Suffolk Journal of Trial and Appellate Advocacy Suffolk Journal of Trial and Appellate Advocacy
Volume 12 Issue 1 Article 11
1-1-2007
State of Confusion: The HIPPA Privacy Rule and State Physician-State of Confusion: The HIPPA Privacy Rule and State Physician-
Patient Privilege Laws in Federal Question Cases Patient Privilege Laws in Federal Question Cases
Jenna Phipps
Suffolk University Law School
Follow this and additional works at: https://dc.suffolk.edu/jtaa-suffolk
Part of the Litigation Commons
Recommended Citation Recommended Citation
12 Suffolk J. Trial & App. Advoc. 159 (2007)
This Notes is brought to you for free and open access by Digital Collections @ Suffolk. It has been accepted for
inclusion in Suffolk Journal of Trial and Appellate Advocacy by an authorized editor of Digital Collections @ Suffolk.
For more information, please contact [email protected].
STATE OF
CONFUSION:
THE
HIPAA
PRIVACY
RULE
AND
STATE
PHYSICIAN-PATIENT
PRIVILEGE
LAWS
IN
FEDERAL
QUESTION
CASES
I.
INTRODUCTION
People expect that when
they
visit
a
doctor
the
information
that
is
revealed
in
the
visit
and
recorded
in
their
medical
records will
be
kept
from
the
eyes
of
others.
This may
be
a
reasonable
expectation
in
most
situations, but not necessarily
if
the medical
records
are
sought
for
use
in
court.
No
federal
physician-patient
privilege
exists,
and the
existence
and
scope
of
such
a
privilege
varies
across
states.'
The
passage
of
the Health
Insurance
Portability
and
Accountability
Act
(HIPAA)
has led
to
confu-
sion
over
the
appropriate effect
of
state
privileges
in
federal
question
cases.
2
HIPAA
required
the
Department
of
Health
and
Human
Services
(HHS)
to
promulgate
rules
relating
to
privacy
of
protected health informa-
tion.
3
The
resulting
set
of
regulations, known
as
the
HIPAA Privacy
Rule,
contains
a
section
discussing
the
use
of
protected
health information,
such
as
medical
records,
in
judicial
proceedings.
a
Federal
courts
generally
use
federal
evidentiary
rules where
federal
law
supplies
the
rule
of
decision.
5
1
See
generally
Kenneth
S.
Broun,
The
Medical
Privilege
in
the
Federal
Courts-
Should
it
Matter
Whether
Your
Ego
or
Your
Elbow
Hurts?,
38
LoY.
L.A.
L.
REV.
657
(2004)
(arguing
for
a
federal
physician-patient privilege
to
expand on
psychotherapist-
patient
privilege).
2
Health
Insurance
Portability
and
Accountability
Act
of
1996,
Pub.
L.
No.
104-191,
110
Stat.
1936
(codified
at
scattered
sections
of
18
U.S.C.,
26
U.S.C.,
29
U.S.C.,
and
42
U.S.C.
(2000));
see
also
Grace
Ko,
Note,
Partial
Preemption
Under
the
Health
Insurance
Portability
and
Accountability
Act,
79
S.
CAL.
L.
REV.
497, 527-28
(2006) (arguing that
Congress should clarify
its
intent
as to
this issue).
3
42
U.S.C.
§
1320d-2
note
(2000).
4
45
C.F.R.
§
164.512(e)
(2005).
5
FED.
R.
EVID.
501;
see
also
In
re
Sealed
Case
(Medical
Records),
381
F.3d
1205,
160
JOURNAL
OF
TRIAL
&
APPELLATE
ADVOCACY
[Vol.
XII
Additionally,
federal laws
typically
preempt
contrary
state
laws.
6
HIPAA,
however,
contains
a
preemption
clause
stating
that
it
will
not
"supercede
[sic] a
contrary
provision
of
State
law,
if
the
provision
of
State
law
im-
poses requirements,
standards,
or implementation
specifications that
are
more
stringent
than the
requirements,
standards,
or implementation
speci-
fications imposed
under
the
regulation."
7
Courts
have differed
in
their
interpretation
of
HIPAA's
preemption
clause
in
cases
whose subject
matter
jurisdiction
is
based
on
a
federal
question.
8
Some
courts
have
held
that HIPAA
should always control
in
federal
question
cases.
9
Conversely,
others
have
held
that
state
privilege
laws
should
apply
if
they
are
more
stringent.10
Still
others
have
found
mid-
dle
ground,
analyzing whether
the
particular
state
privilege
law
in
question
is
more
stringent
than
HIPAA
without
generalizing
as
to
HIPAA's
effect
in
all
federal
question
cases.
1
'
This
Note will
argue
that
HIPAA
should
control
in
federal
question
cases,
regardless
of
whether
state
privilege
laws
are
more
stringent.
Future courts should
acknowledge
that
Congress
did
not
intend for HIPAA
to
incorporate
state
privileges.
Courts should
not
compare
the
stringency
of
state
privilege
laws
with
HIPAA
in
federal
question
cases
because
this
confuses
the
proper
analysis
and
could
lead
to
inappropriate
control
by
state
privilege
laws
in
these
cases.
Part
II
will
provide
an
overview
of
relevant
sections
of
HIPAA,
along
with Congress
and
HHS's
intent. This
section will
also
review
the
general
doctrine
of
evidentiary privileges, various
physician-patient
and
medical records privileges
in
states,
and
the
theory
of
preemption.
Part
III
will discuss various
approaches taken by courts
regarding
the interpreta-
tion
of
HIPAA's
preemption
provision
and
the
consequences that
this
has
on
which
privilege
law
will
apply
in
federal
question
cases.
Part
IV
will
analyze these approaches,
and
argue
that
HIPAA
should
preempt
state
privilege
laws
in
federal
question
cases,
regardless
of
the
stringency
of
state law.
1212
(D.C.
Cir.
2004)
(recognizing preference
for
applying
federal
privilege
law
in
cases
with both
federal and state
claims).
6
See
infra
notes 36-39 and
accompanying
text.
7
HIPAA
§
264(c)(2),
Pub.
L.
No.
104-191,
110
Stat.
2033-34. Courts
and
commenta-
tors have
also
referred
to this
as
an
anti-preemption
clause, or
as
a
supersession provision.
See,
e.g.,
Nat'l
Abortion
Fed'n
v.
Ashcroft
(NAF
New
York),
No.
1:03-CV-08695, 2004
WL
555701,
at
*3
(S.D.N.Y.
Mar.
19,
2004)
(anti-preemption provision).
8
See
infra
Section
III
(for
courts' differing interpretations).
The
United
States Consti-
tution
gives
federal
courts
power
to
hear
cases
arising
under
federal
law.
U.S.
CONST.
art.
III,
§
2.
Congress then extended
"federal
question"
jurisdiction
to
federal
district
courts.
28
U.S.C.
§
1331
(2000).
9
See
infra
notes
57-71
and
accompanying text.
10
See
infra
notes 72-80
and accompanying text.
1
See
infra
notes
81-90
and
accompanying
text.
HIPAA
IN
FEDERAL
QUESTION
CASES
II.
HIPAA,
PRIVILEGES, PREEMPTION,
AND
CONGRESSIONAL
INTENT
A.
Overview
of
HIPAA
and
the
Privacy
Rule
Congress enacted HIPAA
on
August
21,
1996.12
The
purposes
of
HIPAA were
to
ensure more
consistent
health
insurance coverage,
reduce
insurance
fraud, and
increase
efficiency
in
insurance
administration.
13
Many
provisions, particularly
those
in
the
Administrative
Simplification
section,
would
implicate
privacy
issues
because
they
would
result
in in-
creased sharing
of
individuals' health
information.
14
Congress
therefore
directed
the Secretary
of
HHS
to
provide
them
with
recommendations
re-
garding
appropriate
standards
to
protect
individuals'
information
privacy.15
If
Congress failed
to
enact
legislation encompassing
the
recommended
standards,
then
HHS
was
to
issue
regulations
regarding privacy
of
pro-
tected health
information.'
6
The
task
fell
to
HHS
when
Congress
did
not
enact such
legislation.
In
2002, HHS
promulgated
the
regulations
known
as
the HIPAA
Privacy
Rule,
which
detail
the
measures that
must
be
taken
to
properly
handle
protected health information.
7
Protected health
information
(PHI)
is
individually identifiable
health
information, meaning
someone
could
potentially
identify
the
individual
by
examining
the
health
and
demo-
graphic
information
contained
in
the
PHI.'
8
All
health
plans,
health care
clearinghouses,
and
health
care
providers
who
transmit
health
information
electronically
are
considered
covered
entities
and
must
abide
by the
regu-
lations.'
