Case: 12-12593 Date Filed: 04/09/2013 Page: 1 of 13
[PUBLISH]
IN THE UNITED STATES COURT OF APPEALS
FOR THE ELEVENTH CIRCUIT
________________________
No. 12-12593
________________________
D. C. Docket No. 4:11-cv-00400-RS-CAS
OPIS MANAGEMENT RESOURCES LLC,
RULEME CENTER LLC,
GULF COAST HEALTHCARE LLC,
SA-PG-JACKSONVILLE LLC,
SA-PG-SUN CITY CENTER LLC, et al.,
Plaintiffs-Appellees,
versus
SECRETARY FLORIDA AGENCY FOR
HEALTH CARE ADMINISTRATION,
Defendant-Appellant.
________________________
Appeal from the United States District Court
for the Northern District of Florida
_________________________
(April 9, 2013)
Before DUBINA, Chief Judge, BLACK and ALARCÓN, * Circuit Judges.
*
Honorable Arthur L. Alarcón, United States Circuit Judge for the Ninth Circuit, sitting by
designation.
Case: 12-12593 Date Filed: 04/09/2013 Page: 2 of 13
BLACK, Circuit Judge:
The issue before us is whether § 400.145 of the Florida Statutes—which
provides for the release of medical records of deceased residents of nursing homes
to certain specified individuals—is preempted by the federal Health Insurance
Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d to d-9,
and its implementing regulations. As it stands, § 400.145 and HIPAA cannot be
reconciled, and we agree with the district court that the Florida statute stands as an
obstacle to the accomplishment and execution of the full purposes and objectives
of HIPAA in keeping an individual’s protected health information strictly
confidential. Accordingly, we affirm.
I. BACKGROUND
The underlying facts are not in dispute. Plaintiffs-Appellees OPIS
Management Resources, LLC; Ruleme Center, LLC; Gulf Coast Healthcare, LLC;
SA-PG-Jacksonville, LLC; SA-PG-Sun City Center, LLC; Cypress Health Group,
LLC; and Consulate Health Care, LLC (collectively the Nursing Facilities or the
Facilities) are operators and managers of skilled nursing facilities in Florida. In the
course of their operations, the Nursing Facilities received requests from spouses
and attorneys-in-fact for the medical records of deceased nursing home residents.
The Facilities refused to disclose the records because the parties requesting them
were not “personal representatives” under the relevant provisions of HIPAA,
2
Case: 12-12593 Date Filed: 04/09/2013 Page: 3 of 13
which regulates the release of protected health information by covered entities. 1
See 45 C.F.R. § 164.502.2 Consequently, the requesting parties filed complaints
with the U.S. Department of Health and Human Services Office for Civil Rights,
which concluded the Nursing Facilities’ actions were consistent with HIPAA.
Defendant-Appellant Florida Agency for Health Care Administration (the
State Agency), however, issued citations to the Nursing Facilities for violating
Florida law by refusing to release the records. Specifically, the Facilities were
cited for violating § 400.145 of the Florida Statutes, which requires licensed
nursing homes to release a former resident’s medical records to the spouse,
guardian, surrogate, or attorney-in-fact of any such resident. See Fla. Stat.
§ 400.145(1). In written correspondence to individuals who had requested and
been denied deceased residents’ medical records, the State Agency explained that
it interprets § 400.145 in a manner allowing a spouse to qualify as a personal
representative such that a deceased spouse’s medical records may be disclosed
under HIPAA.
Given the dueling interpretations of the relevant statutes, the Nursing
Facilities filed a complaint in the district court seeking a declaratory judgment that
1
The parties do not dispute that the Nursing Facilities are covered entities.
2
We note that various amendments to the Code of Federal Regulations relating to
HIPAA became effective March 26, 2013, while this appeal was pending. The amendments,
however, are largely immaterial to the issue before us, except for the addition of 45 C.F.R.
§ 164.510(b), which we discuss in further detail below.
3
Case: 12-12593 Date Filed: 04/09/2013 Page: 4 of 13
§ 400.145 is preempted by HIPAA. 3 The parties then filed cross-motions for
summary judgment. In ruling on the motions, the district court found that
§ 400.145 was preempted because it impeded the accomplishment and execution of
HIPAA’s purposes and objectives. The court granted the Nursing Facilities’
motion for summary judgment, explaining that the Florida statute affords nursing
home residents less protection than is required by the federal law. This appeal
followed.
II. STANDARD OF REVIEW
We review the district court’s grant of summary judgment de novo, viewing
the evidence and drawing all reasonable inferences in the light most favorable to
the nonmoving party. Fresenius Med. Care Holdings, Inc. v. Tucker, 704 F.3d
935, 939 (11th Cir. 2013).
