CopyCited 6 times | Published | Court of Appeals for the Eleventh Circuit | 2013 WL 1405035, 2013 U.S. App. LEXIS 7194
...*
Honorable Arthur L. Alarcón, United States Circuit Judge for the Ninth Circuit, sitting by
designation.
Case: 12-12593 Date Filed: 04/09/2013 Page: 2 of 13
BLACK, Circuit Judge:
The issue before us is whether § 400.145 of the Florida Statutes—which
provides for the release of medical records of deceased residents of nursing homes
to certain specified individuals—is preempted by the federal Health Insurance
Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d to d-9,
and its implementing regulations. As it stands, § 400.145 and HIPAA cannot be
reconciled, and we agree with the district court that the Florida statute stands as an
obstacle to the accomplishment and execution of the full purposes and objectives
of HIPAA in keeping an individual’s protected health information strictly
confidential....
...Defendant-Appellant Florida Agency for Health Care Administration (the
State Agency), however, issued citations to the Nursing Facilities for violating
Florida law by refusing to release the records. Specifically, the Facilities were
cited for violating § 400.145 of the Florida Statutes, which requires licensed
nursing homes to release a former resident’s medical records to the spouse,
guardian, surrogate, or attorney-in-fact of any such resident. See Fla. Stat.
§ 400.145(1). In written correspondence to individuals who had requested and
been denied deceased residents’ medical records, the State Agency explained that
it interprets § 400.145 in a manner allowing a spouse to qualify as a personal
representative such that a deceased spouse’s medical records may be disclosed
under HIPAA.
Given the dueling interpretations of the relevant statutes, the Nursing
Faciliti...
...The amendments,
however, are largely immaterial to the issue before us, except for the addition of 45 C.F.R.
§ 164.510(b), which we discuss in further detail below.
3
Case: 12-12593 Date Filed: 04/09/2013 Page: 4 of 13
§ 400.145 is preempted by HIPAA. 3 The parties then filed cross-motions for
summary judgment. In ruling on the motions, the district court found that
§ 400.145 was preempted because it impeded the accomplishment and execution of
HIPAA’s purposes and objectives....
...Fresenius Med. Care Holdings, Inc. v. Tucker,
704 F.3d
935, 939 (11th Cir. 2013).
III. DISCUSSION
The State Agency contends the district court erred in granting summary
judgment to the Nursing Facilities because §
400.145 does not impede the goals
and purposes of HIPAA. Instead, laws such as §
400.145 play a vital role in the
federal statute’s requirements, which look to state law to define the category of
3
In Claim Two, the Nursing Facilities also sought injunctive relief....
...entity.
Id. § 164.510(b)(5).
Since 1987—nearly a decade before Congress enacted HIPAA—Florida law
has required licensed nursing homes to disclose deceased residents’ medical
records to certain individuals who request them. See Fla. Stat. § 400.145; see also
1987 Fla. Sess. Law Serv. 87-302. Specifically, § 400.145 provides that:
Unless expressly prohibited by a legally competent resident, any
nursing home licensed pursuant to this part shall furnish to the spouse,
guardian, surrogate, proxy, or attorney in fact ....
...Copies of such records shall not be considered part of a deceased
resident’s estate and may be made available prior to the administration
of an estate, upon request, to the spouse, guardian, surrogate, proxy,
or attorney in fact . . . .
Fla. Stat. § 400.145(1).
5
We read “applicable law” to mean state law.
8
Case: 12-12593 Date Filed: 04/09/2013 Page: 9 of 13
The State Agency’s argument against p...
...This is important because an individual’s personal representative
enjoys the same broad access to protected information and freedom from the
Privacy Rule’s strictures as the individual. See 45 C.F.R. § 164.502(g)(1).
According to the State Agency, § 400.145 enumerates groups of people, including
spouses, who may access a deceased resident’s medical records “on behalf of” the
resident, meaning that they should be treated as personal representatives. Thus,
rather than conflicting with HIPAA and the Privacy Rule, § 400.145 supplements
and works in tandem with the federal law.
The fatal flaw in the State Agency’s argument is that the plain language of
§ 400.145 does not empower or require an individual to act on behalf of a deceased
resident....
...lth information
9
Case: 12-12593 Date Filed: 04/09/2013 Page: 10 of 13
relevant to such personal representation” (emphasis added)). We therefore agree
with the district court that § 400.145 frustrates the federal objective of limiting
disclosures of protected health information, and that the statute is thus preempted
by the more stringent privacy protections of HIPAA and the Privacy Rule.
The State Agency’s contention that 45 C.F.R. § 164.510(b)(5) saves
§ 400.145 suffers from the same problem....
...Second, covered entities may release only protected health
information that is relevant to such person’s involvement, i.e., information that is
relevant to the care of the deceased individual or to the payment of the deceased
individual’s health care. Section 400.145, by comparison, contains no such
limitations or restrictions.
The State Agency’s reliance on Alvista Healthcare Center, Inc....
...btaining a decedent’s medical
records, and that the statute was “carefully tailored” to provide the authority
contemplated by the Privacy Rule. Id.
Unlike the situation in Alvista, the Florida legislature has not amended or
modified § 400.145 to address the impact of HIPAA and its implementing
regulations. Section 400.145 does not require a HIPAA-compliant authorization to
accompany a request for a deceased individual’s medical records, nor can the
statute plausibly be read as creating a limited personal representation in the person
of a surviving spouse in light of the blanket disclosures that it requires. Given the
opportunity, we are confident the Florida legislature could bring § 400.145 into
compliance with federal law in any number of ways. Amending the statute,
however, is a task for the state legislature, not a panel of federal judges.
Finally, we emphasize that we have no occasion to address the State
Agency’s argument that it is possible to comply with both HIPAA and § 400.145
because 45 C.F.R....
...hus, nothing that we have
said should be inferred as expressing an opinion regarding the “required by law”
provision.
IV. CONCLUSION
For the foregoing reasons, we agree with the district court that § 400.145 of
the Florida Statutes impedes the accomplishment and execution of the full
purposes and objectives of HIPAA and the Privacy Rule in keeping an individual’s
protected health information confidential. Accordingly, the district court’s grant of
summary judgment is AFFIRMED.
7
Although the State Agency cited § 164.512 in its motion for summary judgment, it did
so in support of its argument that § 400.145 is more stringent than the Privacy Rule....