9
One
section
of
the
Privacy
Rule
pertains
to
the use
of
protected
health information
in
judicial
and
administrative proceedings, allowing
disclosure
of
such
information after certain detailed procedures
are
fol-
2
HIPAA,
Pub.
L.
No.
104-191,
110
Stat.
1936
(codified
at
scattered sections
of
18
U.S.C.,
26
U.S.C.,
29
U.S.C.,
and
42
U.S.C.
(2000)).
"3
HIPAA,
Pub.
L.
No.
104-191,
110
Stat.
1936,
preface.
14
See
42
U.S.C.
§§
1320d
-
1320d-8
(2000)
(Administrative
Simplification
Sections);
see
also
Ralph
Ruebner
&
Leslie Ann
Reis,
Hippocrates
to
HIPAA:
A
Foundation
for
a
Federal
Physician-Patient
Privilege,
77
TEMP.
L.
REV.
505,
521-23
(2004)
(reviewing
way's
in
which increased
use
of
electronic medical records
threatens
patient privacy).
HIPAA,
§
264(c)(1).
16
HIPAA,
§
264(c)(1),
codified
at
42
U.S.C.
§
1320d-2
note
(requiring
Secretary to
issue
regulations).
"
45
C.F.R.
§§
160, 164
(2005). Covered health
care
providers
were
required
to
com-
ply
with
the
regulations
by April
14,
2003.
45
C.F.R.
§
164.534 (2005).
's
45
C.F.R.
§
160.103
(2005).
9
45
C.F.R.
§
160.102
(2005).
2007]
162
JOURNAL
OF
TRIAL
&
APPELLATE
ADVOCACY
[Vol.
XII
lowed.
z
If
the
presiding
court issues
a
subpoena, the covered
entity
may
disclose medical
records
without
providing
notice
to
the
patient.
21
If
the
subpoena
or
discovery request
is
not court-ordered,
the
covered
entity
may
disclose
the
records after
either providing
notice
to
the
affected individual
or obtaining
a
qualified protective
order.
22
B.
Privileges
A
privilege
gives
a
witness
the
right
to
withhold
certain information
from
a
judicial
proceeding.
23
Privileges
are
exceptions
to
the
maxim
that
"the
public
...
has
a
right
to
every
man's
evidence."
24
The
policy
underly-
ing
privileges
is
to
encourage
the
free
flow
of
information
in
certain
rela-
tionships
in
which
society
highly
values
privacy.
Many states
provide
for
such
a
privilege between
patient
and
physician, usually
via
statute.
26
These
statutes
vary
in
scope
but generally protect against requiring
admission
of
medical
records
into
evidence.
27
20
45
C.F.R.
§
164.512(e) (2005).
21
45
C.F.R.
§
164.512(e)(1)(i)
(2005).
This Note
uses the
phrase "medical records"
interchangeably
with
PHI
because this
is
the
more common term,
but
technically
PHI
can
also
include
information
such
as
records
of
payment
for
health care.
See
45
C.F.R.
§
160.103
(2005).
22
45
C.F.R.
§
164.512(e)(1)(vi)
(2005).
The
covered
entity
may
also
disclose
the
in-
formation
if
the
party seeking
the
records provides satisfactory assurance
of
reasonable
efforts
to
either provide
notice or obtain
a
qualified protective order.
45
C.F.R.
§
164.512(e)(1)(ii)
(2005).
The
standards
for
adequate
notice
and for
a
qualified protective
order
are
found
at
45
C.F.R.
§§
164.512(e)(1)(iii)-(v)
(2005).
23
See
Jaffee
v.
Redmond,
518
U.S.
1,
9
(1996)
(establishing
federal
psychotherapist-
patient
privilege);
see
also
Trammel
v.
United
States,
445 U.S.
40
(1980)
(tracing
history
of
marital
privilege
allowing
each
spouse
to
prevent
adverse testimony from
the
other).
24
Trammel,
445
U.S.
at
50
(quoting
United
States
v.
Bryan,
339
U.S.
323,
331
(1950))
(narrowing
privilege against
spousal
testimony).
The
Court
reasoned
that
privileges
should
be
construed narrowly
to
protect
the
policy
of
admitting probative
evidence.
Id.
25
See
Ruebner
&
Reis,
supra
note
14,
at
532-40
(reviewing
the
Jaffee
court's
reason-
ing
,
Ruebner
&
Reis,
supra
note
14,
at
563-64.
27
See,
e.g.,
HAW.
REv.
STAT.
ANN.
§
504
(LexisNexis 2006);
MICH.
COMP.
LAWS
ANN.
§
600.2157 (West
2006);
see
also
Ruebner
&
Reis,
supra
note
14,
at
564-65
(surveying
similar
state
statutes).
The Hawaii
privilege provides:
A
patient
has
a
privilege
to
refuse
to
disclose
and
to
prevent
any
other
person
from
disclosing
confidential communications
made
for
the
purpose
of
diagnosis
or
treatment
of
the
patient's
physical,
mental,
or
emotional
condition, including
alcohol
or
drug
addiction,
among
oneself,
the
pa-
tient's
physician,
and
persons
who
are
participating
in
the
diagnosis
or
treatment
under
the
direction
of
the
physician,
including
members
of
the
patient's
family.
HAW.
REV.
STAT.
ANN.
§
504
(LexisNexis
2006). The
Michigan statute
is
drafted
more
narrowly:
HIPAA
IN
FEDERAL
QUESTION
CASES
Federal
Rule
of
Evidence
501
governs
privileges
in
federal
courts.
2
'
As
a
result
of
this
rule,
federal
privileges
control
in
federal
courts
unless
state law
provides
the
rule
of
decision-in
which
case,
state
privi-
leges
apply.
2
9
The rule
reflects
the
theory
that
where
a
particular
state's
law
provides
the
rule
of
decision
in
a
case,
that
state has
an
interest
in
the
privilege policies
that
the court applies.
30
If
federal
law
applies,
Rule
501
dictates the
procedure
to
determine
which privileges,
if
any,
pertain
to
the
case.
First,
the
court
determines
whether
an
Act
of
Congress
has
created
a
privilege;
if
not,
the
court then
assesses
whether
federal
courts
have
developed
a
common-law privilege
"in
the
light
of
reason
and
experience."
3
'
While
federal
courts
currently
recognize
a
psychologist-patient
privilege,
no
such federal
privilege exists
to
protect
the
physician-patient
relationship
or
the
resulting
medical
re-
cords.
32
HIPAA
fits
into
this framework
in
a
rather
complex
way.
Some
commentators
argue
that
HIPAA
was,
in
fact,
an
"Act
of
Congress"
that
created
a
physician-patient privilege.
33
Others contend that
while
HIPAA
did
not
create
a
federal
statutory
privilege,
federal
courts
should now
rec-
Except
as
otherwise
provided
by law,
a
person
duly
authorized
to
practice
medicine
or
surgery
shall not
disclose
any
information
that
the
person
has
acquired
in
attending
a
patient
in
a
professional
character,
if
the
informa-
tion
was
necessary
to
enable the
person
to
prescribe
for
the
patient
as
a
physician,
or
to
do any
act
for
the
patient
as
a
surgeon.
MICH.
COMP.
LAws
ANN.
§
600.2157 (West
2006)
28
FED.
R.
EvID.
501.
The
text
of
the
Rule
is
as
follows:
Except
as
otherwise required
by
the
Constitution
of
the
United States
or
provided
by
Act
of
Congress
or
in
rules
prescribed
by
the
Supreme
Court
pursuant
to
statutory
authority,
the
privilege
of
a
witness, person,
gov-
ernment,
State,
or
political
subdivision
thereof
shall be
governed
by
the
principles
of
the
common
law
as
they
may
be
interpreted
by
the
courts
of
the
United
States
in
the
light
of
reason
and
experience.
However,
in
civil
actions
and
proceedings,
with respect
to
an
element
of
a
claim
or
defense
as
to
which
State
law
supplies
the rule
of
decision,
the
privilege
of
a
wit-
ness,
person,
government,
State, or
political subdivision
thereof
shall
be
determined
in
accordance
with
State
law.
FED.
R.
EvID.
501.
29
See
id.;
see
also
In
re
Sealed
Case
(Medical
Records),
381
F.3d
1205,
1212
(D.C.
Cir.
2004)
(leaving
issue
unresolved
in
cases
containing both
federal and state
claims).
30
FED.
R.
EvID.
501
advisory
committee's
note.
31
See
FED.
R.
EViD.
501.
32
See
Jaffee
v.
Redmond,
518
U.S.
