Commentary: When HIPAA and states collide

By Anthony Brino
08:17 AM
Share

Far from Direct messaging or clinical repositories, a more basic form of health information exchange — and very much as a verb — is families managing the healthcare of elderly relatives and seeking their medical records at the end of life and after death.

For a variety of reasons, legal or personal, families members might want to obtain their deceased relatives’ records, and in a lot of cases, it would seem they have a right to under the Health Insurance Portability and Accountability Act and under various state laws.

But as a recent federal appeals court ruling shows, state and federal statutes can collide and end up hindering information access — even when to a large extent they have similar end-goals of allowing reasonable and meaningful access to medical information.

In Florida, in the late 2000s, seven nursing homes were issued citations by the state Agency for Health Care Administration (ACHA) for not releasing the medical records of deceased patients to family members, as permitted under a 1987 state law.

Citing HIPAA, several groups of families and attorneys appealed to the U.S. Department of Health and Human Services’ Office of Civil Rights after the nursing homes said HIPAA in fact prevented the disclosure.

HHS ended up siding with the nursing homes, clarifying that they were complying with with HIPAA’s “personal representatives” provisions by only selectively releasing deceased patient records under certain circumstances. The nursing homes, in turn, took the Florida AHCA to court over the citations and in early April, the the 11th U.S. Circuit Court of Appeals in Atlanta upheld a district court ruling that the 1987 Florida law was too broad in its disclosure allowances and thus preempted by HIPAA.

The Florida law, wrote justice Susan Black on behalf of a three judge panel, “authorizes sweeping disclosures, making a deceased resident’s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident’s stead” — all in conflict with HIPAA.

HIPAA’s personal representative requirements extents to people who were given medical power of attorney or authority of the deceased patient’s estate, and to relatives or people identified by the patient involved in paying for their healthcare — but only “in narrowly delineated circumstances,” Black said.

[Podcast: HIE 2.0 riding in on a raft of new challenges]

HIPAA applies only to those involved in or paying for the deceased patient’s healthcare, and stipulates that “covered entities may release only protected health information that is relevant to such person’s involvement, i.e., information that is relevant to the care of the deceased individual or to the payment of the deceased individual’s healthcare.”

Florida’s 1987 law, though, “contains no such limitations or restrictions,” and it doesn’t require a HIPAA-compliant authorization in requests for deceased patients’ PHI.

The AHCA had argued that the state law and HIPAA actually complimented each other, with the HIPAA Privacy Rule allowing any person with legal authority to act on behalf of a deceased individual under state law to also act as a personal representative.

“The fatal flaw in the State Agency’s argument,” Black wrote, “is that the plain language of [the Florida law] does not empower or require an individual to act on behalf of a deceased resident.”

That Florida law, part of a body of nursing home statutes, “stands as an obstacle to the accomplishment and execution of the full purposes and objectives of HIPAA in keeping an individual’s protected health information strictly confidential,” Black wrote.

The ACHA said in a statement after the ruling that its now ensuring compliance with the stricter standards. The appeals court, meanwhile, offer guidance for reconciling state law with HIPAA: “Given the opportunity, we are confident the Florida legislature could bring [the state’s 1987 law] into compliance with federal law in any number of ways. Amending the statute, however, is a task for the state legislature, not a panel of federal judges."

Related:

HIE workgroup offers exchange advancement suggestions

HIE 2.0 closer than may appear

Commentary: HIE evolution is underway