Opis Management Resources, LLC v. Secretary, Florida Agency for Health Care Administration

713 F.3d 1291, 2013 WL 1405035, 2013 U.S. App. LEXIS 7194

• Court: Court of Appeals for the Eleventh Circuit
• Decided: April 9, 2013
• Docket: 12-12593
• Status: Published

Opinion

BLACK, Circuit Judge:

The issue before us is whether § 400.145 of the Florida Statutes — which provides for the release of medical records of deceased residents of nursing homes to certain specified individuals — is preempted by the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d to d-9, and its implementing regulations. As it stands, § 400.145 and HIPAA cannot be reconciled, and we agree with the district court that the Florida statute stands as an obstacle to the accomplishment and execution of the full purposes and objectives of HI-PAA in keeping an individual’s protected health information strictly confidential. Accordingly, we affirm.

I. BACKGROUND

The underlying facts are not in dispute. Plaintiffs-Appellees OPIS Management Resources, LLC; Ruleme Center, LLC; Gulf Coast Healthcare, LLC; SA-PG-Jacksonville, LLC; SA-PG-Sun City Center, LLC; Cypress Health Group, LLC; and Consulate Health Care, LLC (collectively the Nursing Facilities or the Facilities) are operators and managers of skilled nursing facilities in Florida. In the course of their operations, the Nursing Facilities received requests from spouses and attorneys-in-fact for the medical records of deceased nursing home residents. The Facilities refused to disclose the records because the parties requesting them were not “personal representatives” under the relevant provisions of HIPAA, which regulates the release of protected health information by covered entities. 1 See 45 C.F.R. § 164.502. 2 Consequently, the requesting parties filed complaints with the U.S. Department of Health and Human Services Office for Civil Rights, which concluded the Nursing Facilities’ actions were consistent with HIPAA.

Defendant-Appellant Florida Agency for Health Care Administration (the State Agency), however, issued citations to the Nursing Facilities for violating Florida law by refusing to release the records. Specifically, the Facilities were cited for violating § 400.145 of the Florida Statutes, which requires licensed nursing homes to release a former resident’s medical records to the spouse, guardian, surrogate, or attorney-in-fact of any such resident. See Fla. Stat. § 400.145(1). In written correspondence to individuals who had requested and been denied deceased residents’ medical records, the State Agency explained that it interprets § 400.145 in a manner allowing a spouse tq qualify as a personal representative such that a deceased spouse’s medical records may be disclosed under HI-PAA.

Given the dueling interpretations of the relevant statutes, the Nursing Facilities filed a complaint in the district court seeking a declaratory judgment that § 400.145 is preempted by HIPAA. 3 The parties then filed cross-motions for summary judgment. In ruling on the motions, the district court found that § 400.145 was preempted because it impeded the accomplishment and execution of HIPAA’s purposes and objectives. The court granted the Nursing Facilities’ motion for summary judgment, explaining that the Florida statute affords nursing home residents less protection than is required by the federal law. This appeal followed.

II. STANDARD OF REVIEW

We review the district court’s grant of summary judgment de novo, viewing the evidence and drawing all reasonable inferences in the light most favorable to the nonmoving party. Fresenius Med. Care Holdings, Inc. v. Tucker, 704 F.3d 935, 939 (11th Cir.2013).

III. DISCUSSION

The State Agency contends the district court erred in granting summary judgment to the Nursing Facilities because § 400.145 does not impede the goals and purposes of HIPAA. Instead, laws such as § 400.145 play a vital role in the federal statute’s requirements, which look to state law to define the category of “personal representatives” to whom a deceased individual’s protected health information may be disclosed.