III. DISCUSSION
The State Agency contends the district court erred in granting summary
judgment to the Nursing Facilities because § 400.145 does not impede the goals
and purposes of HIPAA. Instead, laws such as § 400.145 play a vital role in the
federal statute’s requirements, which look to state law to define the category of
3
In Claim Two, the Nursing Facilities also sought injunctive relief. The Facilities,
however, successfully moved to dismiss the claim following the district court’s grant of partial
summary judgment, and that claim is not before us on appeal.
4
Case: 12-12593 Date Filed: 04/09/2013 Page: 5 of 13
“personal representatives” to whom a deceased individual’s protected health
information may be disclosed.
We begin our analysis with the bedrock principle that the Constitution
designates the laws of the United States as the supreme law of the land, requiring
that “all conflicting state provisions be without effect.” Maryland v. Louisiana,
451 U.S. 725, 746, 101 S. Ct. 2114, 2128–29 (1981); see also U.S. Const. art. VI,
cl. 2. Accordingly, where state and federal law directly conflict, “state law must
give way.” PLIVA, Inc. v. Mensing, 131 S. Ct. 2567, 2577 (2011). In addition,
“[t]here is no doubt that Congress may withdraw specified powers from the States
by enacting a statute containing an express preemption provision.” Arizona v.
United States, 132 S. Ct. 2492, 2500–01 (2012). As the Supreme Court has
explained, “[w]hen a federal law contains an express preemption clause, we focus
on the plain wording of the clause,” as the plain language of the text is “the best
evidence of Congress’ preemptive intent.” Chamber of Commerce of U.S. v.
Whiting, 131 S. Ct. 1968, 1977 (2011) (internal quotation omitted). Nevertheless,
“when the text of a pre-emption clause is susceptible of more than one plausible
reading, courts ordinarily accept the reading that disfavors pre-emption.” Altria
Grp., Inc. v. Good, 555 U.S. 70, 77, 129 S. Ct. 538, 543 (2008) (internal quotation
omitted).
5
Case: 12-12593 Date Filed: 04/09/2013 Page: 6 of 13
In drafting HIPAA, Congress included an express preemption provision. 42
U.S.C. § 1320d-7. HIPAA’s preemption clause provides that the statute “shall
supersede any contrary provision of State law,” and lists certain exceptions that are
not at issue here. Id. § 1320d-7(a). A state law is “contrary” to HIPAA if:
(1) A covered entity or business associate would find it impossible to
comply with both the State and Federal requirements; or
(2) The provision of State law stands as an obstacle to the
accomplishment and execution of the full purposes and objectives
of . . . section 264 of Public Law 104-191. . . .
45 C.F.R. § 160.202. HIPAA, however, does not preempt state laws that provide
“more stringent” privacy protections. See id. § 160.203(b).
One of Congress’s objectives in enacting HIPAA was to address concerns
about the confidentiality of patients’ individually identifiable health information.
See Health Insurance Portability and Accountability Act of 1996, Pub. L. No.
104-191, § 264, 110 Stat. 1936; see also S.C. Med. Ass’n v. Thompson, 327 F.3d
346, 348, 354 (4th Cir. 2003) (“Recognizing the importance of protecting the
privacy of health information in the midst of the rapid evolution of health
information systems, Congress passed HIPAA in August 1996.”). To that end,
Congress provided for the Secretary of Health and Human Services to promulgate
privacy regulations addressing individuals’ rights to individually identifiable health
information, procedures for exercising such rights, and the uses and disclosures of
such information. Pub. L. No. 104-191, § 264(b) & (c)(1); S.C. Med. Ass’n, 327
6
Case: 12-12593 Date Filed: 04/09/2013 Page: 7 of 13
F.3d at 349. In compliance with the statute, the Department of Health and Human
Services issued final regulations known as the “Privacy Rule.” S.C. Med. Ass’n,
327 F.3d at 349; see also Citizens for Health v. Leavitt, 428 F.3d 167, 172–74 (3d
Cir. 2005) (detailing the history of the Privacy Rule’s promulgation and explaining
its requirements). The Privacy Rule establishes that “[a] covered entity or business
associate may not use or disclose protected health information,” except in certain
circumstances not at issue here, or with valid authorization. 45 C.F.R.
§§ 164.502(a), 164.508(a)(1). Among the disclosures permitted by the Privacy
Rule are disclosures to the individual whose information is being protected, as well
as disclosures to the individual’s personal representative. Id. § 164.502(a)(1)(i),
(g)(1) (“[A] covered entity must . . . treat a personal representative as the
individual for purposes of this subchapter.”).
