Brown v. Mortensen

Filed 6/16/11

IN THE SUPREME COURT OF CALIFORNIA

ROBERT A. BROWN et al., )
)
Plaintiffs and Appellants, )
) S180862
v. )
) Ct.App. 2/1 B199793
STEWART MORTENSEN, )
) Los Angeles County
Defendant and Respondent. ) Super. Ct. No. BC289546
____________________________________)

In this case we address the remedies available to a patient when a debt
collector, acting on behalf of a medical professional, is asserted to have illegally
disclosed confidential patient medical information to various consumer reporting
agencies in the course of a dispute over an alleged medical debt.
Individuals, as patients, have a substantial interest in the privacy of their
medical information. (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th
1, 41.) As consumers, they have substantial interests as well in the privacy and
accuracy of their credit information. Recognizing the importance of these
interests, Congress has intervened on both fronts, enacting the Health Insurance
Portability and Accountability Act (HIPAA) (42 U.S.C. § 1320d et seq., inter alia)
and the Fair Credit Reporting Act (FCRA) (15 U.S.C. § 1681 et seq.) to protect
against the mishandling of medical information and credit information,
respectively. Our Legislature has been no less diligent, enacting the
Confidentiality of Medical Information Act (Confidentiality Act) (Civ. Code, § 56

1
et seq.) and the Consumer Credit Reporting Agencies Act (id., § 1785.1 et seq.),
inter alia, to address the same concerns.
Because of the dual state and federal responses to the protection of an
individual‟s privacy and accuracy interests, when the interests overlap, as in this
case, the question of what remedies are available is a federalism problem. As will
appear, we conclude that Congress did not intend the state remedies to be
preempted. Accordingly, we reverse the Court of Appeal, which held to the
contrary.
FACTUAL AND PROCEDURAL BACKGROUND1
Plaintiff Robert A. Brown and his two minor children were dental patients
of defendant Dr. Rolf Reinholds.2 In July 2000, Dr. Reinholds billed Brown $600
for a permanent dental crown. Brown never received a crown and never entered
into an agreement to pay for one. He thus declined to pay the bill.
Dr. Reinholds referred the debt to a collection agency, Credit Bureau
Services, the fictitious business name for defendant Stewart Mortensen.
Mortensen or his agents contacted Brown and attempted to collect the debt. When
Brown requested that Mortensen provide proof of the debt, Mortensen sent Brown
a copy of Brown‟s dental chart, as well as the charts of Brown‟s minor children.
In response, Brown informed Mortensen he did not owe any money to Dr.

1 Because plaintiffs appeal from the trial court‟s sustaining of a demurrer, we
take the well-pleaded facts stated in the complaint as true. (Beal Bank, SSB v.
Arter & Hadden, LLP (2007) 42 Cal.4th 503, 505, fn. 1.)
2 Dr. Reinholds, his professional corporation, a fellow dentist‟s professional
corporation, and Reinholds‟s bookkeeper were all originally parties to this action,
but have since been dismissed. For convenience, we refer to this group of
defendants collectively as Dr. Reinholds.

2
Reinholds and the dental charts contained his and his children‟s confidential
medical information.
Over the next two years, Mortensen repeatedly disclosed the contents of
Brown‟s and his children‟s dental charts to the three major national consumer
reporting agencies, Experian, Equifax, and Trans Union. Additionally, Mortensen
disclosed to the agencies the Browns‟ names, Social Security numbers, dates of
birth, addresses, telephone numbers, and Brown‟s and his children‟s entire dental
history with Dr. Reinholds, including alleged dental treatments. Mortensen made
these disclosures for purposes of verifying to the consumer reporting agencies that
a debt was owed, despite the facts that (1) no one contended Brown owed money
for dentistry performed on his children, and (2) Brown had never authorized Dr.
Reinholds or Mortensen to disclose this information to any third parties, including
the three consumer reporting agencies.
From 2001 to 2003, Brown repeatedly but unsuccessfully demanded that
Mortensen cease making unauthorized disclosures. Brown also contacted the
three consumer reporting agencies and informed them the disclosures made by
Mortensen were inaccurate and incomplete. This assertion prompted the agencies
to request that Mortensen provide additional information; in response, Mortensen
disclosed Brown‟s dental history dating back 10 years, despite the fact this history
included detailed information about Brown‟s dental treatments and was irrelevant
to the present dispute over whether Brown owed anything for a permanent dental
crown.
Brown contacted Dr. Reinholds in January 2003 and requested that he
submit signed written instructions to the three consumer reporting agencies
directing them to delete the disclosures of medical information. Dr. Reinholds
declined and instead ratified Mortensen‟s disclosures; Dr. Reinholds also made
further unauthorized disclosures to Equifax.

3
 Brown and his wife, individually and as guardians ad litem for their minor
children, then sued Dr. Reinholds and Mortensen, alleging violations of the
Confidentiality Act (Civ. Code, § 56 et seq.), inter alia. Only the claims against
Mortensen for violation of the Confidentiality Act are at issue; all other claims and
parties have been voluntarily dismissed.
In the third and fourth causes of action of the operative complaint, the
fourth amended complaint, Brown alleges Mortensen‟s disclosure of his and his
children‟s medical information to consumer reporting agencies violated the
Confidentiality Act. Subject to certain exceptions, that act prohibits the
unauthorized dissemination of individually identifiable medical information and
provides for compensatory damages and other remedies. (Civ. Code, §§ 56.10,
56.26, 56.35.) The trial court sustained a demurrer with leave to amend and then,
when Brown elected not to amend, dismissed the action.
The Court of Appeal affirmed. While it rejected the trial court‟s conclusion
that Brown‟s Confidentiality Act claims were impermissibly vague, it accepted
Mortensen‟s alternative argument that the FCRA preempted them. The Court of
Appeal opined that all state law claims arising from the furnishing of information
to consumer reporting agencies are preempted by the FCRA. (See 15 U.S.C.
§ 1681t(b)(1)(F).)3 Reasoning that Mortensen had acted as a furnisher of credit
information when disclosing the Browns‟ medical information to various credit
agencies, the court affirmed dismissal.
We granted review to consider the interplay between state and federal laws
governing credit reporting and the confidentiality of medical information.

