CARLEY, Justice.
Ernestine Wright filed a medical malpractice action against Dr. Thomas Allen and others (Appellants). In ostensible compliance with OCGA § 9-11-9.2, Ms. Wright executed an authorization to release her medical records, which she filed contemporaneously with her complaint. Appellants moved to dismiss on the ground that the authorization did not satisfy the requirements of OCGA § 9-11-9.2 in several particulars. Appellants’ objections included the failure of the document to authorize their attorneys to communicate with her [10]*10treating physicians outside the presence of and without prior notification to her lawyer, even though the statute does not expressly provide that the plaintiffs requisite authorization must grant such ex parte discovery rights to the defendant. The trial court denied the motion to dismiss, holding that OCGA § 9-11-9.2 was preempted by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The trial court certified its order for immediate review, and the Court of Appeals granted an interlocutory appeal. That Court affirmed the trial court’s ruling in a brief opinion which noted that the preemption issue had recently been decided adversely to Appellants’ contention in Northlake Medical Center v. Queen, 280 Ga. App. 510 (634 SE2d 486) (2006) and that “the reasoning set forth in Division 2 of that opinion [is] controlling here.” Allen v. Wright, 280 Ga. App. 554, 555 (1) (634 SE2d 518) (2006). See also Crisp Regional Hosp. v. Sanders, 281 Ga. App. 393 (636 SE2d 123) (2006).
Appellants applied for certiorari to review the decision of the Court of Appeals. Because the preemption question was an issue of first impression and certiorari had not been sought in the Northlake Medical Center case, we granted Appellants’ petition.
1. Subsection (a) of OCGA § 9-11-9.2 provides, in relevant part, that
[i]n any action for damages alleging medical malpractice..., contemporaneously with the filing of the complaint, the plaintiff shall be required to file a medical authorization form. Failure to provide this authorization shall subject the complaint to dismissal.
Subsection (b) of the statute specifies that
[t]he authorization shall provide that the attorney representing the defendant is authorized to obtain and disclose protected health information contained in medical records to facilitate the investigation, evaluation, and defense of the claims and allegations set forth in the complaint which pertain to the plaintiff or, where applicable, the plaintiffs decedent whose treatment is at issue in the complaint. This authorization includes the defendant’s attorney’s right to discuss the care and treatment of the plaintiff or, where applicable, the plaintiffs decedent with all of the plaintiffs or decedent’s treating physicians.
[11]*11Subsection (c) states that
[t]he authorization shall provide for the release of all protected health information except information that is considered privileged and shall authorize the release of such information by any physician or health care facility by which health care records of the plaintiff or the plaintiff s decedent would be maintained.
The intent of HIPAA is “to ensure the integrity and confidentiality of patients’ information and to protect against unauthorized uses or disclosures of the information.” [Cit.] The rules promulgating the standards set forth in HIPAA, which govern the disclosure of “protected health information” by health care providers, are collectively known as “the Privacy Rule.” [Cit.] HIPAA expressly preempts any provision of State law that is contrary to the provisions of HIPAA. [Cits.]
Northlake Medical Center v. Queen, supra at 511-512 (2). The provisions of OCGA § 9-11-9.2 (a) impose a requirement on the plaintiff who brings a medical malpractice action in this state to file a medical authorization form contemporaneously with the complaint. The General Assembly could have expressly provided that the requisite authorization comply with the provisions of HIPAA, but it did not. Thus, the issue becomes whether OCGA § 9-11-9.2, as enacted, is unenforceable because it is preempted by HIPAA. “Where a [S]tate statute conflicts with, or frustrates, federal law, the former must give way. [Cits.]” CSXTransp. v. Easterwood, 507 U. S. 658, 663 (I) (113 SC 1732, 123 LE2d 387) (1993).