1,
9
(1996)
(establishing
psychotherapist-patient
privilege);
Northwestern
Mem'l
Hosp.
v.
Ashcroft,
362
F.3d
923,
926
(7
th
Cir.
2004)
(ex-
plaining
that
federal
common-law privileges
do not extend
to
medical
records).
33
See
Ruebner
&
Reis,
supra
note
14,
at
532-40
(arguing
that
HHS
responded
to
Con-
gress'
broad grant
of
authority
by creating
a
physician-patient
privilege).
2007]
164
JOURNAL
OF
TRIAL
&
APPELLATE
ADVOCACY
[Vol.
XII
ognize
a
common-law
privilege.
34
Finally,
some
commentators
propose
that
the
most
efficient
solution
would
be
for Congress
to
revise
HIPAA
so
that
it
would completely preempt
the
area
of
medical
information
privacy,
preventing
states
from
creating
physician-patient
privileges.
3
5
C.
Preemption
and
its
Relation
to
HIPAA
The
Supremacy
Clause
of
Article
VI
of
the
United
States
Constitu-
tion
commands
that
the
Constitution
and
federal laws
enacted
pursuant
to
its
authority
"shall
be
the
supreme
Law
of
the Land.,
36
The doctrine
of
preemption
originating
in
this
clause
establishes that
federal
law
trumps
state law
in
particular
areas
if
Congress
so
intends-expressly
or
impli-
edly-or
if
state
law
conflicts with
federal
law.
37
Express
and
conflict
pre-
emption
are
the types
most
pertinent
to
this discussion.
Express preemp-
tion
occurs
when
Congress enacts
a
statute
explicitly
stating
that
it
will
preempt
state law
in
the
relevant
field.
38
Conflict
preemption
exists
in sce-
narios
in
which
one
cannot
simultaneously comply with both
state
and
federal
law
because
they
are in
conflict.
39
In
enacting
HIPAA, Congress
expressly preempted
some
state
laws
relating
to
medical
record-keeping.
40
As
mentioned
earlier, however,
Congress saved
from
preemption conflict-
ing
state laws
if
they
provide
more
stringent
protections
for
health infor-
34
See
Broun,
supra
note
1,
at
659
(proposing
that
physician-patient
privilege
should
be
narrow
in
scope and
modeled after existing psychotherapist-patient
privilege); Ruebner
&
Reis,
supra
note
14,
at
540-74
(contending
that
even
if
HIPAA
did not
create new privi-
lege,
it
provides foundation
for
common-law privilege
through "reason
and
experience");
Molly
Silfeti,
Note
and Comment,
I
Want My
Information
Back:
Evidentiary
Privilege
Following
the
Partial
Birth
Abortion Cases,
38
J.
HEALTH
L.
121,
132-34
(2005)
(arguing
that
courts
should
create
federal
physician-patient
privilege
that
is
"somewhat weaker"
than
the
psychiatrist-patient
privilege).
Professor
Broun
also
provides
a
useful
survey
of
legal
scholars' arguments
for
and
against
such
a
privilege.
See
Broun,
supra
note
1,
at
683-91.
35
Jennifer
Guthrie,
Time
is
Running
Out
--
The
Burdens
and
Challenges
of
HIPAA
Compliance:
A
Look
at
Preemption
Analysis,
The
"Minimum
Necessary"
Standard,
and
the
Notice
of
Privacy
Practices,
12
ANNALS
HEALTH
L.
143,
156-57
(2003)
(proposing
a
"federal
ceiling" instead
of
a
federal
floor
of
regulations);
see
generally
Rebecca
H.
Bishop, Note,
The
Final
Patient
Privacy
Regulations Under
the
Health
Insurance
Portabil-
ity
and
Accountability
Act --
Promoting
Patient
Privacy
or
Public
Confusion?,
37
GA.
L.
REv.
723
(2003).
36
U.S.
CONST.
art.
VI,
cl.
2.
37
Schneidewind
v.
ANR
Pipeline
Co.,
485
U.S.
293,
299-300
(1988).
38
Id.
at
299
("Of
course,
Congress
explicitly
may
define
the
extent
to
which
its
enact-
ments pre-empt
state
law.").
39
Id.
at
300
("Such
a
conflict
will
be
found
'when
it
is
impossible
to
comply
with
both
state and federal
law,
or where
the state
law
stands
as
an
obstacle
to
the
accomplishment
of
the
full
purposes
and objectives
of
Congress."'
(quoting
Cal.
Coastal
Comm'n
v.
Granite
Rock
Co.,
480
U.S.
572,
581
(1987))).
The
third
type,
implied
preemption,
occurs when
Congress
effectively
occupies
a
field.
Id
4u
42
U.S.C.
§
1320d-7(a)(1)
(2000).
HIPAA
IN
FEDERAL
QUESTION
CASES
mation
privacy.4
HHS
included
similar sections
on
preemption
in
the
Privacy
Rule
regulations, which
state
that
the
regulations
as
a
whole preempt
contrary
state
law.
42
A
notable exception
to
this
general rule
is
the "anti-
preemption"
clause,
providing
that
HIPAA
and
its
regulations
will
not
preempt
a
conflicting
state
provision
that
"relates
to
the
privacy
of
indi-
vidually identifiable health information
and
is
more
stringent
than
a
stan-
dard,
requirement,
or implementation specification adopted
under
[the
privacy provisions]
of
this subchapter.A
3
It
is
this
preemption
provision
that
has
proven
so
troublesome
in
federal
question
cases. Some
commenta-
tors and
courts
believe that
the
anti-preemption
clause
contained
in
HIPAA
gives
state
privileges
that
are
more
stringent
the
force
of
federal
law
in
federal
question
cases.
44
D.
Intent
of
Congress
and
HHS
In
drafting
and
enacting
HIPAA,
Congress
did
not
explicitly
ad-
dress
the issue
of
whether
HIPAA would
give
more
stringent
state
privi-
lege
laws
the
force
of
law
in
federal
question
cases.
Congressional records
reveal,
however,
that
several
legislators expressed
concern during
debate
that
HIPAA
did not
provide
more
substantial
privacy
protections.
45
Repre-
sentative
Jim
McDermott
from
Washington
was
especially
disturbed
that
the
bill required increased
ease
of
transferring
health information
without
mandating
"one
single
shred
of
protection
of
your
privacy.
' '4
6
Other
testi
mony
indicates
that
the
anti-preemption provision
may have
been
included
in
response
to
fears
that HIPAA would
override
state
health
care and
in-
surance
reform
efforts.
47
In
HHS'
recommendations
to Congress
and
in
its
final
regulations,
the
Secretary
of
HHS
expressed
an
urgent
need
for
privacy protections
at
4
42
U.S.C.
§
1320d-7(a)(2)
(2000); HIPAA
§
264(c)(2).
42
45
C.F.R.
§
160.203
(2005).
43
45
C.F.R.
§
160.203(b)
(2005).
This
provision
in
the
regulation
complements
the
similar
statement
in the
statute.
See
supra
note
7
(quoting
relevant
language from
HIPAA).
44
See
Ruebner
&
Reis,
supra
note
14,
at
533-34
(construing
HHS'
commentary
to
support
this position);
see
also
United States
v.
Diabetes Treatment
Ctrs.
of
Am.,
No.
Civ.
99-3298,
2004
WL
2009416,
at
*3-*4
(D.D.C.
May
17,
2004)
(holding
Florida medical
privacy
law
to
be
more
stringent
than
HIPAA).
45
See
142
CoNG.
REC.
S9501-01,
S9516
(1996)
(statement
of
Sen.
Paul
Simon);
142
CONG.
REc.
S9501-01,
S9523
(1996)
(statement
of
Sen.
Patrick Leahy).
46
142
CONG.
REc.
H9785-02
(1996)
(statement
of
Rep.
Jim
McDermott).
47
See
142
CONG.
REC.
H3029-03
(1996)
(statement
of
Rep.
Jim
McDermott);
see
also
Amendment
to
Health
Care
Coverage
Availability
and
Affordability
Act:
Hearing
on H.R.
3103
Before
the
H.
Rules
Comm.
(1996)
(statement
of
Rep.
Elizabeth
Furse);
142
CONG.
REc.
H2972-01
(1996)
(statement
of
Rep.
Gene Green).
2007]
166
JOURNAL
OF
TRIAL
&
APPELLATE
ADVOCACY
[Vol.
XII
the
federal
level.
The
Secretary
explained that
many
factors,
including
the
rising
use
of
electronic medical
records
and the
attendant
ease
of
informa-
tion transfer,
have
increased
the
potential
for
misuse
of
private
health
data.
