CopyCited 47 times | Published | Supreme Court of Georgia | May 14, 2007 | 282 Ga. 9, 2007 Fulton County D. Rep. 1457
...Nasrallah, Robertson Bodoh & Nasrallah, LLP, Marietta; Charles R. Adams, III, Adams & Adams, LLP, Forte Valley, Amici Appellant. CARLEY, Justice. Ernestine Wright filed a medical malpractice action against Dr. Thomas Allen and others (Appellants). In ostensible compliance with OCGA §
9-11-9.2, Ms. Wright executed an authorization to release her medical records, which she filed contemporaneously with her complaint. Appellants moved to dismiss on the ground that the authorization did not satisfy the requirements of OCGA §
9-11-9.2 in several particulars....
...r notification to her lawyer, even though the statute does not expressly provide that the plaintiff's requisite authorization must grant such ex parte discovery rights to the defendant. The trial court denied the motion to dismiss, holding that OCGA §
9-11-9.2 was preempted by the Health Insurance Portability and Accountability Act of 1996 (HIPAA)....
...Appellants applied for certiorari to review the decision of the Court of Appeals. Because the preemption question was an issue of first impression and certiorari had not been sought in the Northlake Medical Center case, we granted Appellants' petition. 1. Subsection (a) of OCGA §
9-11-9.2 provides, in relevant part, that [i]n any action for damages alleging medical malpractice ....
...collectively known as "the Privacy Rule." [Cit.] HIPAA expressly preempts any provision of State law that is contrary to the provisions of HIPAA. [Cits.] Northlake Medical Center v. Queen, supra at 511-512(2),
634 S.E.2d 486. The provisions of OCGA §
9-11-9.2(a) impose a requirement on the plaintiff who brings a medical malpractice action in this state to file a medical authorization form contemporaneously with the complaint. The General Assembly could have expressly provided that the requisite authorization comply with the provisions of HIPAA, but it did not. Thus, the issue becomes whether OCGA §
9-11-9.2, as enacted, is unenforceable because it is preempted by HIPAA....
...tient's authorization to disclose protected health information must contain certain elements, one of which is notice of the right to revoke the authorization. Northlake Medical Center v. Queen, supra at 512-513(2),
634 S.E.2d 486. By its terms, OCGA §
9-11-9.2 does not require that the authorization form contain such a notification provision. Appellants urge that this is immaterial, since the plaintiff is always entitled to dismiss the complaint and thereby revoke the authorization which OCGA §
9-11-9.2 requires accompany it....
...The federal statute does not recognize that the right to dismiss a lawsuit in which the submission of an authorization is a prerequisite is the functional equivalent of informing the patient of his or her right to revoke the authorization itself. Therefore, we conclude that OCGA §
9-11-9.2 does not sufficiently comply with the HIPAA requirement of notice of the right to revoke....
...ments. [Cits.] Law v. Zuckerman,
307 F.Supp.2d 705, 708-709(A) (D.Md.2004). "`[M]ore stringent' . . . mean[s] laws that afford patients more control over their medical records." (Emphasis in original.) Law v. Zuckerman, supra at 709(A). Because OCGA §
9-11-9.2 fails to impose any express requirement of notification of the right to revoke, it is possible to comply with its provisions while failing to *817 satisfy the more stringent requirements of HIPAA....
...850(1),
412 S.E.2d 526 (1991). 2. In addition to the statute's failure to provide for notice of the right of revocation, the Court of Appeals in Northlake Medical Center v. Queen, supra at 513(2),
634 S.E.2d 486, found "that the authorization set forth in OCGA §
9-11-9.2 is contrary to HIPAA because it does not satisfy the requirements for a valid HIPAA authorization [in several other respects]....
...[Cit.]" We agree with the holding in that opinion that the failure to require a specific and meaningful identification of the information to be disclosed and the failure to provide for an expiration date or a sufficient expiration event are additional bases which support the conclusion "that OCGA §
9-11-9.2 is contrary to HIPAA and none of the exceptions . . . applies, [so] it is preempted by HIPPA. [Cit.]" Northlake Medical Center v. Queen, supra at 514(2),
634 S.E.2d 486. 3. The dissent cites Buice v. Dixon,
223 Ga. 645,
157 S.E.2d 481 (1967) in support of the position that OCGA §
9-11-9.2, as presently written, can be construed in harmony with HIPAA. However, OCGA §
9-11-9.2 does not simply provide that the plaintiff in a medical malpractice action must file a medical authorization form, and then leave for necessary implication the incorporation into that form of all HIPAA requirements....
...nts and information that the authorization "shall provide," and there is no dispute that several of the HIPAA requirements are not included in that list of enumerated elements. Thus, the question is whether the courts are authorized to construe OCGA §
9-11-9.2 as mandating that the medical authorization form include those missing HIPAA requirements in addition to those which were specified by the General Assembly. On p. 819, the dissent states: [T]he mere absence of a requirement in OCGA §
9-11-9.2 that the authorization contain a statement of the right to revoke, for example, does not render the statute inconsistent with HIPAA, as an authorization could be drafted that includes both the elements required under the state law and also a statement explaining the plaintiff's right to revoke....
