privacy Rule. The Privacy Rule establishes that a “covered entity or business associate may not use or disclose protected health information,” except in certain circumstances not at issue here, or with valid authorization (45 C.F.R. §§ 164.502(a), 164.508(a)(1)).

Florida statutes. The Florida State Agency explained that it interprets Florida statute sec. 400.145 in a manner which allows a spouse to qualify as a personal representative such that a deceased spouse’s medical records may be disclosed under HIPAA. Because this was a completely different interpretation of the relevant statutes, the nursing facilities filed a complaint seeking a declaratory judgment. The court held that HIPAA preempted the Florida statute because it impeded HIPAA’s goals of keeping protected health information confidential.

The case number is 12-12593.

Attorneys: Kari Leigh Aasheim (Mancuso & Dias, PA) for OPIS Management Resources, LLC, Ruleme Center, LLC, Gulf Coast Healthcare, LLC, SA-PG-Jacksonville, LLC, SA-PG-Sun City Center, LLC, Cypress Health Group, LLC. Shena L. Grantham, Florida Agency for Health Care Administration, for Secretary, Florida Agency for Health Care Administration.

Companies: OPIS Management Resources, LLC; Ruleme Center, LLC; Gulf Coast Healthcare, LLC; SA-PG-Jacksonville, LLC; SA-PG-Sun City Center, LLC; Cypress Health Group, LLC; Florida Agency for Health Care Administration

Cases: CaseDecisions HIPAANews AlabamaNews FloridaNews GeorgiaNews