48
The
Secretary
believed
that
a
federal
floor
of
regulation
in
this
area
would provide
a
minimum
level
of
protection
while
reflecting
HHS'
policy
of
guarding individuals' privacy surrounding
their
medical information.'
9
Although
HHS
recognized
the
importance
of
protecting
medical
privacy,
the
agency
did
not
intend
for
the Privacy
Rule
to
affect existing
evidentiary privileges.
50
The
Secretary
explained that
Congress
and
HHS
had
balanced privacy considerations against competing policies
in
allow-
ing
disclosure for certain purposes,
such
as
for
judicial
proceedings.
51
In
construing
the
interaction
of
the
Privacy
Rule
with
more
protective
state
laws, the
Secretary
emphasized that
such state laws
would
continue
to
ap-
ply
where
they
"operate
in
the
same
area
as
the
federal
standards.
52
III.
FEDERAL
COURTS' VARYING
APPROACHES
The
question
of
whether
state
privilege
laws,
if
more
stringent
than
HIPAA,
should
be
used
in
federal
question
cases
emerged
in
several
courts
in
2004 when
then-Attorney
General
John Ashcroft subpoenaed medical
records
from
various
hospitals
across
the country.
53
This issue arose out
of
a
case
filed
in
New
York
in
which
the
National
Abortion
Federation
and
seven
physicians
challenged
the
constitutionality
of
the
Partial-Birth
Abor-
tion
Ban Act
of
2003
(PBABA).
54
During
discovery the
Attorney
General
48
See
Standards
for
Privacy
of
Individually
Identifiable
Health
Information,
65
Fed.
Re§,
82,462,
82,465 (Dec. 28,
2000)
(preamble,
not
codified
in
C.F.R.).
See
id.
at
82,466
(explaining
that
state
privacy
rules
are
inconsistent
and
that
health
information
transfer
is
becoming
increasingly national);
see
also
id.
at
82,471
(describing
Privacy Rule
as
federal
floor
above which states and
regulated
entities
are
free to
provide
more
privacy protections).
50
See
id.
at
82,596
(refusing
to
incorporate
previously
existing
federal
psychotherapist-
patient privilege
into
regulations).
The Secretary
explicitly
stated
that
creating
any new
privileges would
be
beyond
the
scope
of
the
authority
that
Congress delegated
to HHS.
Id.
51
See
id.
at
82,471
(recognizing
that
information
privacy
is
not absolute
and
must
be
balanced
against
other public expectations).
52
See
id
at
82,583
(emphasis
added)
("state
laws
that
are
more
protective
of
privacy
than
contrary
federal
standards should
remain").
53
See
Nat'l
Abortion
Fed'n
v.
Ashcroft
(NAF
New
York),
No.
1:03-CV-08695,
2004
WL
555701, at
*4
(S.D.N.Y. Mar.
19,
2004)
(enforcing
subpoena
of
medical records
held
by
New York
and
Presbyterian
Hospital); Planned
Parenthood
Fed'n
of
Am.
v.
Ashcrofl,
No.
C03-4872, 2004
WL 432222,
at
*1
(N.D.
Cal.
March
5,
2004)
(denying motion
to
compel
production
of
medical records held
by
Planned Parenthood);
Nat'l
Abortion
Fed'n
v.
Ashcroft
(NAF
Illinois),
No.
1:04-CV-00055,
2004 WL
292079,
at
*1
(N.D.
Ill.
Feb.
6,
2004) (quashing subpoena
of
medical
records held
by
Northwestern
Hospital),
aff'd
sub
nom.
Northwestern
Mem'l
Hosp.
v.
Ashcroft,
362
F.3d
923
(7
h
Cir.
2004).
14
18
U.S.C.
§
1531,
held
unconstitutional
by
Nat'l
Abortion
Fed'n
v.
Gonzales,
437
HIPAA
IN
FEDERAL
QUESTION
CASES
subpoenaed
medical records
of
abortions
performed
by the
plaintiff
physi-
clans.
55
These included
records
at
Northwestern
Hospital
in
Illinois
and
at
New
York
and
Presbyterian
Hospital
in
New
York-two
hospitals
that
challenged
the subpoenas
in
their
respective
district
courts.
56
The
resulting
decisions,
along with other recent
cases,
illustrate
the
various ways
that
courts have reconciled
HIPAA
with
state
privilege
laws.
A.
Stating
that
HIPAA
Should
Always
Control
in
Federal
Question
Cases
Some
courts
have
held
that
HIPAA,
rather
than
any
state
privilege
law,
should
always
control
in
cases
in
which
courts
have
jurisdiction
based
on
a federal
question.
So
far
the
only
federal
circuit Court
of
Appeals
to
reach this conclusion
has
been
the
Seventh
Circuit
in
Northwestern
Memo-
rial
Hospital
v.
Ashcroft.7
Although
the court
ultimately
affirmed
the
quashing
of
the
subpoena,
it
did
so
on
different grounds
from
those
of
the
lower
court.
5
8
The
court
of
appeals
explained that
state
privilege
laws do
F.3d
278 (2d
Cir.
2006),
andPlanned
Parenthood
Fed'n
of
Am.
v.
Gonzales,
435
F.3d
1163
(9th
Cir.
2006),
and
Carhart
v.
Ashcroft,
331
F.
Supp.
2d
805
(D.
Neb. 2004),
and
Nat'l
Abortion
Fed'n
v.
Ashcroft,
330
F.
Supp. 2d
436
(S.D.N.Y. 2004),
aff'd
in
part
sub
nom.
Nat'l
Abortion
Fed'n
v.
Gonzales,
437
F.3d
278
(2d
Cir.
2006).
The
Act,
which
the
plain-
tiffs alleged
was
unconstitutional
on
several
grounds,
outlawed
certain
types
of
late-term
abortion procedures.
Id.
The
district court
later
issued
a
permanent
injunction against
en-
forcement
of
the
PBABA,
holding
it
to
be
unconstitutional
because
it
did
not
contain
an
exception
to
allow
the
procedures
when necessary
to
protect
the health
of
the
mother.
Nat'l
Abortion
Fed'n
v.
Ashcroft,
330
F.
Supp.
2d
at
487,
492-93
(citing
Stenberg
v.
Carhart,
530
U.S.
914, 938
(2000)).
A
parallel
case in
California
also
challenged
the
PBABA,
and
the
plaintiffs
in
that
case
similarly opposed
the
resulting
subpoenas
for
medical
records.
Planned Parenthood
Fed'n
of
Am.,
2004
WL
432222,
at
*1.
The
California
court
did
not
address
HIPAA
or
any
applicable
state
privilege.
See
id
at
*
1-*2.
Instead,
the
court
denied
the
government's
motions
to
compel
the
records
on
grounds
of
undue
burden
to the
provid-
ers
and
privacy
interests
of
the
patients.
Id
"
NAF
New
York,
2004
WL
555701,
at
*
1.
The
government
apparently
sought
these
records
to
test
the
physicians'
assertions
that
the
procedures
in
question
were
sometinmes
medically
indicated.
NAF
Illinois,
2004
WL
292079,
at
* 1.
The
district court
in
New
York
issued
a
protective
order
on
January
23,
2004, which
authorized
the
hospitals
to
redact
the
records
of
some
patient-identifying
information,
but
not
of
any
medical history.
Id.
56
NAFNew
York,
2004
WL
555701,
at
*1;
NAFIllinois,
2004
WL
292079,
at
*1.
Both
hospitals
claimed
that
the
applicable
state
privilege
law
protected
the
records
from
disclo-
sure.
NAF Illinois,
2004
WL
292079,
at
*2;
NAFNew
York,
2004
WL
555701,
at
*2.
57
See
Northwestern
Mem'l
Hosp.
v.
Ashcroft,
362
F.3d
923,
926
(
7
th
Cir.
2004);
see
also
supra
notes
53-56
and
accompanying
text
(providing
facts
giving
rise
to this
case).
The
district
court had
previously
quashed
the
government's
subpoena
for
medical
records
held
by
Northwestern
Hospital.
See
infra
notes
72-77
and accompanying
text
(discussing
district
court's
reasoning).
58
Northwestern,
362
F.3d
at
923.
The
court
of
appeals
held
that
the
medical
records
should
not
be
subject
to
subpoena because
the
government
had
been unable
to
articulate
any
potential probative
value
of
the
records,
and
that
this
did not
offset
the
ensuing
inva-
sion
of
patients' privacy.
Id.
at
927-33
(balancing relative hardships
under
FED.
R.
Civ.
P.
2007]
168
JOURNAL
OF
TRIAL
&
APPELLATE
ADVOCACY
[Vol.