3 All further unlabeled statutory references are to title 15 of the United States
Code.

4
 DISCUSSION
I. Preemption Principles
“The supremacy clause of the United States Constitution establishes a
constitutional choice-of-law rule, makes federal law paramount, and vests
Congress with the power to preempt state law.” (Viva! Internat. Voice for Animals
v. Adidas Promotional Retail Operations, Inc. (2007) 41 Cal.4th 929, 935, fn.
omitted; see U.S. Const., art. VI, cl. 2; Cipollone v. Liggett Group, Inc. (1992) 505
U.S. 504, 516.) Congress may exercise that power by enacting an express
preemption provision, or courts may infer preemption under one or more of three
implied preemption doctrines: conflict, obstacle, or field preemption. (See In re
Jose C. (2009) 45 Cal.4th 534, 550.) We consider here a single claim of express
preemption: Mortensen asserts section 1681t(b)(1)(F), a provision of the FCRA,
expressly preempts Brown‟s causes of action alleging violation of the
Confidentiality Act (Civ. Code, § 56 et seq.).
The United States Supreme Court has identified “two cornerstones” of
federal preemption analysis. (Wyeth v. Levine (2009) 555 U.S. 555, ___ [129
S.Ct. 1187, 1194].) First, the question of preemption “ „fundamentally is a
question of congressional intent.‟ ” (In re Tobacco Cases II (2007) 41 Cal.4th
1257, 1265, quoting English v. General Electric Co. (1990) 496 U.S. 72, 79; see
also Wyeth, 555 U.S. at p. ___ [129 S.Ct. at p. 1194] [“ „[T]he purpose of
Congress is the ultimate touchstone in every pre-emption case.‟ ”].) If a statute
“contains an express pre-emption clause, our „task of statutory construction must
in the first instance focus on the plain wording of the clause, which necessarily
contains the best evidence of Congress‟ pre-emptive intent.‟ ” (Sprietsma v.
Mercury Marine (2002) 537 U.S. 51, 62-63; see also Viva! Internat. Voice for
Animals v. Adidas Promotional Retail Operations, Inc., supra, 41 Cal.4th at
p. 939.) “ „Also relevant, however, is the “structure and purpose of the statute as a

5
whole,” [citation] as revealed not only in the text, but through the reviewing
court‟s reasoned understanding of the way in which Congress intended the statute
and its surrounding regulatory scheme to affect business, consumers, and the
law.‟ ” (Olszewski v. Scripps Health (2003) 30 Cal.4th 798, 816, quoting
Medtronic, Inc. v. Lohr (1996) 518 U.S. 470, 486.)
“Second, „[i]n all pre-emption cases, and particularly in those in which
Congress has “legislated . . . in a field which the States have traditionally
occupied,” . . . we “start with the assumption that the historic police powers of the
States were not to be superseded by the Federal Act unless that was the clear and
manifest purpose of Congress.” ‟ ” (Wyeth v. Levine, supra, 555 U.S. at p. ___
[129 S.Ct. at pp. 1194-1195]; see also Viva! Internat. Voice for Animals v. Adidas
Promotional Retail Operations, Inc., supra, 41 Cal.4th at p. 938.) The role of the
presumption against preemption is to “ „provide[] assurance that “the federal-state
balance” [citation] will not be disturbed unintentionally by Congress or
unnecessarily by the courts.‟ ” (Olszewski v. Scripps Health, supra, 30 Cal.4th at
p. 815, quoting Jones v. Rath Packing Co. (1977) 430 U.S. 519, 525.)
The presumption against preemption applies fully in cases considering
whether Congress intended by passage of the FCRA and subsequent amendments
to displace state law. (See, e.g., American Bankers Ass’n. v. Gould (9th Cir. 2005)
412 F.3d 1081, 1086.) State statutory and common law protection of interests in
informational privacy long predates federal regulation. (See Gormley, One
Hundred Years of Privacy (1992) 1992 Wis. L.Rev. 1335, 1353-1357; Prosser,
Privacy (1960) 49 Cal. L.Rev. 383, 386-388, 392-398; Warren & Brandeis, The
Right to Privacy (1890) 4 Harv. L.Rev. 193.) It thus comprises a field
traditionally occupied by the states and, accordingly, the presumption “applies
with particular force here.” (Farm Raised Salmon Cases (2008) 42 Cal.4th 1077,
1088.)

6
 With these principles in mind, we turn to a consideration of preemption
under the FCRA.
II. The Scope of FCRA Preemption
A. The FCRA
“Congress enacted FCRA in 1970 to ensure fair and accurate credit
reporting, promote efficiency in the banking system, and protect consumer
privacy.” (Safeco Insurance Co. v. Burr (2007) 551 U.S. 47, 52; see also
§ 1681(a)(4) [the FCRA was designed to “insure that consumer reporting agencies
exercise their grave responsibilities with fairness, impartiality, and a respect for
the consumer‟s right to privacy”].) Specifically, the FCRA requires consumer
reporting agencies to adopt procedures for ensuring that consumer credit
information is collected, maintained, and dispensed “in a manner which is fair and
equitable to the consumer, with regard to the confidentiality, accuracy, relevancy,
and proper utilization of such information . . . .” (§ 1681(b); see also TRW Inc. v.
Andrews (2001) 534 U.S. 19, 23.)
As originally enacted, the FCRA contained a broad savings clause,
confirming Congress had no intention of displacing state law except to the extent
state law and the FCRA were in irreconcilable conflict.4 As well, the FCRA at
first focused solely on consumer reporting agencies and imposed no duties on
furnishers, i.e., those that provide information to a consumer reporting agency.5

4 Former section 1681t provided: “This title does not annul, alter, affect, or
exempt any person subject to the provisions of this title from complying with the
laws of any State with respect to the collection, distribution, or use of any
information on consumers, except to the extent that those laws are inconsistent
with any provision of this title, and then only to the extent of the inconsistency.”
(FCRA, Pub.L. No. 91-508, § 622 (Oct. 26, 1970) 84 Stat. 1136.)
5 The FCRA does not define the term “furnisher”; instead, its meaning is
inferable from the context of its usage throughout the FCRA.