As was recognized by the Court of Appeals, in order to comply with HIPAA, a patient’s authorization to disclose protected health information must contain certain elements, one of which is notice of the right to revoke the authorization. Northlake Medical Center v. Queen, supra at 512-513 (2). By its terms, OCGA § 9-11-9.2 does not require that the authorization form contain such a notification provision. Appellants urge that this is immaterial, since the plaintiff is always entitled to dismiss the complaint and thereby revoke the authorization which OCGA § 9-11-9.2 requires accompany it. However, the fallacy in this assertion is that revocation of the authorization is simply the indirect result of dismissal of the lawsuit. HIPAA requires that a patient be expressly informed of the right to revoke the authorization directly. There is a significant difference between the requirement that express notice be given to a medical patient of the right to revoke an authorization of access to protected medical [12]*12information, and simply recognizing that the exercise of his or her legal right of dismissal of the lawsuit can have an effect similar to a direct revocation of the authorization itself. HIPAA requires that patients be informed of their right to revoke an authorization form. The federal statute does not recognize that the right to dismiss a lawsuit in which the submission of an authorization is a prerequisite is the functional equivalent of informing the patient of his or her right to revoke the authorization itself.
Therefore, we conclude that OCGA § 9-11-9.2 does not sufficiently comply with the HIPAA requirement of notice of the right to revoke.
This Court may construe statutes to avoid absurd results .... [Cit.] However, under our system of separation of powers this Court does not have the authority to rewrite statutes. “(T)he doctrine of separation of powers is an immutable constitutional principle which must be strictly enforced. Under that doctrine, statutory construction belongs to the courts, legislation to the legislature.
Free access — add to your briefcase to read the full text and ask questions with AI
CARLEY, Justice.
Ernestine Wright filed a medical malpractice action against Dr. Thomas Allen and others (Appellants). In ostensible compliance with OCGA § 9-11-9.2, Ms. Wright executed an authorization to release her medical records, which she filed contemporaneously with her complaint. Appellants moved to dismiss on the ground that the authorization did not satisfy the requirements of OCGA § 9-11-9.2 in several particulars. Appellants’ objections included the failure of the document to authorize their attorneys to communicate with her [10]*10treating physicians outside the presence of and without prior notification to her lawyer, even though the statute does not expressly provide that the plaintiffs requisite authorization must grant such ex parte discovery rights to the defendant. The trial court denied the motion to dismiss, holding that OCGA § 9-11-9.2 was preempted by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The trial court certified its order for immediate review, and the Court of Appeals granted an interlocutory appeal. That Court affirmed the trial court’s ruling in a brief opinion which noted that the preemption issue had recently been decided adversely to Appellants’ contention in Northlake Medical Center v. Queen, 280 Ga. App. 510 (634 SE2d 486) (2006) and that “the reasoning set forth in Division 2 of that opinion [is] controlling here.” Allen v. Wright, 280 Ga. App. 554, 555 (1) (634 SE2d 518) (2006). See also Crisp Regional Hosp. v. Sanders, 281 Ga. App. 393 (636 SE2d 123) (2006).
Appellants applied for certiorari to review the decision of the Court of Appeals. Because the preemption question was an issue of first impression and certiorari had not been sought in the Northlake Medical Center case, we granted Appellants’ petition.
1. Subsection (a) of OCGA § 9-11-9.2 provides, in relevant part, that
[i]n any action for damages alleging medical malpractice..., contemporaneously with the filing of the complaint, the plaintiff shall be required to file a medical authorization form. Failure to provide this authorization shall subject the complaint to dismissal.
Subsection (b) of the statute specifies that
[t]he authorization shall provide that the attorney representing the defendant is authorized to obtain and disclose protected health information contained in medical records to facilitate the investigation, evaluation, and defense of the claims and allegations set forth in the complaint which pertain to the plaintiff or, where applicable, the plaintiffs decedent whose treatment is at issue in the complaint. This authorization includes the defendant’s attorney’s right to discuss the care and treatment of the plaintiff or, where applicable, the plaintiffs decedent with all of the plaintiffs or decedent’s treating physicians.
[11]*11Subsection (c) states that
[t]he authorization shall provide for the release of all protected health information except information that is considered privileged and shall authorize the release of such information by any physician or health care facility by which health care records of the plaintiff or the plaintiff s decedent would be maintained.