XII
not apply
in
cases
based
on federal
question
jurisdiction.
59
The court
did
not
explicitly
discuss
HIPAA's
anti-preemption
provision
but
reasoned
that
it
was
not
HHS's
intent
for
the
regulations
to
incorporate
state
law.
60
Rather,
HIPAA
and
the
Privacy
Rule
are
purely
procedural
in
nature-
merely
establishing
the
requisite
procedures
for
medical
records
to
be
61
brought
into
court.
In
the
Southern
District
of
New
York,
a
judge
faced the
same facts
as
those
in
Northwestern
and
came
to
a
similar conclusion
regarding
HIPAA and
the
use
of
state
privileges.
62
This court was
more
explicit
in
its
analysis
of
HIPAA's
anti-preemption provision
than
was
the
Seventh
Cir-
cuit.
63
The
district
court
distinguished
a
federal law
that
does
not
by
its
terms
preempt
state
law
from
a
federal
law
that
incorporates
state
law.
6
4
The
former
permits
the
state
law
to
continue operating where
it
otherwise
would
have
if
the federal law
in
question
had
not been
in
effect; in
con-
trast,
the
latter
actively
adopts
state
law
as
federal
law.
65
The
district
court
interpreted
HIPAA's
language
as
being more
similar
to
the
former
non-preemption
situation.
Thus,
the
anti-preemption
clause
simply
allows
state
privileges
to
have
continued
effect
in
state
court,
and also
in
federal
court
when
state
law
provides
the rule
of
deci-
45(c)(3)(A)(iv)).
The
court considered,
as
one
factor
in
its
balancing,
that
Illinois'
medical
records
privilege would
have
dictated
quashing
the
subpoena.
Id.
at
932-33.
The
court
also
overruled
the
lower
court's
alternate
holding
that
would
have
established
a
federal com-
mon-law
privilege
for
the
abortion
records.
Id.
at
926.
59
Id.
at
925-26;
see
also
Kalinoski
v.
Evans,
377
F.
Supp.
2d
136,
140-41
(D.D.C.
2005)
(citing
Northwestern
and
agreeing
that
federal
privilege
law
applies when
federal
claims
are
brought
in
federal
court); Equal
Employment
Opportunity
Comm'n
v.
Boston
Mkt Corp., No.
2:03-CV-04227,
2004
WL
3327264,
at
*4
(E.D.N.Y.
Dec.
16,
2004)
(refus-
ing to
decide
whether
state
privilege
law
was more
stringent
in
a
case
based
on
a
federal
claim).
60
Northwestern,
362
F.3d
at
925
("[Wle
think
it
improbable
that
HHS
intended
to
open
such
a
can
of
worms when
it
set forth
a
procedure
for
disclosure
of
medical records
in
litigation.").
The
court
acknowledged
at
the
outset
of
its
analysis, however,
that
the
ques-
tion
regarding
the
effect
of
HIPAA
on
state
privileges
in
federal
court
is
still "not
free
from
doubt."
Id.
61
Id.
at
925-26.
Further,
the
court
remarked
that
HIPAA
is
not
an
"Act
of
Congress"
that would
create
a
privilege
and
remove
the
issue
from the
purview
of
federal
common-
law
under
Federal Rule
of
Evidence
501.
Id.
at
926.
62
Nat'l
Abortion
Fed'n
v.
Ashcroft
(NAF
New
York),
No.
1:03-CV-08695,
2004
WL
555701,
at
*4-*6 (S.D.N.Y. Mar.
19,
2004)
(refusing
to
apply New York
privilege
law).
The
district court
judge
allowed
the
subpoena
of
the medical
records
to
stand.
Id
at
*
1.
The
Attorney
General,
however, withdrew
the
subpoena after
all
of
these
cases
were
decided.
63
Compare
NAF
New
York,
2004
WL
555701,
at
*4-*5,
with
Northwestern,
362
F.3d
at
925-26.
64
NAF
New
York,
2004
WL
555701,
at
*4
(reasoning
that courts
must
look
to
Con-
gressional
intent
to
interpret
which
result
statute dictates).
65
See
id.
at
*4-*5
(comparing
the
former
to
the
effect
of
a
shield,
and
the
latter
to
a
sword).
HIPAA
IN
FEDERAL
QUESTION
CASES
sion.
66
To
support
this
proposition,
the
court
provided
contrasting
exam-
ples
of
incorporation-type
situations
in
which Congress
makes
explicit
statements
such
as
"State
standards
to
preempt applicable
Federal
stan-
dards"
67
or
"laws
of
each
adjacent
State
...
are
declared
to
be the
law
of
the
United States.,
68
The
relevant
language
in
HIPAA
instead
states only
that
it
will not
preempt contrasting,
more
stringent
state
privilege
laws.
69
The court
also
quoted
HHS,
who
authored
the
Privacy
Rule
regulations,
as
interpreting
HIPAA
to
not
"give
an
effect
to
State
law
that
it
would
not
otherwise
have
in
the absence
of
section
264(c)(2).,,
70
This
supports
the
court's
conclusion that HIPAA
was
not
intended
to
incorporate
state
law
into
federal
law.
7
'
B.
Stating that
More
Stringent
State
Privilege
Laws
Should
Apply
A
minority
of
courts
have
held
that
even
in
federal
question
cases,
state
privilege
laws
should apply
if
they
are
more
stringent
than the protec-
tions
afforded
by
HIPAA.
The
first
of
these
cases
was
National
Abortion
Federation
v.
Ashcroft
(NAF
Illinois)-a
case
from
the
Northern
District
of
Illinois,
which
on
appeal
became
Northwestern
Memorial,
discussed
above.
72
NAF
Illinois
involved
a
subpoena
for
medical
records for
certain
patients
of
a
physician-plaintiff
in
the
original
case
in
New
York,
challeng-
ing
PBABA's
constitutionality.
73
66
See
id.
at
*4-*5
("The
negative
language
in
section
264(c)(2)
does not
equate
to the
positive power
to
create
binding
law
in
the federal
domain.").
67
Id.
at
*4
(quoting
29
U.S.C.
§
667(b))
(distinguishing
HIPAA
from
law
in
which
Congress
intended
for state
law
to
preempt
federal
law).
Id.
at
*4
(quoting
43
U.S.C.
§
1333(a)(2)(A))
(distinguishing
HIPAA
from
law
that
Congress intended
to
incorporate
state
standards).
6
Id.
at
*5.
70
Id.
at
*5
(quoting
64
Fed.
Reg.
59,918,
60,000
(Nov.
3,
1999)).
The
court
empha-
sized
HHS'
construction,
saying
that
courts should
look
to
the
relevant administrative
agency's
reasonable
interpretation
if
a
statute
is
silent
on
a
particular
issue.
Id
(citing
Chevron
USA,
Inc.
v.
Natural
Res.
Def.
Council,
467
U.S.
837,
843-44
(1984)).
71
Id.
at
*6.
The
court
also
asserted
that
although
HIPAA
does
not
create
a
privilege,
it
counts
as
an
Act
of
Congress
for
the
purposes
of
Fed.
R.
Evid.
501.
Id.
If
other courts were
to
adopt
this
view
it
would preclude development
of
a federal
common-law
privilege.
Id.
at
*6.
72
Nat'l
Abortion
Fed'n
v.
Ashcroft
(NAF
Illinois),
No.
1:04-CV-00055,
2004
WL
292079,
at
*5
(N.D.
I11.
Feb.
6,
2004),
aff'd
sub
nom.
Northwestern
Mem'l
Hosp.
v.
Ashcroft,
362
F.3d
923
(
7
th
Cir. 2004).
Although
the
court
of
appeals affirmed
the
ultimate
result regarding
the
subpoena
in
NAF
Illinois,
it
disagreed
with
the
district
court's
interpre-
tation
of
HIPAA
and how
it
relates
to the
Illinois medical-records
privilege.
See
supra
notes
57-61
and
accompanying
text
(discussing
court
of
appeals'
decision).
The
district
court's
reasoning
remains
useful
for
study
as
the
law
in
this
subject
area
is
unsettled,
and
it
is
unclear
what approach
future
courts will
take.
73
Nat'l
Abortion
Fed'n
v.
Ashcroft,
330
F.
Supp.
2d.
436
(S.D.N.Y.
2004)
(original
case
challenging PBABA),
aff'd
in
part
sub
nom.
Nat'l
Abortion
Fed'n
v.
Gonzales,
437
2007]
170
JOURNAL
OF
TRIAL
&
APPELLATE
ADVOCACY
[Vol.
