State of confusion: the HIPAA privacy rule and state physician-patient privilege laws in federal question cases.

INTRODUCTION

People expect that when they visit a doctor the information that is revealed in the visit and recorded in their medical records will be kept from the eyes of others. This may be a reasonable expectation in most situations, but not necessarily if the medical records are sought for use in court. No federal physician-patient privilege exists, and the existence and scope of such a privilege varies across states. (1) The passage of the Health Insurance Portability and Accountability Act (HIPAA) has led to confusion over the appropriate effect of state privileges in federal question cases. (2)

HIPAA required the Department of Health and Human Services (HHS) to promulgate rules relating to privacy of protected health information. (3) The resulting set of regulations, known as the HIPAA Privacy Rule, contains a section discussing the use of protected health information, such as medical records, in judicial proceedings. (4) Federal courts generally use federal evidentiary rules where federal law supplies the rule of decision. (5) Additionally, federal laws typically preempt contrary state laws. (6) HIPAA, however, contains a preemption clause stating that it will not "supercede [sic] a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation." (7)

Courts have differed in their interpretation of HIPAA's preemption clause in cases whose subject matter jurisdiction is based on a federal question. (8) Some courts have held that HIPAA should always control in federal question cases. (9) Conversely, others have held that state privilege laws should apply if they are more stringent. (10) Still others have found middle ground, analyzing whether the particular state privilege law in question is more stringent than HIPAA without generalizing as to HIPAA's effect in all federal question cases. (11) This Note will argue that HIPAA should control in federal question cases, regardless of whether state privilege laws are more stringent. Future courts should acknowledge that Congress did not intend for HIPAA to incorporate state privileges. Courts should not compare the stringency of state privilege laws with HIPAA in federal question cases because this confuses the proper analysis and could lead to inappropriate control by state privilege laws in these cases.

Part II will provide an overview of relevant sections of HIPAA, along with Congress and HHS's intent. This section will also review the general doctrine of evidentiary privileges, various physician-patient and medical records privileges in states, and the theory of preemption. Part III will discuss various approaches taken by courts regarding the interpretation of HIPAA's preemption provision and the consequences that this has on which privilege law will apply in federal question cases. Part IV will analyze these approaches, and argue that HIPAA should preempt state privilege laws in federal question cases, regardless of the stringency of state law.

HIPAA, PRIVILEGES, PREEMPTION, AND CONGRESSIONAL INTENT

1. Overview of HIPAA and the Privacy Rule

   Congress enacted HIPAA on August 21, 1996. (12) The purposes of HIPAA were to ensure more consistent health insurance coverage, reduce insurance fraud, and increase efficiency in insurance administration. (13) Many provisions, particularly those in the Administrative Simplification section, would implicate privacy issues because they would result in increased sharing of individuals' health information. (14) Congress therefore directed the Secretary of HHS to provide them with recommendations regarding appropriate standards to protect individuals' information privacy. (15) If Congress failed to enact legislation encompassing the recommended standards, then HHS was to issue regulations regarding privacy of protected health information. (16) The task fell to HHS when Congress did not enact such legislation.

   In 2002, HHS promulgated the regulations known as the HIPAA Privacy Rule, which detail the measures that must be taken to properly handle protected health information. (17) Protected health information (PHI) is individually identifiable health information, meaning someone could potentially identify the individual by examining the health and demographic information contained in the PHI. (18) All health plans, health care clearinghouses, and health care providers who transmit health information electronically are considered covered entities and must abide by the regulations. (19)

   One section of the Privacy Rule pertains to the use of protected health information in judicial and administrative proceedings, allowing disclosure of such information after certain detailed procedures are followed. (20) If the presiding court issues a subpoena, the covered entity may disclose medical records without providing notice to the patient. (21) If the subpoena or discovery request is not court-ordered, the covered entity may disclose the records after either providing notice to the affected individual or obtaining a qualified protective order. (22)

2. Privileges

   A privilege gives a witness the right to withhold certain information from a judicial proceeding. (23) Privileges are exceptions to the maxim that "the public ... has a right to every man's evidence." (24) The policy underlying privileges is to encourage the free flow of information in certain relationships in which society highly values privacy. (25) Many states provide for such a privilege between patient and physician, usually via statute. (26) These statutes vary in scope but generally protect against requiring admission of medical records into evidence. (27)

   Federal Rule of Evidence 501 governs privileges in federal courts. (28) As a result of this rule, federal privileges control in federal courts unless state law provides the rule of decision--in which case, state privileges apply. (29) The rule reflects the theory that where a particular state's law provides the rule of decision in a case, that state has an interest in the privilege policies that the court applies. (30)

   If federal law applies, Rule 501 dictates the procedure to determine which privileges, if any, pertain to the case. First, the court determines whether an Act of Congress has created a privilege; if not, the court then assesses whether federal courts have developed a common-law privilege "in the light of reason and experience." (31) While federal courts currently recognize a psychologist-patient privilege, no such federal privilege exists to protect the physician-patient relationship or the resulting medical records. (32)

   HIPAA fits into this framework in a rather complex way. Some commentators argue that HIPAA was, in fact, an "Act of Congress" that created a physician-patient privilege. (33) Others contend that while HIPAA did not create a federal statutory privilege, federal courts should now recognize a common-law privilege. (34) Finally, some commentators propose that the most efficient solution would be for Congress to revise HIPAA so that it would completely preempt the area of medical information privacy, preventing states from creating physician-patient privileges. (35)

3. Preemption and its Relation to HIPAA

   The Supremacy Clause of Article VI of the United States Constitution commands that the Constitution and federal laws enacted pursuant to its authority "shall be the supreme Law of the Land." (36) The doctrine of preemption originating in this clause establishes that federal law trumps state law in particular areas if Congress so intends--expressly or impliedly--or if state law conflicts with federal law. (37) Express and conflict preemption are the types most pertinent to this discussion. Express preemption occurs when Congress enacts a statute explicitly stating that it will preempt state law in the relevant field. (38) Conflict preemption exists in scenarios in which one cannot simultaneously comply with both state and federal law because they are in conflict. (39) In enacting HIPAA, Congress expressly preempted some state laws relating to medical record-keeping. (40) As mentioned earlier, however, Congress saved from preemption conflicting state laws if they provide more stringent protections for health information privacy. (41)

   HHS included similar sections on preemption in the Privacy Rule regulations, which state that the regulations as a whole preempt contrary state law. (42) A notable exception to this general rule is the "anti-preemption" clause, providing that HIPAA and its regulations will not preempt a conflicting state provision that "relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under [the privacy provisions] of this subchapter." (43) It is this preemption provision that has proven so troublesome in federal question cases. Some commentators and courts believe that the anti-preemption clause contained in HIPAA gives state privileges that are more stringent the force of federal law in federal question cases. (44)

4. Intent of Congress and HHS

   In drafting and enacting HIPAA, Congress did not explicitly address the issue of whether HIPAA would give more stringent state privilege laws the force of law in federal question cases. Congressional records reveal, however, that several legislators expressed concern during debate that HIPAA did not provide more substantial privacy protections. (45) Representative Jim McDermott from Washington was especially disturbed that the bill required increased ease of transferring health information without mandating "one single shred of protection of your privacy." (46) Other testimony indicates that the anti-preemption provision may have been included in response to fears that HIPAA would override state health care and insurance...