For over seven years, we’ve been following the odd little romance that the other side of the “v.” has been having with purported federal preemption of state litigation practices that allow our side to conduct voluntary, informal interviews with treating physicians – since our “HIPAA Does Not Preempt State Litigation Practice” post back in DDLaw’s formative Beck/Herrmann days. To put our position in one sentence, since HIPAA has an explicit exception for litigation (45 C.F.R. §164.512(e)), HIPAA has no preemptive effect on state law that accords both sides the same right to talk to treating physicians informally.
We cheered when the New York Court of Appeals got it right and hissed when a Missouri intermediate appellate court got it wrong. Well, we’re cheering again, and we like that better.
Last Friday the Eleventh Circuit decided Murphy v. Dulay, ___ F.3d ___, 2014 WL 5072710 (11th Cir. Oct 10, 2014), and rejected a HIPAA challenge to a Florida statute allowing – indeed effectively routinizing (if the doctor is willing) – informal treater interviews. Murphy isn’t going to help our clients directly, since the statute in question applies only to medical malpractice cases, and general Florida law, according to our 50-state survey of informal interview law is adverse. Still, precedent is precedent, and a federal appellate court rejecting bogus HIPAA preemption arguments should be rather persuasive, as well as fun to blog about.
Here’s what happened in Murphy. In 2011, the Florida Legislature required that all medical malpractice plaintiffs jump through certain procedural hoops before filing suit. One of those steps was to “execute a written authorization form for release of protected health information” that included authorization for defense side informal treater interviews. Murphy, 2014 WL 5072710, at *1 (citing Fla. Stat. §766.1065(2)(a)). As described in Murphy:
The authorization form must expressly allow ex parte interviews, stating: “This authorization expressly allows the persons or class of persons listed . . . above to interview the health care providers listed . . . above, without the presence of the Patient or the Patient’s attorney.” Id. §766.1065(3)(E). Those “persons or class of persons” include the doctor defendant, his insurer, adjuster, experts or attorneys. Id. §766.1065(3)(D)-(E). Thus, the doctor defendant’s attorney would be able to interview ex parte the treating physician of a plaintiff. However, the statute does not require the treating provider to submit to a request for an interview. See id. §766.106(6)(b)(5).
2014 WL 5072710, at *3.
Almost immediately, some Florida would-be plaintiff went running to federal court with a declaratory judgment action whining that this Florida law – which specified that the form release must be HIPAA compliant – was nevertheless preempted by HIPAA. 2014 WL 5072710, at *2 (citing Fla. Stat. §766.1065(3)). Some pro-plaintiff district judge agreed, holding that despite exempting litigation, HIPAA required that informal interviews be “voluntary,” and the statute wasn’t because plaintiffs couldn’t file medical malpractice actions without signing the release. 2014 WL 5072710, at *4. The Court of Appeals unanimously reversed. Nobody has to sue anybody.
Interestingly, plaintiffs fell afoul of their own favorite canard, the presumption against preemption. Id. at *5 (citing Medtronic, Inc. v. Lohr, 518 U.S. 470 (1996)). Murphy found that two express exceptions to preemption (which could be called “savings clauses”) potentially applied: “First, disclosure may be made through the judicial process. 2014 WL 5072710, at *5 (citing §164.512(e)). Second, disclosure is permitted if an individual expressly authorizes release of his or her medical information in a valid authorization form. See id. §164.502(a)(1)(iv).” The litigation exception – the one we like to cite here at DDLaw – provides:
[E]ven without a written authorization, “[a] covered entity may disclose protected health information in the course of any judicial or administrative proceeding.” Id. §164.512(e)(1). But certain procedures must be followed. Information may be released only in response to: (1) an “order of a court or administrative tribunal,” or (2) a “subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal,” when certain conditions are met. Id. §164.512(e)(1)(i)-(ii).
2014 WL 5072710, at *7. Those conditions are either notice to the other side, or entry of a “a qualified protective order” involving protection against further dissemination. Id. (citing §164.512(e)(1)(ii)).
HIPAA also allows disclosure via a “valid” written authorization. Id. (citing §164.508). That avenue has a bunch of its own exceptions and requirements, which we discuss below. Id. (citing §164.508(b)(2)). We’re being uncharacteristically punctilious with the citations because HIPAA is complex and we want our readers to know how to navigate this.