7
(See Pulver v. Avco Financial Services (1986) 182 Cal.App.3d 622, 633.)
Consequently, consumers remained free to sue furnishers under state law, subject
only to a provision limiting certain state law tort claims to instances where a
defendant had acted maliciously or with the intent to injure. (§ 1681h(e).)6
The Consumer Credit Reporting Reform Act of 1996 (1996 Reform Act)
amended the FCRA in two ways significant to this case. For the first time,
Congress imposed affirmative duties on furnishers. (§ 1681s-2; see Sen.Rep. No.
104-185, 1st Sess., p. 49 (1995) [discussing proposed new section and noting that
“[c]urrently, the FCRA contains no requirements applying to those entities which
furnish information to consumer reporting agencies”].) Additionally, it amended
the savings clause by carving out from the general no-preemption rule a series of
discrete areas in which federal law henceforth would govern to the exclusion of
state law. (§ 1681t(b).)7 One such area is at issue here: that covered by section
1681t(b)(1)(F), relating to the preemption of claims against furnishers.
B. Section 1681t(b)(1)(F) and the Presumption Against Preemption
We begin with the text of section 1681t(b)(1)(F): “(b) No requirement or
prohibition may be imposed under the laws of any State— [¶] (1) with respect to
any subject matter regulated under— [¶] . . . [¶] (F) section 1681s-2 of this title,
relating to the responsibilities of persons who furnish information to consumer
reporting agencies, except that this paragraph shall not apply— [¶] (i) . . .

6 Section 1681h(e) generally limits actions “in the nature of defamation,
invasion of privacy, or negligence” against furnishers to instances where the
defendant furnished false information “with malice or willful intent to injure such
consumer.”
7 While the 1996 Reform Act subjected these preemption provisions to an
eight-year sunset period (Pub.L. No. 104-208, § 2419 (Sept. 30, 1996) 110 Stat.
3009, 3009-453), Congress later made them permanent (Pub.L. No. 108-159,
§ 711 (Dec. 4, 2003) 117 Stat. 2011, amending 15 U.S.C. § 1681t(d)).

8
[¶] (ii) with respect to section 1785.25(a) of the California Civil Code (as in effect
on September 30, 1996).” (Italics added.)
When analyzing an express preemption clause, our task is to “ „identify the
domain expressly pre-empted‟ ” by its language. (Medtronic, Inc. v. Lohr, supra,
518 U.S. at p. 484, quoting Cipollone v. Liggett Group, Inc., supra, 505 U.S. at
p. 517.) The scope of this preemption clause therefore hinges on an interpretation
of what the “subject matter regulated” under section 1681s-2 is.
As noted, section 1681s-2 was enacted to, for the first time, impose certain
affirmative duties on furnishers of information to consumer reporting agencies.
Broadly speaking, section 1681s-2 regulates the actions of furnishers in two areas:
it imposes a duty to provide accurate information (§ 1681s-2(a)), and it dictates
what furnishers must do upon receiving official notice from a consumer reporting
agency of a dispute concerning the completeness or accuracy of information they
have provided (§ 1681s-2(b)). (See Sanai v. Saltz (2009) 170 Cal.App.4th 746,
763-764; Stafford v. Cross Country Bank (W.D.Ky. 2003) 262 F.Supp.2d 776,
782-784.)8
The “subject matter regulated” under section 1681s-2 is ambiguous because
the level of generality at which one is to characterize that subject matter is unclear,
and thus, so is the domain expressly preempted by section 1681t(b)(1)(F).
Characterized most narrowly, section 1681s-2 regulates only two discrete areas:

8 The statute prohibits any person from “furnish[ing] any information
relating to a consumer to any consumer reporting agency if the person knows or
has reasonable cause to believe that the information is inaccurate.” (§ 1681s-
2(a)(1)(A).) Furthermore, if a furnisher receives statutory notice of a “dispute
with regard to the completeness or accuracy of any information,” the furnisher
must investigate and correct incomplete or inaccurate information in a timely
fashion. (§ 1681s-2(b)(1).)