XII
The
district
court
in
NAF
Illinois
quashed
the
subpoena on the
basis
of
Illinois'
medical privacy
law,
which
prevents
physicians
from
disclos-
ing
patients'
medical
information
without
their
consent.
74
The
court com-
pared
the
scope
of
the
Illinois
statutory
privilege
with
HIPAA's
protec-
tions
and
found
that
the
Illinois
provisions
were contrary
to
and
more
stringent
than
HIPAA.
75
In
determining which
provisions
to
apply, the
court
interpreted
HIPAA's
anti-preemption
clause
to
mean
that HIPAA
"activated"
Illinois's
provisions,
describing
this
as
"a
case
of
one
federal
law
displacing
another.,
76
The court
reasoned that
it
must
have
been
Con-
gress'
intent
in
enacting
HIPAA
to
give
federal
effect
to
more stringent
state
privilege
laws
because
the
Privacy
Rule
would
otherwise
be
mean-
ingless
under
Federal
Rule
of
Evidence
501.77
Similarly,
in
United
States
v.
Diabetes
Treatment
Centers
ofAmerica,
78
the
District Court
for
the
Dis-
trict
of
Columbia found that
Florida's
state
privilege
law was
in
conflict
with
and more
stringent
than the
HIPAA
provisions.
79
The
court
reasoned
F.3d
278
(2d
Cir.
2006);
NAF
Illinois,
2004
WL
292079,
at
*
1
(explaining that Northwest-
ern
had
control
over
records because
plaintiff-physician
practiced
there);
see
supra
notes
53-56
and
accompanying
text
(providing
circumstances
leading
to
these
cases).
74
NAF
Illinois,
2004
WL
292079,
at
*3,
*5
(citing
735
ILCS
5/8-802).
Illinois
law
prevented disclosure
in
this situation
even
though
the
records would
have been
redacted
of
certain
patient-identifying
information.
Id.
at
*3.
75
Id.
at
*3-*4
(citing
45
C.F.R.
§
160.202
for
definition
of
"more
stringent").
The
court
determined
that
Illinois's
provision
does
not allow
a
physician
to
disclose protected
information
even
in
response
to
a
subpoena,
while
"HIPAA
regulations
clearly
allow
a
hospital
to
disclose patient
medical
records,
when ordered
in
judicial
proceedings,
subject
to...
limitations."
Id.
at
*3.
This
Note
does
not focus on the
specifics
of
how
to
perform
a
HIPAA
preemption
analysis because
it
is
argued
here
that
such
analyses should
not
be
performed
in
federal
question
cases.
Interested readers
are
referred
to
other commentators
for
further elaboration
on
the
mechanics
of
HIPAA
preemption
analyses.
See
Guthrie,
supra
note
35,
at
152-53
(arguing
that
covered heath
care
entities
should
not
be
forced to
perform
such
difficult
legal
analyses).
See
generally
Beverly
Cohen,
Reconciling
the
HIPAA
Privacy
Rule
with
State
Laws
Regulating
Ex
Parte
Interviews
of
Plaintiffs'
Treating
Physicians:
a
Guide
to
Performing
HIPAA
Preemption
Analysis,
43
Hous.
L.
REv.
1091
(2006)
(noting
that
courts
have
been
inconsistent
in
analysis).
76
NAF
Illinois,
2004
WL
292079,
at
*5
(rejecting
government's
argument
that follow-
ing
Illinois
law
violates
Supremacy Clause by allowing
state
law
to
trump
federal
law).
7
Id.
at
*5.
The
Illinois
court
reasoned
that
the
lack
of
a
federal
common-law
physi-
cian-patient
privilege
was
not
dispositive
because
HIPAA
was
an
Act
of
Congress
for
the
purposes
of
Federal
Rule
of
Evidence
501.
See
id
As
an
alternate
means
of
quashing
the
subpoena,
the
court also
declared
there
to
be a
federal
physician-patient privilege
protecting
abortion records.
See
id.
at
*6
(holding
that
reason
and
experience dictate
a
privilege under
Federal
Rule
of
Evidence
501
for
such
sensitive information
as
abortion
records).
78
No.
Civ.
99-3298,
2004
WL
2009416
(D.D.C.
May
17,
2004).
79
Id.
at
*
1.
The
case
involved
medical
records
from
twenty-seven
states
and
the
Dis-
trict
of
Columbia;
however,
only
those
from
Florida
were
at
issue
here
because only
Flor-
ida's
privilege
law
was
in
conflict with
and
more
stringent
than
HIPAA's
protections.
Id.
at
*2
(reviewing
state-by-state
analysis
taken
by
Diabetes
Treatment Centers
of
America).
The
Florida
law
required
that
notice
be
provided
to
non-party
patients whose medical
re-
cords
would
be
brought
into
the
action, while
HIPAA
would
not require
notice
if
the dis-
HIPAA
IN
FEDERAL
QUESTION
CASES
that
HIPAA
did not preempt
the
state
law
because
of
HIPAA's
anti-
preemption
language.
8 °
C.
Performing
Comparison
of
HIPAA with
State
Privilege
Laws
Some
courts
exercising
federal
question
jurisdiction
have
per-
formed
comparisons
to
determine
whether
HIPAA
or
the
relevant
state
privilege
law
offers
greater privacy protections. For example,
in
Creely
v.
Genesis
Health
Ventures,
81
the
District
Court for
the Eastern
District
of
Pennsylvania
exercised
federal
question
jurisdiction
and
addressed
whether
the
defendant
would
be
required
to
produce certain medical
re-
cords
during
discovery.
82
The
court
determined
that
HIPAA
did
not
pre-
vent
the
court-ordered
production
of
the
records.
83
Significantly,
the
court
also evaluated
whether
Pennsylvania's
medical records
confidentiality
statute
allowed
the
records
to
be
withheld.
84
While the
Creely
court did
not
formally
analyze
whether
the
state
statute should apply
in
a
federal
ques-
tion
case,
it
referenced
HIPAA's
anti-preemption
language
and
implied
that
if
Pennsylvania's
law
had
prevented disclosure
it
would
have con-
trolled
in
the
case.
85
The
District
Court
for
the
Eastern
District
of
Louisiana performed
a
similar
analysis
in
United States
ex
rel.
Stewart
v.
Louisiana
Clinic,
86
in
which
the court
addressed
whether
HIPAA or Louisiana
privilege
law
pre-
vented
nonparty
medical records
from
disclosure.
87
The
Stewart
court
ex-
closure
were pursuant
to
a
court
order.
Id.
at
*3-*4
(using
notice
requirement
to
fulfill
both
elements:
being
contrary
to
and
more
stringent
than
HIPAA).
80
See
id.
(applying HIPAA retroactively
to case
that
arose
before
the
regulations
went
into
effect). The
court
noted that
the
compliance requirements
associated with HIPAA are
confusing
for
entities
that must
comply with
them,
especially
because
there
is
so
little
precedent
in
this area.
Id.
at
*5
(citing
Jennifer Guthrie,
Time
is
Running
Out
--
The
Bur-
dens
and
Challenges
of
HIPAA
Compliance:
A
Look
at
Preemption
Analysis,
The
"Mini-
mum
Necessary"
Standard,
and
the
Notice
of
Privacy
Practices,
12
ANNALS
HEALTH
L.
143,
146-47
(2003)).
81
No. 2:04-CV-00679,
2004
WL
2943661,
at
*1
(E.D.
Pa.
Dec.
17,
2004).
82
Creely,
2004
WL
2943661,
at
*1
(denying
defendant's
motion
to
prevent disclo-
sure).
The
particular
medical
records
at
issue
concerned
a
deceased
non-party
individual.
Id.
at
*2.
83
Id.
at
*3
(noting
that
a
non-party's
records
can
be
disclosed
even
without
notice to
the
patient pursuant
to
a
court
order).
4
Id.
at
*3-*4
(citing
28
Pa.
Code
§
211.5(b)
(2004)).
85
See
id.
(evaluating
whether Pennsylvania
law was
more stringent
than
HIPAA
by
applying
Pennsylvania's
standard,
which
allows
disclosure
for
good
cause). The
court
held
that
under
the
facts
of
this
case
the
Pennsylvania
statute did not
prevent disclosure, creating
a
similar
result under either
HIPAA
or
Pennsylvania
law.
Id.
(finding
disclosure
of
redacted
records
posed
little
potential
for
harm
to
the
deceased
patient).
86
No.
99-1767,
2002 WL
31819130,
at
*1
(E.D.
La.
Dec.
12,
2002).
87
Stewart,
2002
WL
31819130,
at
*1
(case
brought
under
the
False
Claims
Act,
31
2007]
172
JOURNAL
OF
TRIAL
&
APPELLATEADVOCACY
[Vol.
