Citizens for Health v. Leavitt, 04-2550.
| Decision Date | 31 October 2005 |
| Docket Number | No. 04-2550.,04-2550. |
| Citation | 428 F.3d 167 |
| Parties | CITIZENS FOR HEALTH; American Association for Health Freedom; American Association of Practicing Psychiatrists; American Mental Health Alliance-USA; American Psychoanalytic Association; National Coalition of Mental Health Professionals and Consumers; New Hampshire Citizens for Health Freedom; Sally Scofield; Ted Koren, DC; Michaele Dunlap, Psy.D.; Morton Zivan, Ph.D.; California Consumer Healthcare Council; Congress of California Seniors; Health Administration Responsibility Project; Daniel S. Shrager; Eugene B. Meyer; Jane Doe; Janis Chester; Deborah Peel, Appellants v. <SMALL><SUP>*</SUP></SMALL>Michael O. LEAVITT, Secretary U.S. Department of Health and Human Services. |
| Court | U.S. Court of Appeals — Third Circuit |
Robert N. Feltoon, Conrad, O'Brien, Gellman & Rohn, Philadelphia, PA, James C. Pyles [Argued], Powers, Pyles, Sutter & Verville, Washington, DC, Peter D. Winebrake, Trujillo, Rodriguez & Richards, The Penthouse, Philadelphia, PA, for Appellants.
Charles W. Scarborough [Argued], U.S. Department of Justice, Appellate Section, Washington, DC, Mark B. Stern, U.S. Department of Justice, Civil Division, Appellate Staff, Washington, DC, for Appellee.
Stacy A. Fols, Montgomery, McCracken, Walker & Rhoads, Cherry Hill, NJ, for Amicus-appellants The National Association of Social Workers, Inc. and PA Chapter of the National Association of Social Workers.
M. Duncan Grant, Pepper Hamilton, Philadelphia, PA, for Amicus-appellant Program for Psychiatry and the Law at Harvard Medical School.
Jonathan S. Martel, Arnold & Porter, Washington, DC, for Amicus-appellant NARAL Pro-Choice America Foundation.
David P. Felsher, New York, NY, for Amicus-appellants Guenter L. Spanknebel, Leonard Morse, Wayne Glazier, Graham L. Spruiell, and Association of American Physicians and Surgeons, Inc.
Before McKEE, RENDELL and NYGAARD,** Circuit Judges.
Appellant Citizens for Health, along with nine other national and state associations and nine individuals (collectively "Citizens"), brought this action against the Secretary of the United States Department of Health and Human Services ("HHS" or "Agency") challenging a rule promulgated by the Agency pursuant to the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub.L. 104-191, 110 Stat. 1936. Citizens allege that the "Privacy Rule"-officially titled "Standards for Privacy of Individually Identifiable Health Information"-is invalid because it unlawfully authorizes health plans, health care clearinghouses, and certain health care providers to use and disclose personal health information for so-called "routine uses" without patient consent. The relevant part of the specific offending provision of the Privacy Rule reads:
(a) Standard: Permitted uses and disclosures. Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) [] and (3) [relating to marketing], a covered entity may use or disclose protected health information for treatment, payment, or health care operations ... provided that such use or disclosure is consistent with other applicable requirements of this subpart.
(b) Standard: Consent for uses and disclosures permitted. (1) A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.
(2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart.
45 C.F.R. § 164.506 (emphasis added). Citizens challenge subsection (a) as authorizing disclosures that, they contend, violate individual privacy rights.
The District Court granted summary judgment to the Secretary on all of Citizens' claims based on its conclusions that the promulgation of the Privacy Rule did not violate the Administrative Procedure Act, that the Secretary did not exceed the scope of authority granted to him by HIPAA, and that, insofar as the Privacy Rule is permissive and does not compel any uses or disclosures of personal health information by providers, it does not affirmatively interfere with any right protected by the First or Fifth Amendments. Because we reason to the same conclusions reached by the District Court, albeit under a slightly different analysis, we will affirm.
The objectionable provision is only one aspect of a complex set of regulations that is the last in a series of attempts by HHS to strike a balance between two competing objectives of HIPAA-improving the efficiency and effectiveness of the national health care system and preserving individual privacy in personal health information.
HIPAA was passed by Congress in August 1996 to address a number of issues regarding the national health care and health insurance system. The statutory provisions relevant to the issues in this case are found in Subtitle F of Title II.1 Aimed at "administrative simplification," HIPAA Sections 261 through 264 provide for "the establishment of standards and requirements for the electronic transmission of certain health information." § 261, 110 Stat. at 2021. More specifically, these provisions direct the Secretary to adopt uniform national standards for the secure electronic exchange of health information. § 262, 110 Stat. at 2021-26.
