Ass'n of American Phys. v. U.S. Dept. of Health

• Decision Date: 17 June 2002
• Docket Number: Civ. A. No. H-01-2963.
• Citation: 224 F.Supp.2d 1115
• Parties: The ASSOCIATION OF AMERICAN PHYSICIANS & SURGEONS, INC., et al., Plaintiffs, v. UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES, et al., Defendants.
• Court: U.S. District Court — Southern District of Texas

224 F.Supp.2d 1115

The ASSOCIATION OF AMERICAN PHYSICIANS & SURGEONS, INC., et al., Plaintiffs, v. UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES, et al., Defendants.

Civ. A. No. H-01-2963.

United States District Court, S.D. Texas, Houston Division.

June 17, 2002.

COPYRIGHT MATERIAL OMITTED

COPYRIGHT MATERIAL OMITTED

Karen Bryant Tripp, Houston, TX, Andrew Schlafly, AAPS General Counsel, Far Hills, NJ, for Plaintiffs.

Elizabeth J. Shapiro, U.S. Dept. of Justice, Civ. Div., Washington, DC, for Defendants.

MEMORANDUM AND ORDER

LAKE, District Judge.

Plaintiffs, The Association of American Physicians & Surgeons, Inc., Congressman Ron Paul, M.D., Dawn Richardson, Rebecca Rex, and Darrell McCormick, filed this action against defendants, the United States Department of Health and Human Services ("HHS") and Tommy G. Thompson, as Secretary of HHS, challenging the privacy regulations promulgated by HHS under Title II, Subtitle F, §§ 261-64 of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub.L. No. 104-191, 110 Stat.1936 (1996). Plaintiffs allege that the privacy regulations go beyond the legislative scope of HIPAA and violate the First, Fourth, and Tenth Amendments to the Constitution, the Regulatory Flexibility Act ("RFA"), 5 U.S.C. §§ 601 et seq., and the Paperwork Reduction Act ("PRA"), 44 U.S.C. §§ 3501 et seq. Plaintiffs seek declaratory relief and attorneys' fees. Pending before the court is Defendants' Motion to Dismiss (Docket Entry No. 10). For the reasons set forth below, defendants' motion will be granted.

I. Standard of Review

The Federal Rules of Civil Procedure authorize a court, upon suitable showing, to dismiss any action or any claim within an action for lack of subject matter jurisdiction or for failure to state a claim upon which relief can be granted. Fed.R.Civ.P. 12(b)(1) and 12(b)(6). Plaintiffs bear the burden of proof that jurisdiction exists. Menchaca v. Chrysler Credit Corp., 613 F.2d 507, 511 (5th Cir.1980). When a Rule 12(b)(1) motion is filed in conjunction with other Rule 12 motions, the court should consider the Rule 12(b)(1) jurisdictional attack before addressing any attacks on the merits. Hitt v. City of Pasadena, 561 F.2d 606, 608 (5th Cir.1977) (per curiam). Lack of subject matter jurisdiction may be determined from (1) the complaint alone, (2) the complaint supplemented by undisputed facts evidenced in the record, or (3) the complaint supplemented by undisputed facts plus the court's resolution of disputed facts. Barrera-Montenegro v. United States, 74 F.3d 657, 659 (5th Cir.1996).

In considering a motion to dismiss under Rule 12(b)(6), the district court must construe the allegations in the complaint favorably to the pleader and must accept as true all well-pleaded facts in the complaint. See Lowrey v. Texas A & M Univ. Sys., 117 F.3d 242, 247 (5th Cir.1997); Malina v. Gonzales, 994 F.2d 1121, 1125 (5th Cir. 1993). Unlike a motion for summary judgment, but similar to a motion under Rule 12(b)(1), dismissal of a claim should be granted only if "it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief." Torres de Maquera v. Yacu Runa Naviera S.A., 107 F.Supp.2d 770, 774 (S.D.Tex.2000). See Conley v. Gibson, 355 U.S. 41, 78 S.Ct. 99, 101-102, 2 L.Ed.2d 80 (1957); Tuchman v. DSC Communications Corp., 14 F.3d 1061, 1067 (5th Cir.1994).

In order for a plaintiff to prevail against a motion to dismiss, "the complaint must contain either direct allegations on every material point necessary to sustain a recovery ... or contain allegations from which an inference fairly may be drawn that evidence on these material points will be introduced at trial." 5 Charles Alan Wright & Arthur R. Miller, FEDERAL PRACTICE AND PROCEDURE: CIVIL 2d § 1216 at 156-159 (footnote omitted). "[A] statement of facts that merely creates a suspicion that the pleader might have a right of action" is insufficient. Id. at 163. Dismissal is proper if the complaint lacks an allegation regarding a required element necessary to obtain relief. Campbell v. City of San Antonio, 43 F.3d 973, 975 (5th Cir.1995). Conclusory allegations or legal conclusions masquerading as factual conclusions will not suffice to prevent a motion to dismiss. Fernandez-Montes v. Allied Pilots Ass'n, 987 F.2d 278, 284 (5th Cir.1993).