XII
plicitly noted that
federal-not
state-confidentiality
law
typically
con-
trols
in
federal
question
cases.
88
The court
reasoned, however, that
if
the
Louisiana
law
met
the
requirements
of
the
HIPAA
anti-preemption
lan-
guage, the
state
law
would
apply
to
the
case.
89
Ultimately,
the
Stewart
court held
that
HIPAA
preempted
the
Louisiana
law
because
it
did
not
satisfy
the
required
elements
to
be
exempt
from
preemption.
9
"
IV.
ANALYSIS
A.
HIPAA
Was
Not
an
Act
of
Congress
Creating
a
Privilege
Congress
did
not
intend
to
create
a
federal
physician-patient
privi-
lege
in
enacting
HIPAA.
Congress
has
used much
more
direct
language
when creating
other privileges
by
statute.
For
example,
one
such
statute
creating
a
privilege for
certain
highway
safety
reports dictates
that
such
reports
"shall
not
be
subject
to
discovery
or
admitted
into
evidence
in a
Federal
or
State
court
proceeding."
9
'
Another
statute
creating
a
privilege
for
patient
safety
work product
clearly
states
that
"patient
safety
work
product
shall
be
privileged
and
shall
not
be
subject
to
...
subpoena
or or-
der...,
subject
to
discovery..,
admitted
as
evidence
in
any
Federal,
State,
or
local
governmental
civil
proceeding, criminal proceeding, administra-
tive
rulemaking proceeding, or administrative adjudicatory
proceeding...
or
admitted
in
a
professional
disciplinary
proceeding.,
92
Congress
did
not
U.S.C.
§
3729).
Relators
in
the
case
sought
the
complete medical
records
in
question,
while
the
defendants
requested
that
they only
be
required
to
produce records after
redaction
of
patient-identifying information.
Id.
88
Id.
at
*2.
89
See
id.
at
*4-*5
(electing
to
perform
HIPAA
analysis despite HIPAA not
yet
being
in
effect);
see
also
Bayne
v.
Provost,
359
F.
Supp.
2d 234
(N.D.N.Y.
2005) (case
brought
under
42
U.S.C.
§
1983).
The
Bayne
court
similarly stated
that
state
privileges
do
not
apply
in
federal
question
cases,
but then proceeded
to
analyze
whether
the
New
York
law
was
more
stringent
than the
protections
provided
by
HIPAA.
Id.
at 238-41.
Although
the
court
ultimately
held
that New
York
law
did
not offer
more
protections
and was thus
preempted
by
HIPAA,
this implied
that the
court
would
have
applied New York
confidentiality
law
to
the
federal
question
case
if
it
had found
the
reverse.
See
id
at
239-41.
90
Stewart,
2002
WL
31819130,
at
*5
(holding
that
the
Louisiana
statute
was
not more
stringent
than HIPAA
in
that
it
did
not address
"the form,
substance, or
the
need
for
express
legal
permission
from
an
individual"
(citing
45
C.F.R.
§
160.202)).
9
23
U.S.C.
§
409. Courts
have held
that
the
policy underlying
this
provision
is
to
"[f]oster
the
free
flow
of
safety-related information
by
precluding
the
possibility
that
such
information
later
would
be
admissible
in
civil
suits."
Perkins
v.
Ohio
Dept.
of
Transp.,
584
N.E.2d
794,
802
(Ohio
Ct.
App.
1989).
92
42
U.S.C.
§
299b-22.
Patient
safety
work
product
includes
reports
"developed
by
a
provider
for
reporting
to
a
patient
safety
organization
...
or
developed
by
a
patient
safety
HIPAA
IN
FEDERAL
QUESTION
CASES
intend
for HIPAA
to
directly
create
a
physician-patient
privilege
because
it
did not
use
similar
explicit language
as
in
these
other
statutes.
Congress
also did
not
intend
for
HIPAA
to
incorporate
state
privi-
leges
and
thereby
implement
a
de
facto federal
privilege.
93
Had
this
been
the case,
it
surely
would
have been
an
issue
of
debate,
not
only among
those
in
Congress
but
also
among
academic
and legal
commentators,
dur-
ing
the
drafting
and
passage
of
HIPAA.
94
Rather,
Congress
intended
to
increase
efficiency
and reduce fraud
in
the
administration
of
health insur-
ance.
95
The
privacy provisions, relegated
to
formation
by
regulation,
were
primarily
added
to
ensure
that
the
increasing
transfer
of
electronic
health
information
would
not
lead
to
information misuse,
to
give
patients
the
right
to
consent
to
various uses
of
their
personal data,
and
to
provide
indi-
viduals
access
to
their
own
medical
records.
96
The
Secretary
of
HHS
re-
marked
in
the
preamble
to
the
Privacy
Standards
that
the
regulations
were
not
intended
to
create
a
new
privilege,
as
this
would
be
beyond
the
scope
of
authority
that Congress had delegated
to
the
agency.
97
If
Congress did not
intend
to
create
a
privilege,
then
HIPAA was
not an Act
of
Congress
for
the
purposes
of
Federal
Rule
of
Evidence
501.
On the contrary, HIPAA
is
purely procedural
in
nature
and
allows the use
of
protected
medical
information
in
court when litigants
comply with
the
procedures
in
the
Privacy
Rule.
98
Courts
apply
HIPAA
in
determining
what procedures
are
required, but
this does
not
equate
to
a
privilege.
In-
stead,
a
true
privilege results
from
society
valuing
the
privacy
of
a
particu-
lar
relationship
to
such
a
degree
that
it
is
willing
to
forgo
in-court
use
of
any
relevant information
arising
from
that
relationship.
99
The
Privacy
Rule
organization
for
the
conduct
of
patient
safety
activities."
42
U.S.C.
§
299b-21(7)(A);
see
also
42
U.S.C.
3614-1(a)(2)
(using
phrase
"shall
be
privileged"
to
create
privilege
for
re-
ports
of
certain self-tests).
93
See
supra
notes
13-17
and
accompanying
text
(describing
purpose
of
HIPAA
and
Privacy
Rule).
94
Instead,
during
the
debates on
HIPAA,
legislators
commented
on
the lack
of
accom-
panying privacy protections.
See
supra
note
45-46 and accompanying
text
(providing
ex-
amples
of
legislators'
fears
about
HIPAA's
lack
of
attendant
privacy protections).
96
See
supra
note
13
and
accompanying
text
(summarizing
HIPAA's
purposes).
96
See
supra
notes
14-17
and
accompanying
text.
9
See
supra
note
50
and
accompanying
text
(providing
Secretary's
caution
that
HIPAA
regulations
did
not
create any
new
privilege).
9
See
supra
notes
20-22
and
accompanying
text
(summarizing
HIPAA's
requirements
for use
of
medical records
in
judicial
proceedings);
supra
note
61
and
accompanying
text
(discussing
Northwestern's
reasoning that
HIPAA
was
purely
procedural).
The
court
in
NAF
Illinois
explained
that
"HIPAA's
regulations
clearly allow
a
hospital
to
disclose
pa-
tient
medical
records,
when ordered
in
judicial
proceedings,
subject
to
.. .
limitations."
Nat'l
Abortion
Fed'n
v.
Ashcroft
(NAF
Illinois),
No.
1:04-CV-00055, 2004 WL 292079,
at
*3
(N.D.
Ill.
Feb.
6,
2004),
aff'd
sub
nom. Northwestern
Mem'l
Hosp.
v.
Ashcroft,
362
F.3d
923
(
7
th
Cir.
2004).
99
See
supra
notes
24-25
and
accompanying
text
(discussing policy
reasons
behind
2007]
174
JOURNAL
OF
TRIAL
&APPELLATEADVOCACY
[Vol. XII
does
not reach
the
same
policy conclusion;
although
Congress and
HHS
recognized
the
importance
of
privacy
of
medical
information,
they
chose
to
allow
the
use
of
this information
in
courts.
100
Rule
501
dictates
that
courts then look
to
federal
common-law
privileges
in
situations
such
as
this
where
Congress
has
not
so
acted.
10
'
Congress
did
not
intend
for
HIPAA
to
preempt
state
law
in
the
area
of
medical information privacy,
and
the
Privacy
Rule
would
presumably
not
conflict
with
any
privilege
that
courts
may
establish
in
the
future.
10
2
HIPAA
merely
provides
the
minimum procedures
necessary
to
bring
pri-
vate
medical
information
into
court;
a
privilege that
would disallow
the
use
entirely would
go
beyond
the
present
floor
of
protection.
1
03
This
leaves
courts the freedom
to
develop
a
federal
common-law
physician-patient
privilege
if
they
so
choose.
