Summary
finding more stringent state law did not apply in motion to quash subpoena for medical records
Summary of this case from Williams v. City of Phila.Opinion
Misc. No. 06-102-P-DMC.
October 3, 2006.
Craig M. Wolff, U.S. Attorney's Office, District of Maine, Portland, ME, for Grand Jury Proceedings.
James P. Bailinson, Maine Health, Portland, ME, for Spring Harbor Hospital.
MEMORANDUM DECISION AND ORDER
As part of a federal grand-jury investigation, the government on August 23, 2006 served a subpoena on Spring Harbor Hospital ("Hospital") commanding production of any and all documentation reflecting whether a certain individual ever had been involuntarily committed to a mental institution. See Subpoena To Testify Before Grand Jury, Exh. A to Memorandum of Law in Support of Spring Harbor Hospital's Motion To Quash Subpoena To Produce Records ("Supporting Memorandum"), attached to Motion To Quash Subpoena To Produce Records ("Motion") (Docket No. 1). The Hospital moves to quash that subpoena on narrow grounds. See Supporting Memorandum at 1-2. It concedes that it possesses no information that would permit it to challenge the subpoena on grounds that the information sought is either irrelevant or obtainable by alternate means. See id. at 1. And it acknowledges that, pursuant to regulations implementing the federal Health Insurance Portability and Accountability Act ("HIPAA"), which governs confidentiality of medical records, "a grand jury subpoena alone is sufficient for a covered entity such as [the Hospital] to disclose protected health information . . . for law enforcement purposes." Id. at 4; see also 45 C.F.R. § 164.512(f)(1)(ii)(B) ("A covered entity may disclose protected health information . . . [i]n compliance with and as limited by the relevant requirements of . . . [a] grand jury subpoena[.]"). But, according to the Hospital, it is uncertain whether section 164.512(f)(1)(ii)(B) applies in this case. See Supporting Memorandum at 3-4. This is so, it explains, inasmuch as:
1. HIPAA regulations elsewhere expressly state that HIPAA does not preempt more stringent state medical privacy laws.
2. In the Hospital's view, relevant Maine law is more stringent and does not permit it to make such a disclosure solely in response to a subpoena.
3. There is a split of authority whether the HIPAA preemption provision effectuates a kind of reverse preemption, pursuant to which stricter state medical privacy laws apply to federal-law cases brought in federal court.
4. Neither this court nor the First Circuit has weighed in on that latter point.
See id. at 4-5. Unsure of its obligations, the Hospital understandably has taken the precaution of filing the instant motion. See id. The government rejoins that (i) Maine medical-privacy law does not apply in the context of a federal grand-jury investigation and, (ii) in any event, relevant Maine law is not more stringent than its federal counterpart. See Government's Response to Motion To Quash Subpoena To Produce Records (Docket No. 3) at 1-2. I agree with the first proposition and hence need not and do not reach the second.
In section 264 of HIPAA, titled "Recommendations With Respect to Privacy of Certain Health Information," Congress directed: "A regulation promulgated under paragraph (1) shall not supercede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation." HIPAA, § 264(c)(2), 110 Stat 1936, 2033-34 (1996). Section 1178, titled "Effect on State Law" (contained within section 262 of the act), added:
(1) GENERAL RULE. — Except as provided in paragraph (2), a provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1172 through 1174, shall supersede any contrary provision of State law, including a provision of State law that requires medical or health plan records (including billing information) to be maintained or transmitted in written rather than electronic form.
(2) EXCEPTIONS. — A provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1172 through 1174, shall not supersede a contrary provision of State law, if the provision of State law —
***
(B) subject to section 264(c)(2) of the Health Insurance Portability and Accountability Act of 1996, relates to the privacy of individually identifiable health information.Id. at 2030 (codified at 42 U.S.C. § 1320d-7(a)).
The Department of Health and Human Services ("HHS") subsequently promulgated the HIPAA preemption regulation in issue, which provides, in relevant part:
A standard, requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law. This general rule applies, except if one or more of the following conditions is met:
***
(b) The provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter.45 C.F.R. § 160.203.
