In a case of first impression, a Louisiana court held that the Health Insurance Portability and Accountability Act (HIPAA) and the Standards for Privacy of Individually Identifiable Health Information (Standards) promulgated by the Secretary of the Department of Health and Human Services (DHHS) preempt the Louisiana health care provider/patient privilege law. See U. S. ex rel. Mary Jane Stewart et al. v. The Louisiana Clinic et al, No. Civ. A. 99 1767, 2002 WL 31819130 (E.D.La., Dec. 12, 2002).
HIPAA effectively establishes a minimum floor for privacy protection and the Standards preempt state privacy laws that are contrary to it, i.e., a covered entity would find it impossible to comply with both the state and federal requirements. A state enacting contrary privacy protections must request an exception from DHHS to avoid preemption. However, HIPAA allows states to enact privacy protections that are consistent with but “more stringent” than the Standards. The key preemption issue in this case is the interpretation of “more stringent.” See 45 CFR §§ 160.201-160.205.
This case is a qui tam action in which relators Mary Jane Stewart, Jr. et al (“relators”) seek to recover damages on behalf of themselves and the U.S. government under the False Claims Act. See 31 U.S.C. § 3729. Relators allege that defendants presented false claims for Medicare and Medicaid reimbursement. To prove their case, relators need access to patient names and patient medical records to investigate the validity of the reimbursement claims. Defendants sought a protective order concerning the disclosure of the nonparty patient billing and medical records. Defendants sought an order that would allow them to produce documents after removing all patient identifying information from the documents, and replacing patient names with numbers.
The Standards permit a covered entity to disclose nonparty patient records (without notice to the patients) during a lawsuit only if the information is protected by an appropriate court order. Defendants argued that HIPAA’s disclosure provision is less stringent than Louisiana law, which requires notice to the patient and a hearing that includes the patient before nonparty patient records may be produced without the patient’s consent. Therefore, defendants argued that since Louisiana law is more stringent than HIPAA there is no preemption and that Louisiana law must be applied. The court rejected such argument, finding the Louisiana law less stringent than HIPAA, since the Louisiana statute does not address “the form, substance, or the need for express legal permission from an individual” required by 45 CFR § 160.202. The court noted that the procedure utilized by the Louisiana statute “provides a way of negating the need for [patient] permission,” since the statute requires to court to order disclosure even without patient’s consent “if the court finds that release of the information is proper.” See WL 31819130 at page 5.
The court agreed with relators’ argument that the HIPAA Standards do not apply since the compliance date for health care providers is April 14, 2003. Therefore, much of the opinion regarding the impact of HIPAA is dicta, but may be instructive of how this and other courts may approach the issue in the future. The court applied the HIPAA standards because it found HIPAA to show the federal policy to protect patient medical records and therefore provide guidance in deciding this case.
Applying the Standards, the court held that both relators and defendants complied with HIPAA Standards by seeking an appropriate protective order (but without holding a hearing or obtaining the patient’s consent). See WL 31819130 at page 5. See also 45 C.F.R. § 164.512(e)(v), which prohibits the parties from using or disclosing protected health information for purposes other than the litigation and further requires that the information be returned to the covered entity or destroyed at the end of the litigation.
The court agreed to issue a protective order using a “twofold” production so that defendants would produce a set of unaltered documents marked “confidential, for counsel’s eyes only” and a second set of redacted documents with patient identifying information removed for use by any party for any pretrial purpose. The protective order would restrict the unaltered set to “counsel of record, no more than two paralegals and one expert for each party.” See WL 31819130 at page 5.