10
4
B.
HIPAA
Does
Not
Direct
Courts
to
Apply
More
Stringent
State
Privilege
Laws
in
Federal
Question
Cases
The
plain language
of
HIPAA
does
not
direct
federal law
to
incor-
porate
state
privilege
laws.
105
HIPAA's
anti-preemption
section
states
that
its
provisions
do
not
supersede
contrary
state
laws
that
"[impose]
require-
ments,
standards,
or implementation specifications
that
are
more
stringent
than
[those]
imposed
under
the
regulation."
10 6
State
privilege
laws do
not
impose
any
requirements
in
cases
where courts exercise
federal
question
jurisdiction,
as
federal
privilege
law
controls
in
these cases.
10 7
Thus,
the
anti-preemption
language
could
have
no
effect
on state
law
in
these
cases
providing
a
privilege);
see
also
supra
note
27
(providing
examples
of
state
physician-
patient privileges).
100
See
supra
notes
50-52
and
accompanying
text
(explaining
HHS's
policy
valuing
privacy while balancing
against
other competing policies).
101
See
supra
note
31
and accompanying
text
(setting out
analysis
under
FED.
R.
EVID.
501).
102
See
supra
notes
36-43
and
accompanying
text
(providing
overview
of
preemption
doctrine
and
HIPAA's
preemption
language).
Federal
law
preempts
state
law
in
a
particular
area
if
Congress
so
intends or
if
federal and
state laws
are
in
conflict
with
one
another.
Id.
103
See
supra
note
49
and
accompanying
text
(characterizing
Privacy
Rule
as
a
federal
floor
of
regulations).
104
See
supra
note
49
and
accompanying
text. The Secretary
of
HHS
explained
that
states
and
regulated
agencies
are
free to
provide
more
protections
than does
HIPAA.
Id.
By
inference,
the
federal
courts
or
Congress
are
also
free
to
provide
increased
protections
in
the
future.
See id
105
See
supra
notes
64-71
and
accompanying
text
(summarizing
reasoning
of
Nat'l
Abortion
Fed'n
v.
Ashcroft
in
distinguishing
simple
non-preemption
language
from that
of
incorporation).
10n
42 U.S.C.
§
1320d-2
note
(1996).
107
See
supra
notes
28-30
and
accompanying
text
(explaining
that
federal
courts
only
apply
state
privilege
laws
where
state
law
provides
rule
of
decision).
HIPAA
IN
FEDERAL
QUESTION
CASES
because
state
law
never
would
have
applied
in
the
absence
of
HIPAA.'
°8
The
anti-preemption
provision
applies only
in
state
courts
and
in
federal
court
cases
in
which
state law
provides
the rules
of
decision-i.e.,
diver-
sity
jurisdiction.1
0 9
Congress
did
not
intend
for
state laws
to
preempt HIPAA or
for
HIPAA
to
incorporate
state laws."
0
Congress
has
been
more
explicit
in
giving
state law
the
force
and
effect
of
federal
law
in
those
instances
where
it
has
chosen
to
do
so."'
No similar
explicit
language was
used
in
HIPAA's
anti-preemption provision, implying
that Congress did not
intend
such
a
result.'
12
Further,
HHS
did not believe that
the
Privacy
Rule
gave
federal
ef-
fect
to
state
privilege
laws.
113
HHS
attempted
to
balance
individuals'
pri-
vacy interests with
various
competing
public interests,
such
as
the
use
of
relevant
medical record
information
in
judicial
proceedings.
1
4
The Privacy
Rule
allows for disclosure
in
such
situations, even
without
the
individual
patient's
consent,
so
long
as
proper
procedures
are
followed.
15
HHS
em-
phasized
that
the
rule
dictates
the
procedures parties must
use
in
obtaining
health
information;
it
does
not disturb
any
previously
existing
state
or
fed-
eral
privileges."
6
State
privileges
never
existed
in
federal
question
cases,
so
the
Privacy
Rule's
only
effect
in
these
cases
is
to
provide
procedures
for
disclosure."17
The
Seventh Circuit properly
held
that
the
Privacy
Rule does
not
allow for
state
privileges
to apply
in
federal
question
cases.
18
While
that
court recognized
that
this
point
was
"not
free
from doubt,"
the
majority
of
108
See
supra
notes
50-52
and accompanying text (providing
HHS's
understanding
that
HIPAA
had
no effect
on
existing
privileges).
109
See
supra
note
59
and
accompanying
text
(surveying
courts
that
have
so
held).
1 10
See
supra
note
66
and
accompanying
text
(providing conclusion
of
Nat
'
Abortion
Fed'n
v.
Ashcrofi).
11'
See
supra
notes 67-68
and
accompanying
text
(quoting other
statutes
in
which
Con-
gress more
explicitly
intended
for
federal
law
to
incorporate state
law).
For
example,
Con-
gress
has
used
phrases
such
as "State
standards
to preempt
applicable
Federal
standards"
or
"laws
of
each
adjacent
State
...
are
declared
to
be
the law
of
the
United
States."
Id.
112
See
supra
notes
69-71
and
accompanying
text
(distinguishing
HIPAA's
language
from
that
in
incorporation-type statutes).
113
See
supra
note
70
and
accompanying
text
(quoting
HHS's
statement
made
during
notice
and
comment
period).
114
See
supra
note
51
and
accompanying
text
(stating
balancing
is
necessary
because
privacy interest
is
not
absolute).
115
See
supra
notes
20-22
and accompanying text
(discussing
procedures
for
use
of
medical records
in
judicial
proceedings).
116
See
supra
notes
50-52
and
accompanying
text
(summarizing
Secretary's
statements).
117
See
supra
notes
59-61
and
accompanying text (discussing
Northwestern's
reason-
ingl8
See
supra
note
59
and
accompanying text.
2007]
176
JOURNAL
OF
TRIAL
&
APPELLATE
ADVOCACY
[Vol.
XII
courts
analyzing this
issue
have
also
reached
the
same
conclusion.'
19
The
problematic
cases
are
those
in
which
courts
exercising
federal
question
jurisdiction
perform
preemption
analyses,
in
which
they determine
if
the
relevant
state
privilege
law
is
more
stringent
than
the
protections
offered
by
HIPAA.1
2 0
These
cases create
the
potential for
state laws
to
improperly
control
in
federal
courts,
and
also
confuse
the
proper
analysis.
21
Future
courts
should
follow
the
Seventh
Circuit's
lead and
decline
to
perform
these
preemption
analyses.
1
2
2
V.
CONCLUSION
While
many
states
recognize
statutory
physician-patient
privileges,
there
is
no
similar privilege
in
the
federal
courts. HIPAA
did not
have
the
effect
of
creating
such
a
privilege-either
directly or
by
federalizing
state
privileges.
HIPAA's
preemption
language
allows more
stringent
state
privileges
to
continue
their previous
effect
in
state
courts,
but
does
not
permit
courts
exercising
federal
question
jurisdiction
to
apply these
state
privileges.
Federal courts
currently
performing preemption
analyses
to
determine
if
the
applicable
state
statute
is
more
stringent
than HIPAA
are
improperly giving
federal
effect
to
state
law.
Privacy surrounding
medical records
is
certainly
an
important
value;
however,
it
must
be
balanced against
other
values,
such
as
free
availability
of
relevant evidence
in
judicial
proceedings. Congress
and
federal courts
have
thus
far
chosen
to
weigh
the
balance
on
the
side
of
admissibility
of
medical records
and have
not enacted
a federal
physician-
patient
privilege.
While HIPAA
did
not
itself
create such
a
privilege,
its
passage
is
a
public
recognition
of
the
need
for privacy protections
in
an
environment
in
which
it
is
increasingly
easy
to
transfer
information.
Until
either Congress or
the
federal
judiciary
build upon
this recognition
and
formally recognize
a
physician-patient
privilege,
states'
privileges
should
not
control
in
federal
courts.
Jenna
Phipps
119
See
supra
note
60
and
accompanying
text
(quoting
Northwestern).
But
see
supra
note
72
and
accompanying
text
(summarizing cases
holding
that
more
stringent
state
privi-
lege
law
applied
in
federal
question
cases).
120
See
supra
notes
75, 79,
84-90 and
accompanying
text.
121
See
supra
notes
75,
79,
84-90
and
accompanying
text
(summarizing
cases in
which
courts either
used
or implied
that
they
would
use state
privileges).
122
See
supra
notes
57
and
59
and
accompanying
text
(stating
Seventh
Circuit
was
first
court
of
appeals
to
hold
that
HIPAA does not
direct
federal
courts
to
apply
state
privileges).