HHS made clear, in proposing the foregoing rule, that it neither construed section 264(c)(2) of HIPAA to create any sort of reverse preemption nor intended its own regulation to do so, stating:
We considered whether the preemption provision of section 264(c)(2) of Public Law 104-191, discussed in the preceding section, would give effect to State laws that would otherwise be preempted by federal law. For example, we considered whether section 264(c)(2) could be read to make the Medicare program subject to State laws relating to information disclosures that are more stringent than the requirements proposed in this rule, where such laws are presently preempted by the Medicare statute. We also considered whether section 264(c)(2) could be read to apply such State laws to procedures and activities of federal agencies, such as administrative subpoenas and summons, that are prescribed under the authority of federal law. In general, we do not think that section 264(c)(2) would work to apply State law provisions to federal programs or activities with respect to which the State law provisions do not presently apply. Rather, the effect of section 264(c)(2) is to give preemptive effect to State laws that would otherwise be in effect, to extent they conflict with and are more stringent than the requirements promulgated under the Administrative Simplification authority of HIPAA. Thus, we do not believe that it is the intent of section 264(c)(2) to give an effect to State law that it would not otherwise have in the absence of section 264(c)(2).
Standards for Privacy of Individually Identifiable Health Information, 64 Fed. Reg. 59918, 60000 (Nov. 3, 1999).
As the United States District Court for the Southern District of New York noted in a case closely on point, a court "must defer to HHS's reasonable interpretation of HIPAA." National Abortion Fed'n v. Ashcroft, No. 03 Civ. 8695(RCC), 2004 WL 555701, at *5 (S.D.N.Y. Mar. 19, 2004); see also, e.g., Rumierz v. Gonzales, 456 F.3d 31, 37 (1st Cir. 2006) ("[A] court must uphold [an agency's] interpretation of a silent or ambiguous statute so long as it is reasonable and consistent with the statute."). In Ashcroft, the court confronted the question whether, in a case brought in federal district court challenging the constitutionality of a federal statute, issues of access to medical records were to be resolved in accordance with more stringent New York law. Ashcroft, 2004 WL 555701, at *1, *3. The court held that they were not, observing: "Here, HIPAA is at best ambiguous about the effect of more stringent state laws in areas controlled by federal law prior to HIPAA. HHS reasonably construed section 264(c)(2) not to give any more effect to state law than it would have had in the absence of HIPAA." Id. at *5. The Ashcroft court reasoned:
There is a difference . . . between a federal law that does not preempt a state law and a federal law that incorporates a state rule of law. The latter gives the state law the force of federal law and makes it binding where it would not otherwise be; the former merely allows the state law to continue to operate in its sphere of influence, unaffected by the federal statute. The negative language in section 264(c)(2) does not equate to the positive power to create binding law in the federal domain — here, a case arising under federal law brought in federal court.Id. at *4 (emphasis in original).
Inasmuch as appears, most courts considering the matter have reached the same end point. See, e.g., Northwestern Mem'l Hosp. v. Ashcroft, 362 F.3d 923, 925 (7th Cir. 2004) (declining to apply Illinois privilege rules to adjudicate medical-records-access issue in context of suit challenging constitutionality of federal statute; observing, "Although the issue is not free from doubt, we agree with the government that the HIPAA regulations do not impose state evidentiary privileges on suits to enforce federal law."); Kalinoski v. Evans, 377 F. Supp.2d 136, 141 (D.D.C. 2005) (declining to apply District of Columbia privilege rules to adjudicate medical-records-access issue in context of federal discrimination claim); but see United States ex rel. Pogue v. Diabetes Treatment Ctrs. of Am., No. Civ. 99-3298, 01-MS-50 (MDL) (RCL), 2004 WL 2009416, at *2-*3 (D.D.C. May 17, 2004) (applying Florida medical-records-access law in context of federal False Claims Act litigation). There is no reason to believe that the First Circuit would do otherwise.
Because (i) the instant case involves a federal grand-jury subpoena, (ii) state medical-privacy law, even if more stringent, is inapposite in this context, and (iii) the Hospital acknowledges that, pursuant to 45 C.F.R. § 164.512(f)(1)(ii)(B), a grand-jury subpoena alone suffices to permit it to release the requested records (if any exist), the Motion is DENIED.
So ordered.