We begin our analysis with the bedrock principle that the Constitution designates the laws of the United States as the supreme law of the land, requiring that “all conflicting state provisions be without effect.” Maryland v. Louisiana, 451 U.S. 725, 746, 101 S.Ct. 2114, 2128-29, 68 L.Ed.2d 576 (1981); see also U.S. Const, art. VI, cl. 2. Accordingly, where state and federal law directly conflict, “state law must give way.” PLIVA, Inc. v. Mensing, - U.S. -, 131 S.Ct. 2567, 2577, 180 L.Ed.2d 580 (2011). In addition, “[tjhere is no doubt that Congress may withdraw specified powers from the States by enacting a statute containing an express preemption provision.” Arizona v. United States, — U.S. -, 132 S.Ct. 2492, 2500-01, 183 L.Ed.2d 351 (2012). As the Supreme Court has explained, “[w]hen a federal law contains an express preemption clause, we focus on the plain wording of the clause,” as the plain language of the text is “the best evidence of Congress’ preemptive intent.” Chamber of Commerce of U.S. v. Whiting, — U.S. -, 131 S.Ct. 1968, 1977, 179 L.Ed.2d 1031 (2011) (internal quotation omitted). Nevertheless, “when the text of a pre-emption clause is susceptible of more than one plausible reading, courts ordinarily accept the reading that disfavors pre-emption.” Altria Grp., Inc. v. Good, 555 U.S. 70, 77, 129 S.Ct. 538, 543, 172 L.Ed.2d 398 (2008) (internal quotation omitted).

In drafting HIPAA, Congress included an express preemption provision. 42 U.S.C. § 1320d-7. HIPAA’s preemption clause provides that the statute “shall supersede any contrary provision of State law,” and lists certain exceptions that are not at issue here. Id. § 1320d-7(a). A state law is “contrary” to HIPAA if:

(1) A covered entity or business associate would find it impossible to comply with both the State and Federal requirements; or

(2) The provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of ... section 264 of Public Law 104-191 ....

45 C.F.R. § 160.202. HIPAA, however, does not preempt state laws that provide “more stringent” privacy protections. See id. § 160.203(b).

One of Congress’s objectives in enacting HIPAA was to address concerns about the confidentiality of patients’ individually identifiable health information. See Health Insurance Portability and Accountability Act of 1996, Pub.L. No. 104-191, § 264, 110 Stat. 1936; see also S.C. Med. Ass’n v. Thompson, 327 F.3d 346, 348, 354 (4th Cir.2003) (“Recognizing the importance of protecting the privacy of health information in the midst of the rapid evolution of health information systems, Congress passed HIPAA in August 1996.”). To that end, Congress provided for the Secretary of Health and Human Services to promulgate privacy regulations addressing individuals’ rights to individually identifiable health information, procedures for exercising such rights, and the uses and disclosures of such information. Pub.L. No. 104-191, § 264(b) & (c)(1); S.C. Med. Ass’n, 327 F.3d at 349. In compliance with the statute, the Department of Health and Human Services issued final regulations known as the “Privacy Rule.” S.C. Med. Ass’n, 327 F.3d at 349; see also Citizens for Health v. Leavitt, 428 F.3d 167, 172-74 (3d Cir.2005) (detailing the history of the Privacy Rule’s promulgation and explaining its requirements). The Privacy Rule establishes that “[a] covered entity or business associate may not use or disclose protected health information,” except in certain circumstances not at issue here, or with valid authorization. 45 C.F.R. §§ 164.502(a), 164.508(a)(1). Among the disclosures permitted by the Privacy Rule are disclosures to the individual whose information is being protected, as well as disclosures to the individual’s personal representative. Id. § 164.502(a)(1)®, (g)(1) (“[A] covered entity must ... treat a personal representative as the individual for purposes of this subehapter.”).

As of March 26, 2013, “[a] covered entity must comply with the requirements of [the Privacy Rule] with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.” Id. § 164.502(f). 4 Regarding deceased individuals, the Privacy Rule further specifies that:

If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual’s estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.

Id. § 164.502(g)(4). 5 Aso as of March 26, 2013, if an individual is deceased,

a covered entity may disclose to a family member, or [other relatives, close personal friends of the individual, or any other persons identified by the individual] who were involved in the individual’s care or payment for health care prior to the individual’s death, protected health information of the individual that is relevant to such person’s involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

Id. § 164.510(b)(5).