...761(1),
272 S.E.2d 721 (1980). However, where, as here, the General Assembly expressly designated what the plaintiff's medical authorization form "shall provide," the principle of "expressio unius est *818 exclusio alterius" makes it impossible for the courts to rewrite OCGA §
9-11-9.2 so as to incorporate the missing HIPAA requirements....
...Fielden, supra; Alexander Properties Group v. Doe, supra. Compare Buice v. Dixon, supra. Otherwise, under the guise of statutory construction, the judiciary would be free to incorporate into state statutes the provisions of any federal statute that it did not deem to be inconsistent. As OCGA §
9-11-9.2 is presently worded, it is possible to satisfy its provisions while failing to comply with the more stringent requirements of HIPAA....
...courts. Judgment affirmed. All the Justices concur, except HUNSTEIN, P.J., who concurs in part and dissents in part. HUNSTEIN, Presiding Justice, concurring in part and dissenting in part. While I agree with the majority that subsection (c) of OCGA §
9-11-9.2, which purports to require plaintiffs to authorize release of all their medical information in cases alleging medical malpractice, is preempted by the HIPAA Privacy Rule, [1] I do not agree that the remaining provisions of OCGA §
9-11-9.2 are so preempted. Accordingly, I respectfully dissent from that portion of the majority's opinion that holds subsections (a) and (b) of §
9-11-9.2 to be preempted by HIPAA....
...provision of [s]tate law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA]." 45 CFR § 160.202. Thus, the starting point for analysis herein should be whether it is possible to comply with OCGA §
9-11-9.2 while at the same time complying with the letter and the spirit of HIPAA. OCGA §
9-11-9.2(a) prescribes generally that a plaintiff in a medical malpractice action must file a medical authorization form contemporaneous with the complaint....
...litate the investigation, evaluation, and defense of the claims and allegations set forth in the complaint"; and it must authorize defense counsel to "discuss the care and treatment of the plaintiff . . . with all of [his] treating physicians." OCGA §
9-11-9.2(b)....
...Subsection (c) provides further content for the authorization, requiring that it "provide for the release of all protected health information except information that is considered privileged . . . by any physician or health care facility by which health care records of the plaintiff . . . would be maintained." OCGA §
9-11-9.2(c). Under the reasoning of the majority, which affirms the Court of Appeals' reliance below on its prior holding in Northlake Medical Center v. Queen,
280 Ga.App. 510,
634 S.E.2d 486 (2006), OCGA §
9-11-9.2 is preempted because the authorization required thereunder does not comport with the HIPAA requirements for valid authorizations....
...provided that such additional elements or information are not inconsistent with the elements required by this section." 45 CFR § 164.508(b)(1)(ii). The Court of Appeals held, and the majority herein affirms, that preemption is required because OCGA §
9-11-9.2 does not specifically incorporate either literally or by reference the elements required under 45 CFR § 164.508(c). However, the majority and the Court of Appeals fail to recognize that this omission does not make the state law necessarily inconsistent with HIPAA, as it might be possible to draft an authorization that would comply with both OCGA §
9-11-9.2 and 45 CFR § 164.508(c). Like the Court of Appeals, the majority appears to equate the absence of certain required elements to a statutory prohibition on their inclusion. However, the mere absence of a requirement in OCGA §
9-11-9.2 that the authorization contain a statement of the right to revoke, for example, does not render the statute inconsistent with HIPAA, as an authorization could be drafted that includes both the elements required under the state law and also a statement explaining the plaintiff's right to revoke....
...ired by HIPAA, [3] and the failure to require an explicit expiration date or event does not preclude the inclusion of such. [4] Contrary to the Court of Appeals' position in Northlake Medical Center and the majority's opinion herein, construing OCGA §
9-11-9.2 in harmony with HIPAA by recognizing the possibility of creating an authorization that complies with both does not constitute rewriting the statute....
...relief against county officers for failing to fulfill statutory duties, as implicitly incorporating superior court rules and procedures regarding notice to and service on defendants). Nor does this approach, as the majority contends, "construe OCGA §
9-11-9.2 as mandating that the medical authorization form include those missing HIPAA requirements in addition to those which were specified by the General Assembly." Majority Op....
...y with the common law and the Constitution, but also with reference to other statutes and the decisions of the courts") (punctuation omitted). The majority invokes the principle of "expressio unius est exclusion alterius" to argue that, because OCGA §
9-11-9.2(b) and (c) expressly prescribe some required content for the authorization, we must assume that all other potential content is prohibited....