II. Background

Congress, in order to "improve portability and continuity of health insurance coverage in the group and individual markets,"¹ enacted HIPAA on August 21, 1996. Pub.L. No. 104-191, 110 Stat.1936 (1996). Subtitle F of Title II of HIPAA is entitled "Administrative Simplification," and states that the purpose of the subtitle is to improve health care by "encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information." 110 Stat.2021. In light of this envisioned computerization and increased electronic transmission of health information, and recognizing the concomitant need to guarantee certain protections to patients' privacy, Congress included section 264 within Subtitle F, Title II of HIPAA. Section 264(a) instructs HHS to provide Congress with "recommendations on standards with respect to the privacy of individually identifiable health information" within twelve months of HIPAA's enactment date. Subsection (b) of Section 264 directs HHS to make recommendations concerning "at least" the following subjects:

(1) The rights that an individual who is a subject of individually identifiable health information should have.

(2) The procedures that should be established for the exercise of such rights.

(3) The uses and disclosures of such information that should be authorized or required.

101 Stat.2033.

Section 264(c) states that if Congress should fail to enact legislation governing "standards with respect to the privacy of individually identifiable health information" within 36 months of the enactment of HIPAA, HHS shall promulgate "final regulations" containing such privacy standards not later than 42 months after the enactment of HIPAA. Such HHS regulations shall "not supercede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation." 110 Stat.2033-34.

By August 21, 1999, Congress had not enacted privacy standards pursuant to HIPAA. Accordingly, on November 3, 1999, HHS issued a notice of proposed rulemaking. After receiving approximately 52,000 public comments, and following the publication of several proposed rules and amendments, on February 13, 2001, HHS promulgated final regulations (the "Privacy Rule"). Although the effective date of the Privacy Rule was April 14, 2001, covered entities were given two years, or until April 14, 2003, to come into compliance with the Privacy Rule. Smaller health plans and entities were given three years, or until April 14, 2004, to comply. Following publication of the Privacy Rule, and in response to further public comments, HHS published on its website additional guidance concerning the Rule's practical impact.²

Plaintiffs in this action challenge the constitutionality and statutory validity of the Privacy Rule. The Association of American Physicians & Surgeons, Inc. ("AAPS") is a professional, non-profit, national organization with numerous physician and patient members. Ron Paul is a physician and member of the United States Congress from the state of Texas. Dawn Richardson and Rebecca Rex are "patients" in Austin, Texas, who are also officers of Parents Requesting Open Vaccine Education ("P.R.O.V.E."), a Texas-based, non-profit organization. Darrell McCormick is a "patient" in Gainesville, Florida, who is the former billing manager for approximately 500 physicians at the Shands Healthcare System at the University of Florida in Gainesville, Florida.

III. Plaintiffs' Claims

Plaintiffs claim that the Privacy Rule, as established by HHS pursuant to Subtitle F, Title II of HIPAA, violates the Fourth Amendment's prohibition against unreasonable government searches and seizures. While plaintiffs acknowledge that the Privacy Rule expressly reiterates the importance of maintaining patients' expectation of privacy in their medical records, they complain that the Rule simultaneously gives the government "virtually unrestricted access" to these medical records without a warrant. Plaintiffs allege that the Privacy Rule also requires physicians to aid governmental searches of patient medical records in violation of the Fourth Amendment and facilitates the construction of a centralized government database of personal health information without patient consent.

Plaintiffs also challenge the Privacy Rule under the First and Tenth Amendments to the Constitution, alleging that the Rule has a chilling effect on patient-physician communications and that the regulations go beyond Congress's commerce power authority by intruding into local, private activities involving physicians and patients that lack any nexus to interstate commerce.

Plaintiffs also allege that HHS overreached its statutory mandate under HIPAA by extending the provisions of the Privacy Rule to cover more than electronic transmissions of health information. Plaintiffs claim that although HIPAA only authorized HHS to promulgate standards for electronic transfers of information, the Privacy Rule purports to regulate paper and all other forms of health information storage media. Plaintiffs also allege that because HHS failed to publish the Privacy Rule within the 42-month period required by Congress, HHS forfeited its statutory delegation of power after February 21, 2000 — 42 months after HIPAA's enactment. Plaintiffs also claim that the Privacy Rule violates the Regulatory Flexibility Act ("RFA"),...