The intent of HIPAA is “to ensure the integrity and confidentiality of patients’ information and to protect against unauthorized uses or disclosures of the information.” [Cit.] The rules promulgating the standards set forth in HIPAA, which govern the disclosure of “protected health information” by health care providers, are collectively known as “the Privacy Rule.” [Cit.] HIPAA expressly preempts any provision of State law that is contrary to the provisions of HIPAA. [Cits.]
Northlake Medical Center v. Queen, supra at 511-512 (2). The provisions of OCGA § 9-11-9.2 (a) impose a requirement on the plaintiff who brings a medical malpractice action in this state to file a medical authorization form contemporaneously with the complaint. The General Assembly could have expressly provided that the requisite authorization comply with the provisions of HIPAA, but it did not. Thus, the issue becomes whether OCGA § 9-11-9.2, as enacted, is unenforceable because it is preempted by HIPAA. “Where a [S]tate statute conflicts with, or frustrates, federal law, the former must give way. [Cits.]” CSXTransp. v. Easterwood, 507 U. S. 658, 663 (I) (113 SC 1732, 123 LE2d 387) (1993).
As was recognized by the Court of Appeals, in order to comply with HIPAA, a patient’s authorization to disclose protected health information must contain certain elements, one of which is notice of the right to revoke the authorization. Northlake Medical Center v. Queen, supra at 512-513 (2). By its terms, OCGA § 9-11-9.2 does not require that the authorization form contain such a notification provision. Appellants urge that this is immaterial, since the plaintiff is always entitled to dismiss the complaint and thereby revoke the authorization which OCGA § 9-11-9.2 requires accompany it. However, the fallacy in this assertion is that revocation of the authorization is simply the indirect result of dismissal of the lawsuit. HIPAA requires that a patient be expressly informed of the right to revoke the authorization directly. There is a significant difference between the requirement that express notice be given to a medical patient of the right to revoke an authorization of access to protected medical [12]*12information, and simply recognizing that the exercise of his or her legal right of dismissal of the lawsuit can have an effect similar to a direct revocation of the authorization itself. HIPAA requires that patients be informed of their right to revoke an authorization form. The federal statute does not recognize that the right to dismiss a lawsuit in which the submission of an authorization is a prerequisite is the functional equivalent of informing the patient of his or her right to revoke the authorization itself.
Therefore, we conclude that OCGA § 9-11-9.2 does not sufficiently comply with the HIPAA requirement of notice of the right to revoke.
This Court may construe statutes to avoid absurd results .... [Cit.] However, under our system of separation of powers this Court does not have the authority to rewrite statutes. “(T)he doctrine of separation of powers is an immutable constitutional principle which must be strictly enforced. Under that doctrine, statutory construction belongs to the courts, legislation to the legislature. We can not add a line to the law.” [Cit.]
State v. Fielden, 280 Ga. 444, 448 (629 SE2d 252) (2006).
HIPAA and the related provisions established in the Code of Federal Regulations expressly supercede any contrary provisions of [S]tate law except as provided in 42 U.S.C. § 1320d-7 (a) (2). Under the relevant exception, HIPAA and its standards do not preempt state law if the state law relates to the privacy of individually identifiable health information and is “more stringent” than HIPAA’s requirements. [Cits.]
Law v. Zuckerman, 307 FSupp.2d 705, 708-709 (A) (D. Md. 2004). “ ‘[M]ore stringent’... mean[s] laws that afford patients more control over their medical records.” (Emphasis in original.) Law v. Zuckerman, supra at 709 (A). Because OCGA § 9-11-9.2 fails to impose any express requirement of notification of the right to revoke, it is possible to comply with its provisions while failing to satisfy the more stringent requirements of HIPAA. Therefore, the state statute has been preempted by the federal law. “The Supremacy Clause of the United States Constitution dictates that federal law preempts inconsistent state law. [Cit.]” Poloney v. Tambrands, 260 Ga. 850 (1) (412 SE2d 526) (1991).