Since 1987 — nearly a decade before Congress enacted HIPAA — Florida law has required licensed nursing homes to disclose deceased residents’ medical records to certain individuals who request them. See Fla. Stat. § 400.145; see also 1987 Fla. Sess. Law Serv. 87-302. Specifically, § 400.145 provides that:

Unless expressly prohibited by a legally competent resident, any nursing home licensed pursuant to this part shall furnish to- the spouse, guardian, surrogate, proxy, or attorney in fact ... of a current resident, ... or of a former resident, ... a copy of that resident’s records which are in the possession of the facility. Such records shall include medical and psychiatric records and any records concerning the care and treatment of the resident performed by the facility, except progress notes and consultation report sections of a psychiatric nature. Copies of such records shall, not be considered part of a deceased resident’s estate and may be made available prior to the administration of an estate, upon request, to the spouse, guardian, surrogate, proxy, or attorney in fact ....

Fla. Stat. § 400.145(1).

The State Agency’s argument against preemption hinges on the Privacy Rule’s mandate that any person who has authority to act on behalf of a deceased individual under state law be treated as a personal representative. See 45 C.F.R. § 164.502(g)(4). This is important because an individual’s personal representative enjoys the same broad access to protected information and freedom from the Privacy Rule’s strictures as the individual. See 45 C.F.R. § 164.502(g)(1). According to the State Agency, § 400.145 enumerates groups of people, including spouses, who may access a deceased resident’s medical records “on behalf of’ the resident, meaning that they should be treated as personal representatives. Thus, rather than conflicting with HIPAA and the Privacy Rule, § 400.145 supplements and works in tandem with the federal law.

The fatal flaw in the State Agency’s argument is that the plain language of § 400.145 does not empower or require an individual to act on behalf of a deceased resident. The unadorned text of the state statute authorizes sweeping disclosures, making a deceased resident’s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident’s stead. See 45 C.F.R. § 164.502(g)(4) (providing that a person authorized to act on behalf of a deceased individual must be treated as a personal representative “with respect to protected health information relevant to such personal representation ” (emphasis added)). We therefore agree with the district court that § 400.145 frustrates the federal objective of limiting disclosures of protected health information, and that the statute is thus preempted by the more stringent privacy protections of HIPAA and the Privacy Rule.

The State Agency’s contention that 45 C.F.R. § 164.510(b)(5) saves § 400.145 suffers from the same problem. While § 164.510(b)(5) authorizes covered entities to release a deceased individual’s protected health information to family members or other individuals, the regulation does not open a broad new avenue of access to protected health information, as the State Agency contends. Instead, § 164.510(b)(5) permits covered entities to release a deceased individual’s protected health information in narrowly delineated circumstances. First, the regulation applies only to two groups of people: (1) those involved in the deceased individual’s health care, and (2) those who paid for the deceased individual’s health care. Second, covered entities may release only protected health information that is relevant to such person’s involvement, i.e., information that is relevant to the care of the deceased individual or to the payment of the deceased individual’s health care. Section 400.145, by comparison, contains no such limitations or restrictions.

The State Agency’s reliance on Alvista Healthcare Center, Inc. v. Miller, 286 Ga. 122, 686 S.E.2d 96 (2009), is also unavailing. In Alvista, the widow of a deceased nursing home resident requested copies of her late husband’s medical records to investigate a potential action for wrongful death. Id. at 97. After the requests were denied, the widow sued the operator of the nursing home. Id. The Georgia Supreme Court held that a provision of state law, O.C.G.A. § 31-33-2, authorized a surviving spouse “to act on behalf of the decedent or his estate in obtaining medical records and, therefore, that the surviving spouse [was] entitled to access the decedent’s protected health information in accordance with 45 C.F.R. § 164.502(g)(4).” Id.