9
what a furnisher must do to ensure the information it provides is accurate (a
subject covered in exhaustive detail by the many subparts of § 1681s-2(a)), and
what a furnisher must do upon receiving official notice that the accuracy or
completeness of its information is in dispute (covered in somewhat less detail by
§ 1681s-2(b)). The operative preemption provision could thus be read as
preempting only state laws that attempt also to regulate a furnisher‟s duties with
respect to accuracy or the handling of disputes after receiving official notice.
Numerous federal district courts have adopted this view. In Stafford v.
Cross Country Bank, supra, 262 F.Supp.2d at pages 785-787, for example, the
court rejected the argument that section 1681t(b)(1)(F) preempted all state law
furnisher claims, rather than only those arising out of the two furnisher duties
actually regulated by section 1681s-2. A contrary interpretation, in the court‟s
view, would “extend [section 1681t(b)(1)(F)] well beyond its express terms.”
(Stafford, at pp. 785-786.) In Pasternak v. Trans Union (N.D.Cal. 2008) 2008
U.S. Dist. Lexis 115442, the district court rejected section 1681t(b)(1)(F)
preemption of a claim that the defendant creditor had failed to properly investigate
and cease collection efforts upon being informed personally by the plaintiff that
she was the victim of identity theft. (See Civ. Code, § 1798.92 et seq.) The court
compared the duty asserted to the precise duties actually regulated by section
1681s-2 and, finding no overlap, allowed the plaintiff to proceed. (Pasternak, at
pp. *10-*12.) In Carlson v. Trans Union, LLC (N.D.Tex. 2003) 259 F.Supp.2d
517, 521-522, the district court rejected preemption of a defamation claim against
a furnisher because the “subject matter” of the claim was “significantly different”
from that regulated by section 1681s-2 (Carlson, at p. 522), reasoning that the duty
at issue in a defamation suit does not overlap with the duties actually addressed in
section 1681s-2. (See also Dornhecker v. Ameritech Corp. (N.D.Ill. 2000) 99
F.Supp.2d 918, 930-931 [on reasoning analogous to that in Carlson, concluding

10
common law claims involving duties not regulated by § 1681s-2 were not
preempted by § 1681t(b)(1)(F)].)
Alternatively, the subject matter of section 1681s-2 could be read more
broadly as encompassing all “[r]esponsibilities of furnishers of information to
consumer reporting agencies,” as the provision is captioned, and thus preempting
any attempt by the several states to enforce laws imposing on furnishers duties
additional to the two specific duties imposed by the section—that is, as embodying
a congressional determination to impose on furnishers these, and only these, duties
and to immunize them from any other legal obligations.
The Court of Appeal, apparently overlooking this ambiguity, assumed the
latter understanding of the subject matter regulated by section 1681s-2 was correct
and thus concluded that “[t]he plain language of section 1681t(b)(1)(F) preempts
state law relating to the duties of furnishers of information to consumer reporting
agencies,” i.e., laws relating to any furnisher duty, not just the two general duties
expressly regulated by the section. In light of the ambiguity, however, we are not
at liberty to assume this reading is correct; instead, we must determine which of
the two plausible readings of section 1681t(b)(1)(F) described above actually hews
most closely to congressional intent.
In making this determination, we are assisted by the strong presumption
against displacement of state law that applies in the preemption context. That
presumption applies not only to the existence, but also to the extent, of federal
preemption. (Farm Raised Salmon Cases, supra, 42 Cal.4th at p. 1088.) Because
of it, “courts should narrowly interpret the scope of Congress‟s „intended
invalidation of state law‟ whenever possible.” (Olszewski v. Scripps Health,
supra, 30 Cal.4th at p. 815, quoting Medtronic, Inc. v. Lohr, supra, 518 U.S. at
p. 485; see also Cipollone v. Liggett Group, Inc., supra, 505 U.S. at p. 518 [the
“presumption reinforces the appropriateness of a narrow reading” of an express

11
preemption provision]; id. at p. 533 (conc. opn. of Blackmun, J.) [“We do not,
absent unambiguous evidence, infer a scope of pre-emption beyond that which
clearly is mandated by Congress‟ language.”].) Indeed, the presumption against
preemption is sufficiently powerful to impose upon courts a “duty to accept the
reading that disfavors pre-emption” as among equally plausible interpretations of
an express preemption clause. (Bates v. Dow Agrosciences LLC (2005) 544 U.S.
431, 449; see also Altria Group, Inc. v. Good (2008) 555 U.S. 70, ___ [129 S.Ct.
538, 543] [“When the text of a pre-emption clause is susceptible of more than one
plausible reading, courts ordinarily „accept the reading that disfavors pre-
emption.‟ ”].)
It follows from the foregoing that absent persuasive evidence Congress
intended more expansive preemption, we must prefer the narrower reading of the
scope of section 1681t(b)(1)(F)‟s preemption clause, the reading that extends
preemption only to state laws relating to furnisher accuracy or dispute resolution.
Relying on certain federal “total preemption” cases, Mortensen argues that
section 1681t(b)(1)(F) preempts all state law claims against furnishers involving
the same general subject matter as section 1681s-2. (See, e.g., Roybal v. Equifax
(E.D.Cal. 2005) 405 F.Supp.2d 1177, 1181-1182; Howard v. Blue Ridge Bank
(N.D.Cal. 2005) 371 F.Supp.2d 1139, 1144; Davis v. Maryland Bank, N.A.
(N.D.Cal. 2002) 2002 U.S. Dist. Lexis 26468, *39-*47.) Although Mortensen has
the burden of establishing preemption (Bronco Wine Co. v. Jolly (2004) 33 Cal.4th
943, 956-957), and thus the burden of demonstrating a “clear and manifest”
congressional intent to preempt (id. at p. 957, italics omitted), his argument offers
little that would support a broader displacement of state law. The total preemption
cases he relies on represent but one of three approaches the federal courts have
taken to reconciling section 1681t(b)(1)(F) with the potentially overlapping sphere
of section 1681h(e), which partially bars and partially permits certain common law

