Opis Mgmt. Res., LLC v. Sec'y, Fla. Agency for Health Care Admin.

• Decision Date: 09 April 2013
• Docket Number: No. 12–12593.,12–12593.
• Citation: 713 F.3d 1291
• Parties: OPIS MANAGEMENT RESOURCES, LLC, Ruleme Center, LLC, Gulf Coast Healthcare, LLC, SA–PG–Jacksonville, LLC, SA–PG–Sun City Center, LLC, et al., Plaintiffs–Appellees, v. SECRETARY, FLORIDA AGENCY FOR HEALTH CARE ADMINISTRATION, Defendant–Appellant.
• Court: U.S. Court of Appeals — Eleventh Circuit

713 F.3d 1291

OPIS MANAGEMENT RESOURCES, LLC, Ruleme Center, LLC, Gulf Coast Healthcare, LLC, SA–PG–Jacksonville, LLC, SA–PG–Sun City Center, LLC, et al., Plaintiffs–Appellees,

v.SECRETARY, FLORIDA AGENCY FOR HEALTH CARE ADMINISTRATION, Defendant–Appellant.

No. 12–12593.

United States Court of Appeals, Eleventh Circuit.

April 9, 2013.

Preempted

West's F.S.A. § 400.145Kari Leigh Aasheim, Daniel E. Dias, Mancuso & Dias, PA, Tampa, FL, for Plaintiffs–Appellees.

Shena L. Grantham, Dwight Oneal Slater, Stuart F. Williams, Florida Agency for Health Care Admin., Pam Bondi, Atty. Gen.'s Office, Tallahassee, FL, for Defendant–Appellant.

Appeal from the United States District Court for the Northern District of Florida.

Before DUBINA, Chief Judge, and BLACK and ALARCÓN,^* Circuit Judges.

BLACK, Circuit Judge:

The issue before us is whether § 400.145 of the Florida Statutes—which provides for the release of medical records of deceased residents of nursing homes to certain specified individuals—is preempted by the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d to d–9, and its implementing regulations. As it stands, § 400.145 and HIPAA cannot be reconciled, and we agree with the district court that the Florida statute stands as an obstacle to the accomplishment and execution of the full purposes and objectives of HIPAA in keeping an individual's protected health information strictly confidential. Accordingly, we affirm.

I. BACKGROUND

The underlying facts are not in dispute. Plaintiffs–Appellees OPIS Management Resources, LLC; Ruleme Center, LLC; Gulf Coast Healthcare, LLC; SA–PG–Jacksonville, LLC; SA–PG–Sun City Center, LLC; Cypress Health Group, LLC; and Consulate Health Care, LLC (collectively the Nursing Facilities or the Facilities) are operators and managers of skilled nursing facilities in Florida. In the course of their operations, the Nursing Facilities received requests from spouses and attorneys-in-fact for the medical records of deceased nursing home residents. The Facilities refused to disclose the records because the parties requesting them were not “personal representatives” under the relevant provisions of HIPAA, which regulates the release of protected health information by covered entities.¹See 45 C.F.R. § 164.502. ² Consequently, the requesting parties filed complaints with the U.S. Department of Health and Human Services Office for Civil Rights, which concluded the Nursing Facilities' actions were consistent with HIPAA.

Defendant–Appellant Florida Agency for Health Care Administration (the State Agency), however, issued citations to the Nursing Facilities for violating Florida law by refusing to release the records. Specifically, the Facilities were cited for violating § 400.145 of the Florida Statutes, which requires licensed nursing homes to release a former resident's medical records to the spouse, guardian, surrogate, or attorney-in-fact of any such resident. See Fla. Stat. § 400.145(1). In written correspondence to individuals who had requested and been denied deceased residents' medical records, the State Agency explained that it interprets § 400.145 in a manner allowing a spouse to qualify as a personal representative such that a deceased spouse's medical records may be disclosed under HIPAA.

Given the dueling interpretations of the relevant statutes, the Nursing Facilities filed a complaint in the district court seeking a declaratory judgment that § 400.145 is preempted by HIPAA.³ The parties then filed cross-motions for summary judgment. In ruling on the motions, the district court found that § 400.145 was preempted because it impeded the accomplishment and execution of HIPAA's purposes and objectives. The court granted the Nursing Facilities' motion for summary judgment, explaining that the Florida statute affords nursing home residents less protection than is required by the federal law. This appeal followed.

II. STANDARD OF REVIEW

We review the district court's grant of summary judgment de novo, viewing the evidence and drawing all reasonable inferences in the light most favorable to the nonmoving party. Fresenius Med. Care Holdings, Inc. v. Tucker, 704 F.3d 935, 939 (11th Cir.2013).