Put more than one exception together and one has a “compound authorization,” whereby “an authorization for the use and disclosure of protected health information is combined with any other legal permission.” 2014 WL 5072710, at *8 (citing 78 Fed. Reg. 5565, 5609 (Jan. 25, 2013)). Even that has exceptions, including that medical treatment may not be “conditioned” upon such an authorization. Id. (citing §164.508(b)(3)(iii)).
So much for the gobbledygook. The ruling in Murphy is much more straight-forward. First, Florida is allowed to require an authorization because the authorization complies with everything HIPAA can throw at it. The statute “ensur[es] that the form meets each of the required elements set forth in the HIPAA regulations.” Murphy, 2014 WL 5072710, at *10. The authorizations are explicitly revocable. That revocation comes with ancillary consequences – “that the presuit notice is deemed retroactively void” and “a plaintiff’s medical negligence claim may be barred by the statute of limitations” – doesn’t matter. “HIPAA regulations do not require that a person be able to revoke an authorization free of any consequences.” Id.
Second, there is a “legitimate purpose” – additional privacy protection – to require a plaintiff to list treaters who (a plaintiff claims) has no relevant information. Id. at *11. We note that it also keeps plaintiffs from hiding relevant treaters, which they routinely do. Further, even if there were no HIPAA-related purpose, there doesn’t have to be. “HIPAA regulations do not require that the scope of an authorization be commensurate to a specific, legitimate purpose.” Id.
Third, the statutory authorization is quite “specific,” specifying access to “all” information. That the scope of material released is “broad” doesn’t mean it isn’t “specific.” “[Plaintiff] may not like the breadth of the authorization . . . but the HIPAA regulations do not require that authorizations be narrow, simply that they be specific.” Id. The purpose of the release is crystal clear, to defend a malpractice action. Id. Stop whining.
Fourth, and finally, there’s no improper “compound authorization.” The statute conditions litigation, not medical treatment, on its execution. Id. at *12. “The presuit notice is merely a condition precedent for filing a medical negligence suit in Florida state court.” Id.
Because the statutory procedure meets HIPAA’s authorization exception for release of information, it doesn’t matter that Florida doesn’t require that any notice be given of the informal interviews, as the litigation exception requires:
Because [the statute] is consistent with HIPAA’s requirements for disclosure by written authorization, it is also irrelevant whether [it] calls for procedures that satisfy the requirements of another HIPAA disclosure exception − including the exception for disclosure by judicial process. . . . [W]hen an individual executes a valid HIPAA authorization, he waives all HIPAA protection as to the health information covered by the authorization, including the protections against litigation-related disclosures. Accordingly, no other HIPAA exception for disclosure needs to be satisfied once an individual signs a valid written authorization.
2014 WL 5072710, at *12 (citations and footnote omitted). We don’t mind giving notice under the litigation exception, as long as plaintiffs aren’t permitted to threaten their treaters, but we have to say that this Florida statute is ingenious in creating a way around that litigation-related requirement.
In the end the plaintiff in Murphy was left trying to create something that wasn’t there – a “voluntariness” gloss on HIPAA that would prevent any state from conditioning anything on the release of information otherwise considered confidential under HIPAA. That “Hail Mary” pass didn’t work either. HIPAA itself allows for “coercive” release of medical information to qualify for federal health insurance benefits. Id. at *14. [A]s plaintiff’s decision whether to file suit is still a voluntary one,’ once a plaintiff chooses to sue, s/he can’t hide information from the other side. Id. “[I]t was their choice to file the suit in the first instance.” Id. at *13-14 (citations and quotation marks omitted). Thus, there is no preemptive conflict with HIPAA:
The HIPAA regulations allow authorizations to be based on conditions − such as employment, Medicaid benefits, and other incentives − and prohibit only one type of condition. Even that condition is not absolute but has exceptions. Further, an individual’s decision to sign an authorization prior to bringing a medical negligence claim in state court is not an involuntary one. If an individual does not wish to execute such an authorization, he does not have to. He is, however, precluded from using the Florida courts to obtain relief through a medical negligence lawsuit against a health care provider.
2014 WL 5072710, at *15. In the end, the result in Murphy is the same as it was under the common law physician-patient privilege, as we discussed here, the voluntary decision to file suit legitimately works a waiver of privacy concerns that might otherwise inhibit the other side’s access to the information necessary to defend that suit. Anybody who doesn’t like it shouldn’t sue.