12
claims against furnishers (see ante, fn. 6 and accompanying text), none of which
are at issue here. (Buraye v. Equifax (C.D.Cal. 2008) 625 F.Supp.2d 894, 898;
see, e.g., Carruthers v. Am. Honda Fin. Corp. (N.D.Fla. 2010) 717 F.Supp.2d
1251, 1257-1258 [total preemption approach]; Sites v. Nationstar Mortg. LLC
(M.D.Pa. 2009) 646 F.Supp.2d 699, 708-709 [statutory preemption approach];
Woltersdorf v. Pentagon Federal Credit Union (N.D.Ala. 2004) 320 F.Supp.2d
1222, 1225-1227 [temporal preemption approach].)9 Given the different
preemption question at issue here, we do not find these cases instructive. Nor, for
that matter, do we have occasion here to agree or disagree with either of the two
alternative approaches—statutory and temporal preemption—the federal courts
have taken to reconciling sections 1681t(b)(1)(F) and 1681h(e). Under any of
these approaches, a threshold issue is whether the state law claim involves the
same subject matter as that regulated by section 1681s-2. If the claim does not,
there is no preemption. It is on that point our analysis turns.
Our own inspection of the overall statutory scheme and the pertinent
legislative history reveals evidence suggesting Congress never intended in section
1681t(b)(1)(F) to preempt state laws regulating medical privacy and thereby to
relieve entities otherwise obligated to maintain confidentiality of the duty to do so
when reporting credit information. We find instructive both (1) Congress‟s
passage of HIPAA at the same time as the 1996 Reform Act and (2) the legislative
history of the 1996 Reform Act.

9 The one California case to take a position, Sanai v. Saltz, supra, 170
Cal.App.4th at pages 773-774, follows the total preemption line of cases. We
express no view on Sanai‟s correctness.

13
 C. The Interplay Between the FCRA and HIPAA
“Recognizing the importance of protecting the privacy of health
information in the midst of the rapid evolution of health information systems,
Congress passed HIPAA in August 1996.” (South Carolina Medical Ass’n. v.
Thompson (4th Cir. 2003) 327 F.3d 346, 348; see Pub.L. No. 104-191 (Aug. 21,
1996) 110 Stat. 1936.) Portions of HIPAA were intended to facilitate information
exchange among participants in the health care system (42 U.S.C. §§ 1320d to
1320d-8 (HIPAA §§ 261-262, Pub.L. No. 104-191, § 261-262 (Aug. 21, 1996)
110 Stat. 2021-2031)), but Congress foresaw that with easier transmission of
intimate medical details would come a heightened risk of privacy loss (65
Fed.Reg. 82469 (Dec. 28, 2000); see also Northwestern Memorial Hosp. v.
Ashcroft (7th Cir. 2004) 362 F.3d 923, 928-929 [“the sensitivity that lies behind
HIPAA” is concern for the “natural sensitivity that people feel about the disclosure
of their medical records”]). Accordingly, Congress tasked the federal Department
of Health and Human Services (Department) with recommending privacy
standards for the handling of personal medical information (42 U.S.C. § 1320d-2
note (HIPAA, § 264(a), Pub.L. No. 104-191, § 264(a) (Aug. 21, 1996) 110 Stat.
2033)) and, if no legislation was forthcoming within a specified period, with
promulgating regulations setting forth national medical information privacy
standards (id. (HIPAA, § 264(c)(1), Pub.L. No. 104-191, § 264(c)(1) (Aug. 21,
1996) 110 Stat. 2033)). When Congress failed to agree on legislation, the
Department fulfilled its mandate and issued a wealth of detailed regulations,
commonly known as the “Privacy Rule.” (Stds. for Privacy of Individually
Identifiable Health Information, 65 Fed.Reg. 82462 (Dec. 28, 2000), codified at
45 C.F.R. §§ 160, 164 (2010) [original Privacy Rule]; Stds. for Privacy of
Individually Identifiable Health Information, 67 Fed.Reg. 53182 (Aug. 14, 2002),

14
codified at 45 C.F.R. §§ 160, 164 (2010) [final modifications to the Privacy
Rule].)
Three points about HIPAA and the Privacy Rule are germane here. First, at
the time of HIPAA‟s passage it was expressly contemplated that Congress or the
Department would closely regulate the obligations of health plans, medical
providers, and their agents to maintain patient confidences. (42 U.S.C. § 1320d-2
note (HIPAA, § 264(b), (c)(1), Pub.L. No. 104-191, § 264(b), (c)(1) (Aug. 21,
1996) 110 Stat. 2033); see id., § 1320d-1(a) [identifying entities to be covered by
new standards].) The Privacy Rule does so, defining and restricting the ability of
covered entities to divulge confidential medical information. (See 45 C.F.R.
§ 164.502(a) (2010) [prohibiting use or disclosure of personal health information
except as provided under the Privacy Rule].) The Department‟s regulations
expressly address such matters as the extent to which personal medical
information may be disclosed when seeking payment, including to consumer
reporting agencies. (See id., § 164.506 [permitting disclosure of personal health
information for purposes of payment]; id., § 164.501 [defining payment to include
certain limited disclosures of personal health information to consumer reporting
agencies].)
Second, both HIPAA and the Privacy Rule‟s implementation of it expressly
favor additional, more protective state legislation. Although HIPAA generally
preempts state laws (42 U.S.C. § 1320d-7(a)(1); see 45 C.F.R. § 160.203 (2010)),
Congress carved out a different rule for privacy regulation (42 U.S.C. § 1320d-
7(a)(2)(B)), directing that only conflicting or less stringent state law be preempted,
while more stringent state law be preserved (id., § 1320d-2 note (HIPAA,
§ 264(c)(2), Pub.L. No. 104-191, § 264(c)(2) (Aug. 21, 1996) 110 Stat. 2033-