...enacted the statute at issue with knowledge of existing law and with the intent that it would coexist in harmony with, rather than be preempted by, such law. Specifically, as correctly recognized in the dissent in Northlake Medical Center, when OCGA §
9-11-9.2 was enacted[,] existing Georgia law provided that, by filing a medical malpractice complaint, the plaintiff waived the right to privacy in the plaintiff's medical recordswithout the necessity of waiver by a written medical authorizationto the extent the complaint placed the plaintiff's medical care and treatment . . . at issue in the civil action. Northlake Medical Center,
280 Ga.App. at 518,
634 S.E.2d 486 (Andrews, P.J., dissenting). Indeed, at the time OCGA §
9-11-9.2 was enacted, the placing of one's medical condition at issue in litigation acted as an automatic waiver of a patient's right to privacy in his medical records related to that condition, OCGA § 24-9-40(a) [6] , and Georgia case law had long reaffirmed this principle. See Orr v. Sievert,
162 Ga.App. 677,
292 S.E.2d 548 (1982). It follows that, when the General Assembly enacted OCGA §
9-11-9.2, there was no necessity under existing Georgia law to require that the plaintiff file a written medical authorization with the complaint to establish a waiver of the plaintiff's privacy rights in relevant medical records. There was such a necessity, however, under existing federal law in HIPAA. Northlake Medical Center,
280 Ga.App. at 518-519,
634 S.E.2d 486 (Andrews, P.J., dissenting). The implication, thus, is that OCGA §
9-11-9.2 was enacted not only with knowledge of, but indeed as a result of, HIPAA, which further supports the notion that the statute should be construed in harmony therewith to the extent possible. [7] Notwithstanding the fact that I believe it possible to comply with both OCGA §
9-11-9.2 and the technical requirements in 45 CFR § 164.508(c) by utilizing an authorization containing all elements required under *821 both enactments, I do not believe it possible to comply with subsection (c) of OCGA §
9-11-9.2 without violating the overall purpose of the Privacy Rule, namely, protecting medical privacy and affording individuals greater control over their own medical information....
...ack to the individual, I believe that subsection (c) "stands as an obstacle to the accomplishment and execution of the full purposes of," and is thus "contrary to," the Privacy Rule. See 45 CFR § 160.202. Having been found "contrary to" HIPAA, OCGA §
9-11-9.2(c) will be preempted unless it is "more stringent" than HIPAA's requirements....
...ndividual." See 45 CFR § 160.202. Given that subsection (c) would clearly provide less protection for individuals' medical privacy, it is not "more stringent" than HIPAA and thus is preempted. It should be noted that preserving the validity of OCGA §
9-11-9.2 subsections (a) and (b) while finding subsection (c) to be preempted specifically comports with the intent of the General Assembly, expressed explicitly in enacting the "tort reform" act of which §
9-11-9.2 is a part, that [i]n the event any section, subsection, sentence, clause or phrase of this Act shall be declared or adjudged invalid or unconstitutional, such adjudication shall in no manner affect the other sections, subsections, sentenc...
...ning valid portions is authorized as long as "the remaining portion of the [statute] accomplishes the purpose the legislature intended. [Cits.]" Nixon v. State,
256 Ga. 261, 264(3),
347 S.E.2d 592 (1986). Here, it appears the overall purpose of OCGA §
9-11-9.2 was to require an authorization as a threshold condition to the filing of a medical malpractice action, and the striking of subsection (c) does not impair this purpose. [9] Accordingly, I would affirm the decision of the Court of Appeals only insofar as it holds subsection (c) of OCGA §
9-11-9.2 to be preempted by HIPAA; reverse as to its holding of preemption as to OCGA §
9-11-9.2 subsections (a) and (b); and remand to the superior court for reconsideration of appellee's motion to dismiss in light of the foregoing....
...Throughout this opinion the terms "HIPAA Privacy Rule," "Privacy Rule," and "HIPAA" are used interchangeably. [2] Such a statement would have to include an explanation that revocation of the authorization would subject the complaint to dismissal. See OCGA §
9-11-9.2(a)....
...is or her protected health information." 65 Fed.Reg. 82462, 82530 (Dec. 28, 2000). [3] Though the Court of Appeals also held that HIPAA's "specific and meaningful description" requirement was violated by virtue of the breadth of the information OCGA §
9-11-9.2 requires to be authorized for release, it is clear from the preamble to the Privacy Rule that this requirement is intended to compel specificity of description, rather than limitation on scope, of information sought....
...at 82,517 ("There are no limitations on the information that can be authorized for disclosure. If an individual wishes to authorize [the disclosure of] his or her entire medical record, the authorization can so specify"). However, the breadth of information to be authorized for release under OCGA §
9-11-9.2 is of concern for other reasons, as discussed below....
...Abdulkadir v. State, 279 Ga., 122(2),
610 S.E.2d 50 (2005) (construing rape shield statute as not applicable in prosecutions for child molestation). [6] To date, the Legislature has not amended OCGA § 24-9-40(a). [7] The legislative history of OCGA §
9-11-9.2 further indicates that those who enacted the statute were cognizant of HIPAA....
...a. St. U.L.Rev. 221, 244 (2005). [8] The Privacy Rule prescribes three other exceptions to preemption, none of which are applicable here. See 45 CFR § 160.203. [9] In its amicus brief, the Georgia Trial Lawyers Association ("GTLA") argues that OCGA §
9-11-9.2 is preempted in its entirety to the extent subsection (b) is construed to require the authorization to include a provision permitting ex parte communications between the plaintiff's treating physicians and defense counsel....
