State of confusion: the HIPAA privacy rule and state physician-patient privilege laws in federal question cases

Suffolk Journal of Trial & Appellate Advocacy, Annual, 2007 by Jenna Phipps

A. Stating that HIPAA Should Always Control in Federal Question Cases

Some courts have held that HIPAA, rather than any state privilege law, should always control in cases in which courts have jurisdiction based on a federal question. So far the only federal circuit Court of Appeals to reach this conclusion has been the Seventh Circuit in Northwestern Memorial Hospital v. Ashcroft. (57) Although the court ultimately affirmed the quashing of the subpoena, it did so on different grounds from those of the lower court. (58) The court of appeals explained that state privilege laws do not apply in cases based on federal question jurisdiction. (59) The court did not explicitly discuss HIPAA's anti-preemption provision but reasoned that it was not HHS's intent for the regulations to incorporate state law. (60) Rather, HIPAA and the Privacy Rule are purely procedural in nature--merely establishing the requisite procedures for medical records to be brought into court. (61)

In the Southern District of New York, a judge faced the same facts as those in Northwestern and came to a similar conclusion regarding HIPAA and the use of state privileges. (62) This court was more explicit in its analysis of HIPAA's anti-preemption provision than was the Seventh Circuit. (63) The district court distinguished a federal law that does not by its terms preempt state law from a federal law that incorporates state law. (64) The former permits the state law to continue operating where it otherwise would have if the federal law in question had not been in effect; in contrast, the latter actively adopts state law as federal law. (65)

The district court interpreted HIPAA's language as being more similar to the former non-preemption situation. Thus, the anti-preemption clause simply allows state privileges to have continued effect in state court, and also in federal court when state law provides the rule of decision. (66) To support this proposition, the court provided contrasting examples of incorporation-type situations in which Congress makes explicit statements such as "State standards to preempt applicable Federal standards" (67) or "laws of each adjacent State ... are declared to be the law of the United States." (68) The relevant language in HIPAA instead states only that it will not preempt contrasting, more stringent state privilege laws. (69) The court also quoted HHS, who authored the Privacy Rule regulations, as interpreting HIPAA to not "give an effect to State law that it would not otherwise have in the absence of section 264(c)(2)." (70) This supports the court's conclusion that HIPAA was not intended to incorporate state law into federal law. (71)

B. Stating that More Stringent State Privilege Laws Should Apply

A minority of courts have held that even in federal question cases, state privilege laws should apply if they are more stringent than the protections afforded by HIPAA. The first of these cases was National Abortion Federation v. Ashcroft (NAF Illinois)--a case from the Northern District of Illinois, which on appeal became Northwestern Memorial, discussed above. (72) NAF Illinois involved a subpoena for medical records for certain patients of a physician-plaintiff in the original case in New York, challenging PBABA's constitutionality. (73)