State of confusion: the HIPAA privacy rule and state physician-patient privilege laws in federal question cases

Suffolk Journal of Trial & Appellate Advocacy, Annual, 2007 by Jenna Phipps

HHS included similar sections on preemption in the Privacy Rule regulations, which state that the regulations as a whole preempt contrary state law. (42) A notable exception to this general rule is the "anti-preemption" clause, providing that HIPAA and its regulations will not preempt a conflicting state provision that "relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under [the privacy provisions] of this subchapter." (43) It is this preemption provision that has proven so troublesome in federal question cases. Some commentators and courts believe that the anti-preemption clause contained in HIPAA gives state privileges that are more stringent the force of federal law in federal question cases. (44)

D. Intent of Congress and HHS

In drafting and enacting HIPAA, Congress did not explicitly address the issue of whether HIPAA would give more stringent state privilege laws the force of law in federal question cases. Congressional records reveal, however, that several legislators expressed concern during debate that HIPAA did not provide more substantial privacy protections. (45) Representative Jim McDermott from Washington was especially disturbed that the bill required increased ease of transferring health information without mandating "one single shred of protection of your privacy." (46) Other testimony indicates that the anti-preemption provision may have been included in response to fears that HIPAA would override state health care and insurance reform efforts. (47)

In HHS' recommendations to Congress and in its final regulations, the Secretary of HHS expressed an urgent need for privacy protections at the federal level. The Secretary explained that many factors, including the rising use of electronic medical records and the attendant ease of information transfer, have increased the potential for misuse of private health data. (48) The Secretary believed that a federal floor of regulation in this area would provide a minimum level of protection while reflecting HHS' policy of guarding individuals' privacy surrounding their medical information. (49)

Although HHS recognized the importance of protecting medical privacy, the agency did not intend for the Privacy Rule to affect existing evidentiary privileges. (50) The Secretary explained that Congress and HHS had balanced privacy considerations against competing policies in allowing disclosure for certain purposes, such as for judicial proceedings. (51) In construing the interaction of the Privacy Rule with more protective state laws, the Secretary emphasized that such state laws would continue to apply where they "operate in the same area as the federal standards." (52)

III. FEDERAL COURTS' VARYING APPROACHES

The question of whether state privilege laws, if more stringent than HIPAA, should be used in federal question cases emerged in several courts in 2004 when then-Attorney General John Ashcroft subpoenaed medical records from various hospitals across the country. (53) This issue arose out of a case filed in New York in which the National Abortion Federation and seven physicians challenged the constitutionality of the Partial-Birth Abortion Ban Act of 2003 (PBABA). (54) During discovery the Attorney General subpoenaed medical records of abortions performed by the plaintiff physicians. (55) These included records at Northwestern Hospital in Illinois and at New York and Presbyterian Hospital in New York--two hospitals that challenged the subpoenas in their respective district courts. (56) The resulting decisions, along with other recent cases, illustrate the various ways that courts have reconciled HIPAA with state privilege laws.