As of March 26, 2013, “[a] covered entity must comply with the
requirements of [the Privacy Rule] with respect to the protected health information
of a deceased individual for a period of 50 years following the death of the
individual.” Id. § 164.502(f). 4 Regarding deceased individuals, the Privacy Rule
further specifies that:
If under applicable law an executor, administrator, or other person has
authority to act on behalf of a deceased individual or of the
individual’s estate, a covered entity must treat such person as a
4
Prior to March 26, 2013, § 164.502(f) did not contain any time limitation with respect to
the disclosure of a deceased individual’s protected health information.
7
Case: 12-12593 Date Filed: 04/09/2013 Page: 8 of 13
personal representative under this subchapter, with respect to
protected health information relevant to such personal representation.
Id. § 164.502(g)(4). 5 Also as of March 26, 2013, if an individual is deceased,
a covered entity may disclose to a family member, or [other relatives,
close personal friends of the individual, or any other persons
identified by the individual] who were involved in the individual’s
care or payment for health care prior to the individual’s death,
protected health information of the individual that is relevant to such
person’s involvement, unless doing so is inconsistent with any prior
expressed preference of the individual that is known to the covered
entity.
Id. § 164.510(b)(5).
Since 1987—nearly a decade before Congress enacted HIPAA—Florida law
has required licensed nursing homes to disclose deceased residents’ medical
records to certain individuals who request them. See Fla. Stat. § 400.145; see also
1987 Fla. Sess. Law Serv. 87-302. Specifically, § 400.145 provides that:
Unless expressly prohibited by a legally competent resident, any
nursing home licensed pursuant to this part shall furnish to the spouse,
guardian, surrogate, proxy, or attorney in fact . . . of a current
resident, . . . or of a former resident, . . . a copy of that resident’s
records which are in the possession of the facility. Such records shall
include medical and psychiatric records and any records concerning
the care and treatment of the resident performed by the facility, except
progress notes and consultation report sections of a psychiatric nature.
Copies of such records shall not be considered part of a deceased
resident’s estate and may be made available prior to the administration
of an estate, upon request, to the spouse, guardian, surrogate, proxy,
or attorney in fact . . . .
Fla. Stat. § 400.145(1).
5
We read “applicable law” to mean state law.
8
Case: 12-12593 Date Filed: 04/09/2013 Page: 9 of 13
The State Agency’s argument against preemption hinges on the Privacy
Rule’s mandate that any person who has authority to act on behalf of a deceased
individual under state law be treated as a personal representative. See 45 C.F.R.
§ 164.502(g)(4). This is important because an individual’s personal representative
enjoys the same broad access to protected information and freedom from the
Privacy Rule’s strictures as the individual. See 45 C.F.R. § 164.502(g)(1).
According to the State Agency, § 400.145 enumerates groups of people, including
spouses, who may access a deceased resident’s medical records “on behalf of” the
resident, meaning that they should be treated as personal representatives. Thus,
rather than conflicting with HIPAA and the Privacy Rule, § 400.145 supplements
and works in tandem with the federal law.
The fatal flaw in the State Agency’s argument is that the plain language of
§ 400.145 does not empower or require an individual to act on behalf of a deceased
resident. The unadorned text of the state statute authorizes sweeping disclosures,
making a deceased resident’s protected health information available to a spouse or
other enumerated party upon request, without any need for authorization, for any
conceivable reason, and without regard to the authority of the individual making
the request to act in a deceased resident’s stead. See 45 C.F.R. § 164.502(g)(4)
(providing that a person authorized to act on behalf of a deceased individual must
be treated as a personal representative “with respect to protected health information
9
Case: 12-12593 Date Filed: 04/09/2013 Page: 10 of 13
relevant to such personal representation” (emphasis added)). We therefore agree
with the district court that § 400.145 frustrates the federal objective of limiting
disclosures of protected health information, and that the statute is thus preempted
by the more stringent privacy protections of HIPAA and the Privacy Rule.
The State Agency’s contention that 45 C.F.R. § 164.510(b)(5) saves
§ 400.145 suffers from the same problem. While § 164.510(b)(5) authorizes
covered entities to release a deceased individual’s protected health information to
family members or other individuals, the regulation does not open a broad new
avenue of access to protected health information, as the State Agency contends.
Instead, § 164.510(b)(5) permits covered entities to release a deceased individual’s
protected health information in narrowly delineated circumstances. First, the
regulation applies only to two groups of people: (1) those involved in the deceased
individual’s health care, and (2) those who paid for the deceased individual’s
health care. Second, covered entities may release only protected health
information that is relevant to such person’s involvement, i.e., information that is
relevant to the care of the deceased individual or to the payment of the deceased
individual’s health care. Section 400.145, by comparison, contains no such
limitations or restrictions.
