Liberty Mut. Ins. Co. v. Kimbell

• Decision Date: 09 November 2012
• Docket Number: Case No. 2:11-cv-204
• Parties: LIBERTY MUTUAL INSURANCE COMPANY, Plaintiff, v. STEPHEN W. KIMBELL, in his capacity as the Vermont Commissioner of Banking, Insurance, Securities and Health Care Administration, Defendant.
• Court: U.S. District Court — District of Vermont

LIBERTY MUTUAL INSURANCE COMPANY, Plaintiff, v. STEPHEN W. KIMBELL, in his capacity

as the Vermont Commissioner of Banking, Insurance,

Securities and Health Care Administration, Defendant.

Case No. 2:11-cv-204

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF VERMONT

Dated: November 9, 2012

OPINION and ORDER

Plaintiff Liberty Mutual Insurance Company ("Liberty Mutual") seeks a declaration that Section 502(a) of the Employee Retirement Income Security Act of 1974 ("ERISA"), 29 U.S.C. § 1132(a), preempts Vermont's statute and regulation requiring it to provide information for the State's health care database, see Vt. Stat. Ann. tit. 18, § 9410 (2000 & Supp. 2011); Reg. H-2008-01, and to enjoin the enforcement of a subpoena directing the production of eligibility, medical claims and pharmacy claims files. Defendant Stephen W. Kimbell, in his official capacity as Commissioner of the Vermont Department of Banking, Insurance, Securities and Health Care Administration ("BISHCA" or "Department"),¹ moved to dismiss the complaint for lack of standing and for failure to state a claim upon which relief can be granted. See Fed. R. Civ. P. 12(b)(1), 12(b)(6). LibertyMutual moved for summary judgment. See Fed. R. Civ. P. 56(a). At oral argument on the motions, with the parties' concurrence, the Court converted the Department's Rule 12(b)(6) motion to one for summary judgment under Rule 56(a), in order to consider materials submitted outside the pleadings. See Fed. R. Civ. P. 12(d). For the reasons that follow, the Court concludes that Liberty Mutual has standing to bring this suit for declaratory and injunctive relief, but that the Department's motion for summary judgment is granted because ERISA does not preempt section 9410. Accordingly, the Department's Motion to Dismiss, ECF No. 15, is granted in part and denied in part. The motion is denied with respect to standing and granted with respect to ERISA preemption. Liberty Mutual's Motion for Summary Judgment, ECF No. 35, is denied. Liberty Mutual's Motion for Leave to Respond to Defendant's Notice of Supplemental Authority, ECF No. 52, is granted.

Background²

Liberty Mutual is an insurance company organized under the laws of the Commonwealth of Massachusetts. It is a wholly owned subsidiary of Liberty Mutual Group Inc. Liberty Mutual has employees and offices in Vermont and conducts business within the state.

Liberty Mutual established the Liberty Mutual Medical Plan("Plan") for the benefit of company employees. As of June 30, 2011, the Plan provided medical benefits to 84,711 persons throughout the United States, including 32,933 employees of Liberty Mutual Group, Inc. and its subsidiaries, plus employees' families and company retirees. As of that date, 137 plan participants or beneficiaries resided in Vermont.

As an employee welfare benefit plan, the Plan is governed by ERISA. Liberty Mutual is the "named fiduciary" and "plan administrator" of the Plan within the meaning of Section 3 of ERISA, 29 U.S.C. § 1002. The Plan is self-funded, or self-insured, meaning that Liberty Mutual Group, Inc. pays all benefits provided under the Plan from its own general assets. The Plan contracts with Blue Cross Blue Shield of Massachusetts, Inc. ("BCBSMA") as the third-party administrator ("TPA") of the Plan. As such, BCBSMA processes medical claims for Plan participants, receives participants' confidential medical records and generates claims data. The Administrative Services Agreement ("Agreement") between BCBSMA and Liberty Mutual provides that any information Liberty Mutual makes available must be used solely for the purpose of administering BCBSMA's health care plans, and that its auditors must have procedures in place to guard against unauthorized disclosure of health care information. See Agreement §§5, 6; ECF No. 22-4.

In Liberty Mutual's summary plan description ("SPD"),provided to participants, Liberty Mutual informs participants that information they provide in connection with screening for risk factors will be kept strictly confidential, and that if they participate in genetic testing the test is confidential. See SPD "Well-Baby Programs" at B-28, "Personalized Medicine Program" at B-46; ECF No. 22-5.

Liberty Mutual's Plan specifies that it "has been established for the exclusive benefit of Participants . . . ." See Plan § 9.1; ECF No. 22-2. It also provides that the Plan "shall comply with all other state and federal law to the extent not preempted by ERISA and to the extent such laws require compliance by the Plan." Id. § 9.9.