2. In addition to the statute’s failure to provide for notice of the right of revocation, the Court of Appeals in Northlake Medical Center v. Queen, supra at 513 (2), found “that the authorization set forth in [13]*13OCGA § 9-11-9.2 is contrary to HIPAAbecause it does not satisfy the requirements for a valid HIPAA authorization [in several other respects]. [Cit.]” We agree with the holding in that opinion that the failure to require a specific and meaningful identification of the information to be disclosed and the failure to provide for an expiration date or a sufficient expiration event are additional bases which support the conclusion “that OCGA § 9-11-9.2 is contrary to HIPAA and none of the exceptions ... applies, [so] it is preempted by HIPAA. [Cit.]” Northlake Medical Center v. Queen, supra at 514 (2).
3. The dissent cites Buice u. Dixon, 223 Ga. 645 (157 SE2d 481) (1967) in support of the position that OCGA § 9-11-9.2, as presently written, can be construed in harmony with HIPAA. However, OCGA § 9-11-9.2 does not simply provide that the plaintiff in a medical malpractice action must file a medical authorization form, and then leave for necessary implication the incorporation into that form of all HIPAA requirements. Compare Buice v. Dixon, supra (requirement for notice and hearing implied where statute otherwise failed to contain express provision therefor). Instead, in both subsections (b) and (c), the statute sets forth the specified statements and information that the authorization “shall provide,” and there is no dispute that several of the HIPAA requirements are not included in that list of enumerated elements. Thus, the question is whether the courts are authorized to construe OCGA § 9-11-9.2 as mandating that the medical authorization form include those missing HIPAA requirements in addition to those which were specified by the General Assembly.
On pp. 16-17, the dissent states:
[T]he mere absence of a requirement in OCGA § 9-11-9.2 that the authorization contain a statement of the right to revoke, for example, does not render the statute inconsistent with HIPAA, as an authorization could be drafted that includes both the elements required under the state law and also a statement explaining the plaintiffs right to revoke. Likewise, the failure of the state law to require a “specific and meaningful description” of the information to be released does not preclude the inclusion of such description as required by HIPAA, and the failure to require an explicit expiration date or event does not preclude the inclusion of such.
However, this observation fails to take into account that “Georgia law provides that the express mention of one thing in an Act or statute implies the exclusion of all other things. [Cit.]” Abdulkadir v. State, 279 Ga. 122, 123 (2) (610 SE2d 50) (2005).
[14]*14Pursuant to the principle of statutory construction, “Exprés - sum facit cessare taciturn” (if some things are expressly mentioned, the inference is stronger that those omitted were intended to be excluded) and its companion, the venerable principle, “Expressio unius est exclusio alterius” (“The express mention of one thing implies the exclusion of another”), the list of actions in [a statute] is presumed to exclude actions not specifically listed ([cit.]), and the omission of [additional actions] from [the statute] is regarded by the courts as deliberate. [Cits.]
Alexander Properties Group v. Doe, 280 Ga. 306, 309 (1) (626 SE2d 497) (2006).
The dissent is correct that the established rules of statutory construction require the courts to interpret a statute as valid whenever possible. Banks v. Ga. Power Co., 267 Ga. 602, 603 (481 SE2d 200) (1997); State of Ga. v. Davis, 246 Ga. 761 (1) (272 SE2d 721) (1980). However, where, as here, the General Assembly expressly designated what the plaintiffs medical authorization form “shall provide,” the principle of “expressio unius est exclusio alterius” makes it impossible for the courts to rewrite OCGA § 9-11-9.2 so as to incorporate the missing HIPAA requirements. State v. Fielden, supra; Alexander Properties Group v. Doe, supra. Compare Buice v. Dixon, supra. Otherwise, under the guise of statutory construction, the judiciary would be free to incorporate into state statutes the provisions of any federal statute that it did not deem to be inconsistent. As OCGA § 9-11-9.2 is presently worded, it is possible to satisfy its provisions while failing to comply with the more stringent requirements of HIPAA. State law may provide for more stringent requirements on the disclosure of protected health information than HIPAA does, hut cannot authorize disclosure based upon less stringent requirements than those mandated by the federal law. Law v. Zuckerman, supra. If the state statute is to be amended or rewritten so as not to be preempted by the federal enactment, that is the responsibility of the General Assembly and not the courts.
Judgment affirmed.
All the Justices concur, except Hunstein, P. J., who concurs in part and dissents in part.