Section 264 prescribes the process by which standards regarding the privacy of individually identifiable health information were to be adopted. § 264(a), 110 Stat. at 2033. This process contemplated that, within a year of HIPAA's enactment, the Secretary would submit detailed recommendations on such privacy standards, including individual rights concerning individually identifiable health information, procedures for exercising such rights, and the "uses and disclosures of such information that should be authorized or required," to Congress. § 264(a)-(b), 110 Stat. at 2033. If Congress did not enact further legislation within three years of HIPAA's enactment, the Secretary was directed to promulgate final regulations implementing the standards within 42 months of HIPAA's enactment. § 264(c)(1), 110 Stat. at 2033. The Act specified that any regulation promulgated pursuant to the authority of Section 264 would provide a federal baseline for privacy protection, but that such regulations would "not supercede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation." § 264(c)(2), 110 Stat. at 2033-34.2
Because Congress did not enact privacy legislation by its self-imposed three-year deadline, the Secretary promulgated the privacy standards contemplated in Section 264 through an administrative rulemaking process. During this process, the Rule went through four iterations: the Proposed Original Rule, the Original Rule, the Proposed Amended Rule, and the Amended Rule.3 The Original Rule required covered entities to seek individual consent before using or disclosing protected health information for routine uses. Standards for Privacy of Individually Identifiable Health Information, 65 Fed.Reg. 82,810 (Dec. 28, 2000) (). Before the Original Rule could take effect, however, the Secretary was inundated with unsolicited criticism, principally from health care insurers and providers, warning that the Original Rule's mandatory consent provisions would significantly impact the ability of the health care industry to operate efficiently.4 Standards for Privacy of Individually Identifiable Health Information, 67 Fed.Reg. 14,776, 14,777 (Mar. 27, 2002). He responded by reopening the rulemaking process. Id. at 14,776. The final result was the Amended Rule-the currently effective, codified version of the Privacy Rule, see generally 45 C.F.R. pts. 160 & 164, which is the subject of Citizens' challenge here.5
The Amended Rule retains most of the Original Rule's privacy protections. It prohibits "covered entities"6-defined as health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a transaction covered by the regulations-from using or disclosing an individual's "protected health information"-defined as individually identifiable health information maintained in or transmitted in any form or media including electronic media-except as otherwise provided by the Rule. See 45 C.F.R. §§ 160.103 (), 164.502(a) (). Covered entities must seek authorization from individuals before using or disclosing information unless a specific exception applies. Id. § 164.508(a)(1) ( ). Uses and disclosures that the Amended Rule allows must be limited to the "minimum necessary" to accomplish the intended purpose. Id. § 164.502(b).
The Amended Rule departs from the Original Rule in one crucial respect. Where the Original Rule required covered entities to seek individual consent to use or disclose health information in all but the narrowest of circumstances,7 the Amended Rule allows such uses and disclosures...
To continue reading
Request your trial
-
In re Suboxone (Buprenorphine Hydrochloride & Nalaxone) Antitrust Litig.
...of covered entities, such as health plans and health care providers, to use protected health information. Citizens for Health v. Leavitt, 428 F.3d 167, 173 (3d Cir. 2005).28 Reckitt's case citations in support of their argument are distinguishable. In Vista Healthplan, Inc. v. Cephalon, Inc......
-
Board of Physicians v. Eist
...federal constitution does not confer a general privacy right to nondisclosure of personal information). See also Citizens for Health v. Leavitt, 428 F.3d 167, 177 (3rd Cir.2005) (holding that "a violation of a citizen's right to medical privacy rises to the level of a constitutional claim o......
-
Cnty. of L. A. v. Superior Court of Orange Cnty.
...providers generally may not disclose medical information without a patient's authorization or court order]; Citizens for Health v. Leavitt , 428 F.3d 167, 172 (3d Cir. 2005) [describing administrative privacy regulations promulgated pursuant to HIPAA].)"Medical patients' privacy interest, o......
-
Saint Luke Inst., Inc. v. Jones
...of the constitutional balancing framework applicable to governmental requests for disclosure. See, e.g. , Citizens for Health v. Leavitt , 428 F.3d 167, 177 (3d Cir. 2005) (holding that a "violation of a citizen's right to medical privacy rises to the level of a constitutional claim only wh......
-
Constitutional violations (42 U.S.C. §1983)
...v. Atkins , 487 U.S. 42, 49 (1988) (quoting United States v. Classic , 313 U.S. 299, 326 (1941)). Compare Citizens for Health v. Leavitt , 428 F.3d 167, 182 (3d Cir. 2005) (holding that a federal regulation that “authoriz[ed] conduct that was already legally permissible”—and that did not pr......