Liberty Mutual's Plan is subject to federal reporting and disclosure requirements set forth in ERISA Sections 101 through 110 and associated regulations. See 29 U.S.C. §§ 1021-1031; 29 C.F.R. §§2520.101-1 to 2520.107-1. In addition, Section 513 of ERISA authorizes the Secretary of Labor to "undertake research and surveys and in connection therewith to collect, compile, analyze and publish data, information, and statistics relating to employee benefit plans . . . ." 29 U.S.C. § 1143(a).

Vermont has enacted legislation to create a unified health care database. See Vt. Stat. Ann. tit. 18, § 9410 (2000 & Supp. 2011). The database, established and maintained by the Department, is designed to enable the Department to determine thecapacity of existing resources, identify health care needs, evaluate effectiveness, compare costs, provide information to consumers and purchasers of health care, and improve the quality and affordability of patient health care and health care coverage. See § 9410(a)(1)(A)-(F).

Section 9410 requires "health insurers," which includes "any . . . entity with claims data . . . and other information relating to health care provided to Vermont resident[s]," § 9410(j)(1)(B), to "file reports, data, schedules, statistics, or other information determined by [the Department] to be necessary to carry out the purposes of" the statute. § 9410(c). The statute mandates the adoption of rules to carry out its purposes, § 9410(a)(2)(D), and provides for administrative penalties for knowing and for willful failure to comply with the statute or rules. § 9410(g).

Pursuant to the statute, the Department promulgated Regulation H-2008-01 to implement the creation of the unified health care database. It states:

The purpose of this rule is to set forth the requirements for the submission of health care claims data, member eligibility data, and other information relating to health care provided to Vermont residents . . . by health insurers, . . . . third party administrators, . . . and others to the [DFR] and conditions for the use and dissemination of such claims data, all as required by and consistent with the purposes of . . . § 9410.

Reg. H-2008-01, § 1. The Vermont Healthcare Claims Uniform Reporting and Evaluation System ("VHCURES") is the Department'ssystem for the collection, management and reporting of this data. See id. § 3Ar.

The regulation tracks the statute in defining "health insurer" to include entities defined in § 9410(j)(1), including

any third party administrator . . . and any entity . . . possessing claims data, eligibility data, provider files, and other information relating to health care provided to Vermont residents or by Vermont health care providers and facilities. The term may also include, to the extent permitted under federal law, any administrator of an insured, self-insured, or publicly funded health care benefit plan offered by public and private entities.

Id. § 3X.

The parties do not dispute that Liberty Mutual and BCBSMA fall within the regulation's definition of "health insurer."

The regulation requires health insurers to register with the Department, and to identify whether health care claims are being paid for members who are Vermont residents or for non-residents who are receiving covered services from Vermont health care providers or facilities. See id. § 4A. Health insurers must "regularly submit medical claims data, pharmacy claims data, member eligibility data, provider data, and other information relating to health care provided to Vermont residents and health care provided by Vermont health care providers and facilities to both Vermont residents and non-residents in specified electronic format." Id. § 4D. The regulation sets a threshold for "mandated reporters," those health insurers with two hundred ormore enrolled or covered members. Id. § 3Ab. All other health insurers are considered "voluntary reporters." Id. § 3As. Voluntary reporters may, but are not required to, participate in VHCURES. See id. § 4E.

The statute and regulation include various measures designed to protect confidential material. See §§ 9410(a)(2)(D) ("The rules shall permit health insurers to use security measures designed to allow subscribers access to price and other information without disclosing trade secrets to individuals and entities who are not subscribers."); (e) ("Records or information protected by the provisions of the physician-patient privilege . . . or otherwise required by law to be held confidential, shall be filed in manner that does not disclose the identity of the protected person."); (f) (The commissioner shall adopt a confidentiality code to ensure that information obtained under this section is handled in an ethical manner."); (g) ("[A]ny person who knowingly fails to comply with the confidentiality requirements of this section or confidentiality rules adopted pursuant to this section and uses, sells, or transfers the data or information for commercial advantage, pecuniary gain, personal gain, or malicious harm shall be subject to an administrative penalty of not more than $50,000.00 per violation."); (h)(2)(D) ("Notwithstanding [the Health Insurance Portability and Accountability Act ("HIPAA")] or any other provision of law, thecomprehensive health care information system shall not publicly disclose any data that contains direct personal identifiers. . . ."); see also Reg. H-2008-01 §§ 5(A)(5) (setting forth code and...