III. DISCUSSION

The State Agency contends the district court erred in granting summary judgment to the Nursing Facilities because § 400.145 does not impede the goals and purposes of HIPAA. Instead, laws such as § 400.145 play a vital role in the federal statute's requirements, which look to state law to define the category of “personal representatives” to whom a deceased individual's protected health information may be disclosed.

We begin our analysis with the bedrock principle that the Constitution designates the laws of the United States as the supreme law of the land, requiring that “all conflicting state provisions be without effect.” Maryland v. Louisiana, 451 U.S. 725, 746, 101 S.Ct. 2114, 2128–29, 68 L.Ed.2d 576 (1981); see also U.S. Const. art. VI, cl. 2. Accordingly, where state and federal law directly conflict, “state law must give way.” PLIVA, Inc. v. Mensing, ––– U.S. ––––, 131 S.Ct. 2567, 2577, 180 L.Ed.2d 580 (2011). In addition, “[t]here is no doubt that Congress may withdraw specified powers from the States by enacting a statute containing an express preemption provision.” Arizona v. United States, ––– U.S. ––––, 132 S.Ct. 2492, 2500–01, 183 L.Ed.2d 351 (2012). As the Supreme Court has explained, “[w]hen a federal law contains an express preemption clause, we focus on the plain wording of the clause,” as the plain language of the text is “the best evidence of Congress' preemptive intent.” Chamber of Commerce of U.S. v. Whiting, ––– U.S. ––––, 131 S.Ct. 1968, 1977, 179 L.Ed.2d 1031 (2011) (internal quotation omitted). Nevertheless, “when the text of a pre-emption clause is susceptible of more than one plausible reading, courts ordinarily accept the reading that disfavors pre-emption.” Altria Grp., Inc. v. Good, 555 U.S. 70, 77, 129 S.Ct. 538, 543, 172 L.Ed.2d 398 (2008) (internal quotation omitted).

In drafting HIPAA, Congress included an express preemption provision. 42 U.S.C. § 1320d–7. HIPAA's preemption clause provides that the statute “shall supersede any contrary provision of State law,” and lists certain exceptions that are not at issue here. Id. § 1320d–7(a). A state law is “contrary” to HIPAA if:

(1) A covered entity or business associate would find it impossible to comply with both the State and Federal requirements; or

(2) The provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of ... section 264 of Public Law 104–191 ....

45 C.F.R. § 160.202. HIPAA, however, does not preempt state laws that provide “more stringent” privacy protections. See id. § 160.203(b).

One of Congress's objectives in enacting HIPAA was to address concerns about the confidentiality of patients' individually identifiable health information. See Health Insurance Portability and Accountability Act of 1996, Pub.L. No. 104–191, § 264, 110 Stat. 1936; see also S.C. Med. Ass'n v. Thompson, 327 F.3d 346, 348, 354 (4th Cir.2003) (“Recognizing the importance of protecting the privacy of health information in the midst of the rapid evolution of health information systems, Congress passed HIPAA in August 1996.”). To that end, Congress provided for the Secretary of Health and Human Services to promulgate privacy regulations addressing individuals' rights to individually identifiable health information, procedures for exercising such rights, and the uses and disclosures of such information. Pub.L. No. 104–191, § 264(b) & (c)(1); S.C. Med. Ass'n, 327 F.3d at 349. In compliance with the statute, the Department of Health and Human Services issued final regulations known as the “Privacy Rule.” S.C. Med. Ass'n, 327 F.3d at 349;see also Citizens for Health v. Leavitt, 428 F.3d 167, 172–74 (3d Cir.2005) (detailing the history of the Privacy Rule's promulgation and explaining its requirements). The Privacy Rule establishes that “[a] covered entity or business associate may not use or disclose protected health information,” except in certain circumstances not at issue here, or with valid authorization. 45 C.F.R. §§ 164.502(a), 164.508(a)(1). Among the disclosures permitted by the Privacy Rule are disclosures to the individual whose information is being protected, as well as disclosures to the individual's personal representative. Id. § 164.502(a)(1)(i), (g)(1) (“[A] covered entity must ... treat a personal representative as the individual for purposes of this subchapter.”).

As of March 26, 2013, “[a] covered entity must comply with the requirements of [the Privacy Rule] with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.” Id. § 164.502(f).⁴ Regarding deceased individuals, the Privacy Rule further specifies that:

If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.

Id. § 164.502(g)(4).⁵ Also as of March 26, 2013, if an individual is deceased,

a covered entity may disclose to a family member, or [other relatives, close personal friends of the individual, or any other persons identified by the individual] who were involved in the individual's care or payment for health care prior to the individual's death, protected health information of the individual that is relevant to such person's involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

Id.§ 164.510(b)(5).

Since 1987—nearly a decade before Congress enacted HIPAA—Florida law has required licensed nursing homes to disclose...