Central to the Georgia Supreme Court’s resolution of the case was the fact that, in 2006, the Georgia legislature specifically amended § 31-33-2 to comply with HI-PAA. See id. at 98. The legislature addressed HIPAA and the Privacy Rule by requiring any request for medical records by an individual specified in the statute be accompanied by an authorization that comported with HIPAA and its implementing regulations. Id. In addition, the Georgia statute was amended to provide a hierarchy of individuals who could submit an authorization and thus act on behalf of a decedent or his estate, with the first priority given to an administrator or executor, and a surviving spouse receiving authority only in the absence of an administrator or executor. Id. Thus, it was clear that the statute treated a surviving spouse “as a personal representative in lieu of the executor or administrator with respect to requests for medical records.” Id. The Georgia Supreme Court emphasized that the limited personal representation created by § 33-31-2 did not extend to any context other than obtaining a decedent’s medical records, and that the statute was “carefully tailored” to provide the authority contemplated by the Privacy Rule. Id.

Unlike the situation in Alvista, the Florida legislature has not amended or modified § 400.145 to address the impact of HIPAA and its implementing regulations. Section 400.145 does not require a HIPAA-compliant authorization to accompany a request for a deceased individual’s medical records, nor can the statute plausibly be read as creating a limited personal representation in the person of a surviving spouse in light of the blanket disclosures that it requires. Given the opportunity, we are confident the Florida legislature could bring § 400.145 into compliance with federal law in any number of ways. Amending the statute, however, is a task for the state legislature, not a panel of federal judges.

Finally, we emphasize that we have no occasion to address the State Agency’s argument that it is possible to comply with both HIPAA and § 400.145 because 45 C.F.R. § 164.512(a)(1) permits a covered entity to use and disclose protected health information as “required by law.” 6 The State Agency did not advance this argument before the district court, and we decline to consider it for the first time on appeal. See, e.g., Access Now, Inc. v. Sw. Airlines, Co., 385 F.3d 1324, 1331 (11th Cir.2004) (“This Court has repeatedly held that an issue not raised in the district court and raised for the first time in an appeal will not be considered by this [C]ourt.” (quotations omitted)). 7 Thus, nothing that we have said should be inferred as expressing an opinion regarding the “required by law” provision.

IV. CONCLUSION

For the foregoing reasons, we agree with the district court that § 400.145 of the Florida Statutes impedes the accomplishment and execution of the full purposes and objectives of HIPAA and the Privacy Rule in keeping an individual’s protected health information confidential. Accordingly, the district court’s grant of summary judgment is AFFIRMED.

1 . The parties do not dispute that the Nursing Facilities are covered entities.

2 . We note that various amendments to the Code of Federal Regulations relating to HI-PAA became effective March 26, 2013, while this appeal was pending. The amendments, however, are largely immaterial to the issue before us, except for the addition of 45 C.F.R. § 164.510(b), which we discuss in further detail below.

3 .In Claim Two, the Nursing Facilities also sought injunctive relief. The Facilities, however, successfully moved to dismiss the claim following the district court’s grant of partial summary judgment, and that claim is not before us on appeal.

4 . Prior to March 26, 2013, § 164.502(f) did not contain any time limitation with respect to the disclosure of a deceased individual’s protected health information.

5 . We read “applicable law” to mean state law.

6 . Section 164.512(a)(1) provides that "[a] covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.”

7 . Although the State Agency cited § 164.512 in its motion for summary judgment, it did so in support of its argument that § 400.145 is more stringent than the Privacy Rule. The State Agency did not raise the argument it presents on appeal, i.e., that § 164.512 provides a separate, independent means of harmonizing federal and state law. Accordingly, the specific argument advanced on appeal was not sufficiently raised before the district court and we will not address it. See Bryant v. Jones, 575 F.3d 1281, 1308 (11th Cir.2009) ("It is well established in this circuit that, absent extraordinary circumstances, legal theories and arguments not raised squarely be fore the district court cannot be broached for the first time on appeal.”).