15
2034); see 45 C.F.R. §§ 160.202, 160.203(b) (2010)).10 As the Department
explained when announcing the Privacy Rule: “It is important to understand this
regulation as a new federal floor of privacy protections that does not disturb more
protective rules or practices. . . . The protections are a mandatory floor, which
other governments and any covered entity may exceed.” (65 Fed.Reg. 82471
(Dec. 28, 2000).)
Third, HIPAA was enacted just one month before the 1996 Reform Act.
While in construing statutes we will always prefer interpretations that harmonize
them with other legislation (Lexin v. Superior Court (2010) 47 Cal.4th 1050,
1095), that canon is particularly appropriate here, where the very same Congress
within a few weeks passed both HIPAA and the 1996 Reform Act. Given their
contemporaneous nature and overlapping privacy concerns, we must when
possible interpret HIPAA and the 1996 Reform Act as a coherent whole.
The 104th Congress could have amended the FCRA to address the scope of
a medical provider‟s duties when furnishing information to a consumer reporting
agency, or it could have addressed it as part of HIPAA. It chose to address it as
part of HIPAA, authorizing the Department to adopt regulations on the subject,
while at the same time inviting the states to continue to regulate to the extent they
desired to enact more stringent, privacy-favoring legislation. (See 42 U.S.C.
§ 1320d-2 note (HIPAA, § 264(c)(1), (2), Pub.L. No. 104-191, § 264(c)(1), (2)
(Aug. 21, 1996) 110 Stat. 2033-2034).) We see no plausible basis for reading into

10 HIPAA section 264(c)(2) provides: “(2) PREEMPTION.—A regulation
promulgated under paragraph (1) shall not supercede a contrary provision of State
law, if the provision of State law imposes requirements, standards, or
implementation specifications that are more stringent than the requirements,
standards, or implementation specifications imposed under the regulation.”
(Pub.L. No. 104-191, § 264(c)(2) (Aug. 21, 1996) 110 Stat. 2033-2034.)

16
sections 1681t(b)(1)(F) and 1681s-2, which are silent on the duties of a furnisher
to preserve medical confidentiality, a clear and manifest congressional intent to
preempt state legislation on that topic, when the same Congress in HIPAA had just
authorized and encouraged further state regulation of such matters. Far more
credible is to assume Congress intended preemption only with respect to the
specific furnisher duties for which it adopted standards in section 1681s-2, while
leaving to other laws and their preemption provisions or savings clauses the task
of articulating additional, more general duties and identifying what the several
states‟ role might be in enacting supplemental legislation.11
D. The Legislative History of the 1996 Reform Act
Additionally, we consider whether anything in the sparse legislative history
of the 1996 Reform Act, of which section 1681t(b)(1)(F) is a part, supports
Mortensen‟s and the Court of Appeal‟s assumption that a broader reading of that
preemption provision clearly was intended.12 Nothing does.
The 1996 Reform Act was the product of years of discussion and
negotiations. (Wu et al., Fair Credit Reporting (7th ed. 2010) p. 16.) On April 6,
1995, Senators Bond and Bryan introduced the Consumer Reporting Reform Act
of 1995 (Sen. No. 709, 104th Cong., 1st Sess. (1995)), a bill based in large part on

11 Congress subsequently confirmed the FCRA‟s subordinate role to HIPAA
on questions of medical privacy when it passed the Fair and Accurate Credit
Transactions Act of 2003. (Pub.L. No. 108-159 (Dec. 4, 2003) 117 Stat. 1952.) It
added the first protections for medical privacy to the FCRA, principally limiting
the ability of consumer reporting agencies to disseminate confidential medical
information. (See §§ 1681b(g)(1), 1681c(a)(6).) At the same time, Congress
subordinated these new provisions to the requirements of HIPAA and the Privacy
Rule. (See § 1681b(g)(3)(B), (6).)
12 As the Ninth Circuit has cautioned, “[t]he legislative history surrounding
§ 1681t(b)(1)(F) is murky . . . .” (Gorman v. Wolpoff & Abramson, LLP (9th Cir.
2009) 584 F.3d 1147, 1172.)

17
earlier legislative efforts that had narrowly missed enactment. Senator Bond
described the measure as providing “limited Federal preemption to ensure that
there are uniform Federal standards to govern a number of procedural issues which
are part of credit reporting and which will reduce the burdens on the credit
industry from having to comply with a variety of different State requirements.”
(Remarks of Sen. Bond, 141 Cong. Rec. S5450 (daily ed. Apr. 6, 1995).) Senator
Bryan assured that the bill “tried to only preempt those areas of this law which
affect the operational efficiencies of businesses but do not harm consumers,” and
that it was not intended to “preempt States‟ rights in the area of liability.”
(Remarks of Sen. Bryan, 141 Cong. Rec. S5450 (daily ed. Apr. 6, 1995).)
Preemption was appropriate only in order to set “a national uniform standard” on
matters such as “disclosure forms or timetables”; such limited preemption would
“not set the consumer movement back, yet should help the business community
operate more efficiently.” (Ibid.)
The Senate Committee on Banking, Housing, and Urban Affairs‟s
subsequent report on the bill reflected the same understanding. (Sen.Rep. No.
104-185, 1st Sess. (1995).)13 The committee explained the new preemption
provisions were intended to ensure the FCRA stood “as the national uniform
standard in these [preempted] areas.” (Sen.Rep. No. 104-185, at p. 55.) The
committee made equally clear that broad field preemption was not intended:
“Additionally, the Committee understands that states have the power to protect
their own citizens, including protection from abuses in the credit reporting
industry. Therefore, the FCRA, as amended by the Committee bill[,] will not

13 Technically, the report is on Senate Bill No. 650 (104th Cong., 1st Sess.
(1995)), to which the substance of the Bryan-Bond bill was added by a December
1995 amendment.