The State Agency’s reliance on Alvista Healthcare Center, Inc. v. Miller,
686 S.E.2d 96 (Ga. 2009), is also unavailing. In Alvista, the widow of a deceased
10
Case: 12-12593 Date Filed: 04/09/2013 Page: 11 of 13
nursing home resident requested copies of her late husband’s medical records to
investigate a potential action for wrongful death. Id. at 97. After the requests were
denied, the widow sued the operator of the nursing home. Id. The Georgia
Supreme Court held that a provision of state law, O.C.G.A. § 31-33-2, authorized a
surviving spouse “to act on behalf of the decedent or his estate in obtaining
medical records and, therefore, that the surviving spouse [was] entitled to access
the decedent’s protected health information in accordance with 45 C.F.R.
§ 164.502(g)(4).” Id.
Central to the Georgia Supreme Court’s resolution of the case was the fact
that, in 2006, the Georgia legislature specifically amended § 31-33-2 to comply
with HIPAA. See id. at 98. The legislature addressed HIPAA and the Privacy
Rule by requiring any request for medical records by an individual specified in the
statute be accompanied by an authorization that comported with HIPAA and its
implementing regulations. Id. In addition, the Georgia statute was amended to
provide a hierarchy of individuals who could submit an authorization and thus act
on behalf of a decedent or his estate, with the first priority given to an
administrator or executor, and a surviving spouse receiving authority only in the
absence of an administrator or executor. Id. Thus, it was clear that the statute
treated a surviving spouse “as a personal representative in lieu of the executor or
administrator with respect to requests for medical records.” Id. The Georgia
11
Case: 12-12593 Date Filed: 04/09/2013 Page: 12 of 13
Supreme Court emphasized that the limited personal representation created by
§ 33-31-2 did not extend to any context other than obtaining a decedent’s medical
records, and that the statute was “carefully tailored” to provide the authority
contemplated by the Privacy Rule. Id.
Unlike the situation in Alvista, the Florida legislature has not amended or
modified § 400.145 to address the impact of HIPAA and its implementing
regulations. Section 400.145 does not require a HIPAA-compliant authorization to
accompany a request for a deceased individual’s medical records, nor can the
statute plausibly be read as creating a limited personal representation in the person
of a surviving spouse in light of the blanket disclosures that it requires. Given the
opportunity, we are confident the Florida legislature could bring § 400.145 into
compliance with federal law in any number of ways. Amending the statute,
however, is a task for the state legislature, not a panel of federal judges.
Finally, we emphasize that we have no occasion to address the State
Agency’s argument that it is possible to comply with both HIPAA and § 400.145
because 45 C.F.R. § 164.512(a)(1) permits a covered entity to use and disclose
protected health information as “required by law.” 6 The State Agency did not
advance this argument before the district court, and we decline to consider it for
6
Section 164.512(a)(1) provides that “[a] covered entity may use or disclose protected
health information to the extent that such use or disclosure is required by law and the use or
disclosure complies with and is limited to the relevant requirements of such law.”
12
Case: 12-12593 Date Filed: 04/09/2013 Page: 13 of 13
the first time on appeal. See, e.g., Access Now, Inc. v. Sw. Airlines, Co., 385 F.3d
1324, 1331 (11th Cir. 2004) (“This Court has repeatedly held that an issue not
raised in the district court and raised for the first time in an appeal will not be
considered by this [C]ourt.” (quotations omitted)).7 Thus, nothing that we have
said should be inferred as expressing an opinion regarding the “required by law”
provision.
IV. CONCLUSION
For the foregoing reasons, we agree with the district court that § 400.145 of
the Florida Statutes impedes the accomplishment and execution of the full
purposes and objectives of HIPAA and the Privacy Rule in keeping an individual’s
protected health information confidential. Accordingly, the district court’s grant of
summary judgment is AFFIRMED.
7
Although the State Agency cited § 164.512 in its motion for summary judgment, it did
so in support of its argument that § 400.145 is more stringent than the Privacy Rule. The State
Agency did not raise the argument it presents on appeal, i.e., that § 164.512 provides a separate,
independent means of harmonizing federal and state law. Accordingly, the specific argument
advanced on appeal was not sufficiently raised before the district court and we will not address
it. See Bryant v. Jones, 575 F.3d 1281, 1308 (11th Cir. 2009) (“It is well established in this
circuit that, absent extraordinary circumstances, legal theories and arguments not raised squarely
before the district court cannot be broached for the first time on appeal.”).
13