18
infringe upon the rights of states to legislate more stringent requirements that fall
outside the scope of those areas specifically preempted to the extent such
requirements are not inconsistent with any provisions of the FCRA.” (Id. at p. 56.)
To the extent these remarks shed light on the intent behind section
1681t(b), they suggest Congress intended preemption only in a few discrete areas
where it had in fact adopted a standard intended to serve as a uniform national
standard. (See Watkins v. Trans Union, L.L.C. (N.D.Ala. 2000) 118 F.Supp.2d
1217, 1222 [the legislative history behind § 1681t(b) supports only “discrete” and
“sharply drawn” areas of preemption].) Given this history, it seems more
plausible that section 1681t(b)(1)(F) was intended to preempt only those areas
governing furnishers where Congress had adopted an actual standard, i.e., for
furnisher accuracy in submitting information and furnisher responsiveness in
reacting to disputes, than that the section was, in an act of mini-field preemption,
intended to preempt all state laws implicating any duty that could have been
regulated by section 1681s-2 but was not.
In short, nothing in the legislative history evinces a clear and manifest
congressional intent to displace state law more broadly.

E. The Import of Section 1681t(b)(1)(F)’s Express Exclusion
from Preemption of Specific State Statutes
Mortensen offers one textual argument in support of his construction of
section 1681t(b)(1)(F). The provision selects out two specific state statutes for
exclusion from preemption. (See § 1681t(b)(1)(F)(i), (ii) [saving Mass. Ann.
Laws ch. 93, § 54A(a) and Cal. Civ. Code, § 1785.25, subd. (a)].) It follows,
Mortensen argues, that under the principle of expressio unius est exclusio alterius
other state laws, including the Confidentiality Act (Civ. Code, § 56 et seq.), are
not saved from preemption.

19
 The argument is flawed. That Congress saved two state statutes from
preemption evinces an intent to save those particular statutes in light of an
understanding that in the absence of an exemption the statutes would have been
subject to a colorable claim of preemption.14 As Mortensen correctly surmises,
other state statutes involving the same subject matter as section 1681s-2, but not
specially exempted, are preempted. But the argument begs the point. Congress
obviously did not need to, and did not, specially exempt from preemption any of
the thousands of state statutes further afield that do not touch on the same subject
matter as section 1681s-2. It is that issue—whether claims under the
Confidentiality Act involve the same subject matter as section 1681s-2—that is
dispositive here.
For all the foregoing reasons, we conclude section 1681t(b)(1)(F) preempts
state law claims only insofar as they arise out of a requirement or prohibition with
respect to the specific furnisher duties regulated by section 1681s-2, i.e., the duties
to provide accurate information and to take action upon being notified of a dispute.
We turn to whether the claims in Brown‟s operative complaint do so.

III. Application of Section 1681t(b)(1)(F) Preemption to Brown’s
Confidentiality Act Claims
A. Overview of the Confidentiality Act
The Confidentiality Act (Civ. Code, § 56 et seq.) “is intended to protect the
confidentiality of individually identifiable medical information obtained from a

14 Unlike the Confidentiality Act, the two statutes saved by section
1681t(b)(1)(F) each specifically regulate furnishers and do so in a manner “nearly
identical” to section 1681s-2. (Gorman v. Wolpoff & Abramson, LLP, supra, 584
F.3d at p. 1172.) Thus, in the absence of a savings clause, Congress might
reasonably have been concerned that a court could find them preempted even
under the narrower plausible understanding of the subject matter regulated by
section 1681s-2.

20
patient by a health care provider, while at the same time setting forth limited
circumstances in which the release of such information to specified entities or
individuals is permissible.” (Loder v. City of Glendale (1997) 14 Cal.4th 846,
859; see Heller v. Norcal Mutual Ins. Co. (1994) 8 Cal.4th 30, 38.)
Civil Code sections 56.10, subdivision (a) (applicable to health care
providers) and 56.26, subdivision (a) (applicable to third party administrators)
establish the basic prohibition against disclosure of a patient‟s medical
information. “The basic scheme of the [Confidentiality Act], as amended in 1981,
is that a provider of health care must not disclose medical information without a
written authorization from the patient.” (Pettus v. Cole (1996) 49 Cal.App.4th
402, 425.) “The „authorization‟ requirements, which are found in section 56.11,
are detailed and demanding, reflecting the Legislature‟s interest in assuring that
medical information may be disclosed only for a narrowly defined purpose, to an
identified party, for a limited period of time.” (Id. at p. 426.) Alternatively,
disclosure will be permitted if the provider “can show that the disclosure is
excepted either by the mandatory (§ 56.10, subd. (b)) or permissive (§ 56.10[,
subd. (c)]) provisions of the act, allowing disclosure of medical information under
specified circumstances.” (Heller v. Norcal Mutual Ins. Co., supra, 8 Cal.4th at
p. 38.)15
It follows that “in order to violate the [Confidentiality Act], a provider of
health care must make an unauthorized, unexcused disclosure of privileged

15 Contrary to anything Brown may have asserted at oral argument, nothing in
the Confidentiality Act limits the procedural avenues available to medical
professionals and their agents to pursue unpaid debts for their services. Nor are
such professionals precluded from reporting the existence of a debt to consumer
reporting agencies. (See 45 C.F.R. §§ 164.501, 164.506 (2010).) The Act speaks
only to limits on the disclosure of medical information.

21
medical information.” (Heller v. Norcal Mutual Ins. Co., supra, 8 Cal.4th at
p. 38.) Notably, the interest protected is an interest in informational privacy, not
informational accuracy; a plaintiff need not show the disclosure was false or
misleading. Indeed, the invasion of a privacy interest is all the more pronounced
precisely because the disclosed information is true and may accurately reveal
intimate details the patient had a right to expect were to be maintained in
confidence. (See Hill v. National Collegiate Athletic Assn., supra, 7 Cal.4th at
p. 41 [“ „A person‟s medical profile is an area of privacy infinitely more intimate,
more personal in quality and nature than many areas already judicially recognized
and protected.‟ ”]; Cutter v. Brownbridge (1986) 183 Cal.App.3d 836, 842 [“The
„zones of privacy‟ ” protected by Cal. Const., art. I, § 1 “extend to the details of
one‟s medical history.”]; Stats. 1981, ch. 782, § 1, p. 3040 [declaring a patient‟s
right to expect that medical information be maintained in confidentiality].)
B. The Third and Fourth Causes of Action
As in Carlson v. Trans Union, LLC, supra, 259 F.Supp.2d at pages 521-
522, we determine whether state law claims are preempted by section
1681t(b)(1)(F) by comparing whether “the substance of [the] claim” (Carlson, at
p. 521)—its elements—overlaps with or is distinct from the matters regulated
under section 1681s-2. (See also Cipollone v. Liggett Group, Inc., supra, 505 U.S.
at pp. 524-530 [analyzing whether state claims impose a preempted requirement or
prohibition by examining the duties underlying each cause of action].)
The third and fourth causes of action in the operative complaint allege, on
behalf of Brown‟s two minor children and Brown himself, that Mortensen made
unauthorized disclosures of the Browns‟ confidential medical information to three
consumer reporting agencies. The Browns allege Mortensen disclosed to
Experian, Equifax, and Trans Union their names, Social Security numbers, dates
of birth, addresses, telephone numbers, and Brown‟s and his children‟s entire

22
dental history with Dr. Reinholds, including alleged dental treatments. (See Civ.
Code, § 56.05, subd. (g) [defining individually identifiable medical information as
information “regarding a patient‟s medical history” in combination with a name,
address, telephone number, or similar detail that “reveals the individual‟s
identity”].) Brown never authorized Dr. Reinholds or Mortensen to disclose this
information to any third party, including the three consumer reporting agencies.
Mortensen argues these claims are preempted because the operative
complaint mentions Brown complained to the consumer reporting agencies that
the disclosures were inaccurate and, alternatively, because the Browns‟ claims rest
on the idea that Mortensen misled the consumer reporting agencies by implying
either that Brown‟s children owed a debt or that their medical records were in
some way relevant to Brown‟s disputed debt. According to Mortensen, this
allegation and these theories bring the claims within section 1681s-2(a)‟s
regulation of furnisher accuracy and thus section 1681t(b)(1)(F)‟s preemptive
scope.
This contention mistakes the nature of a Confidentiality Act claim, both in
the abstract and as pleaded.16 As noted ante, that the information disclosed was
inaccurate is not an element of a claim: the Confidentiality Act (Civ. Code, § 56
et seq.) requires only that the disclosure, whether true or not, occurred without
authorization. The third and fourth causes of action repeatedly allege the
disclosures occurred, were unauthorized, and injured the Browns. It will not be
any part of Brown‟s required proof to show the disclosures were inaccurate or

16 It also mistakes the nature of the preemption inquiry here. What matters
are not extraneous allegations in a complaint, but whether the pleaded claims rest
upon state law duties foreclosed by federal law. (See, e.g., Cipollone v. Liggett
Group, Inc., supra, 505 U.S. at pp. 524-530.)

23
misleading as well.17 Nor does the complaint establish that any of Mortensen‟s
disclosures were made in the course of responding to official notice of a credit
information dispute, such that section 1681s-2(b) would apply. Accordingly, these
claims as pleaded, having as their gravamen issues neither of accuracy nor of
credit dispute resolution, do not involve the same subject matter as section 1681s-
2 and are not preempted.
DISPOSITION
For the foregoing reasons, we reverse the Court of Appeal‟s judgment and
remand this case for further proceedings consistent with this opinion.

WERDEGAR, J.
WE CONCUR:
CANTIL-SAKAUYE, C. J.
KENNARD, J.
BAXTER, J.
CHIN, J.
CORRIGAN, J.
IRION, J.*

17 Likewise, any relief Brown might obtain in this case will be confined to
remedying harm from loss of privacy; remediation of any harm arising from
alleged inaccuracies in the information Mortensen reported could come only from
claims under laws governing the accuracy of furnished information (e.g., Civ.
Code, § 1785.25, subd. (a); see Sanai v. Saltz, supra, 170 Cal.App.4th at pp. 776-
778; Gorman v. Wolpoff & Abramson, LLP, supra, 584 F.3d at pp. 1169-1173),
and no such claim has been pleaded here.
* Associate Justice of the Court of Appeal, Fourth Appellate District,
Division One, assigned by the Chief Justice pursuant to article VI, section 6 of the
California Constitution.

24
See next page for addresses and telephone numbers for counsel who argued in Supreme Court.

Name of Opinion Brown v. Mortensen
__________________________________________________________________________________

Unpublished Opinion
Original Appeal
Original Proceeding
Review Granted XXX 181 Cal.App.4th 789
Rehearing Granted

__________________________________________________________________________________

Opinion No. S180862
Date Filed: June 16, 2011
__________________________________________________________________________________

Court: Superior
County: Los Angeles
Judge: Anthony J. Mohr

__________________________________________________________________________________

Counsel:

Law Offices of Robert A. Brown, Robert A. Brown, Law Offices of Lyle F. Middleton and Lyle F.
Middleton for Plaintiffs and Appellants.

Arielle Cohen, Chi Chi Wu; Seth E. Mermin; and Elizabeth De Armond for National Consumer Law
Center, Public Good, Privacy Rights Clearinghouse, Privacy Activism, The World Privacy Forum and
National Association of Consumer Advocates as Amici Curiae on behalf of Plaintiffs and Appellants.

Carlson & Messer, David J. Kaminski, Stephen A. Watkins and Charles R. Messer for Defendant and
Respondent.
Counsel who argued in Supreme Court (not intended for publication with opinion):

Robert A. Brown
Law Offices of Robert A. Brown
633 West 5th Street, 28th Floor
Los Angeles, CA 90071
(213) 596-5992

Charles R. Messer
Carlson & Messer
5959 West Century Boulevard, Suite 1214
Los Angeles, CA 90045
(310) 242-2200