Planned Parenthood of Indiana v. Carter

854 N.E.2d 853 (2006)

PLANNED PARENTHOOD OF INDIANA, Appellant-Plaintiff,
v.
Steve CARTER, in his official capacity as Attorney General of the State of Indiana, and Allen K. Pope, in his official capacity as Director, Indiana Medicaid Fraud Control Unit, Appellees-Defendants.

No. 49A02-0505-CV-469.

Court of Appeals of Indiana.

September 22, 2006.

Kenneth J. Falk, ACLU of Indiana, Indianapolis, IN, Roger K. Evans, Mimi Liu, Planned Parenthood Federation of America, Inc., New York, NY, Attorneys for Appellant.

Steve Carter, Attorney General of Indiana, Thomas M. Fisher, Solicitor General, Indianapolis, IN, Attorneys for Appellees.

OPINION

CRONE, Judge.

Case Summary

The Indiana Medicaid Fraud Control Unit ("IMFCU") is investigating a complaint that Planned Parenthood of Indiana ("PPI") neglected seventy-three of its minor patients by allegedly failing to report child sexual abuse as required by Indiana law. PPI asked the trial court to enjoin IMFCU's demand for unlimited access to its minor patients' medical records, claiming that IMFCU's demand is both unlawful and unconstitutional. The trial court denied PPI's motion for preliminary injunction, and PPI appealed.

In this appeal, we must answer the following questions: (1) whether granting PPI's request to enjoin IMFCU's investigation would violate the separation of powers doctrine; (2) whether IMFCU is authorized by statute to investigate a complaint of patient neglect in a health care facility based on an alleged failure to report child sexual abuse as required by Indiana law; (3) whether IMFCU's demand for unlimited access to PPI's minor patients' medical records violates PPI's Fourth Amendment right against unreasonable searches and seizures; (4) whether PPI has standing to raise a Fourteenth Amendment informational privacy claim on behalf of its minor patients; (5) if so, whether those patients have a constitutional right to privacy in the information contained in their medical records; (6) and, if so, we must balance that right against IMFCU's interest in investigating complaints of patient neglect to determine whether PPI has a reasonable likelihood of proving at trial that granting IMFCU's demand for unlimited access to its minor patients' medical records would violate the patients' constitutional privacy rights.

We answer those questions as follows: (1) enjoining IMFCU's investigation would not violate the separation of powers doctrine; (2) IMFCU is authorized by statute to conduct its investigation; (3) PPI's Fourth Amendment claim is therefore unsuccessful; (4) PPI has standing to raise a Fourteenth Amendment informational privacy claim on behalf of its minor patients; (5) those patients have a limited constitutional right to privacy in their medical records; and (6) in balancing that right against IMFCU's interest in investigating complaints of patient neglect, we conclude that PPI has demonstrated a reasonable likelihood of proving at trial that granting IMFCU's demand for unlimited access to the medical records of PPI's minor patients would violate the patients' constitutional privacy rights. We acknowledge the significant public interest in investigating complaints of patient neglect and allegations of child sexual abuse, but granting IMFCU's demand for unlimited access to PPI's minor patients' medical records is neither the only, nor the most effective, nor the least intrusive means of serving those interests. We therefore reverse the trial court's denial of PPI's motion for preliminary injunction and remand for further proceedings.

On remand, the trial court shall immediately enter a preliminary injunction in favor of PPI against IMFCU's demand for unlimited access to its patients' medical records, and IMFCU shall immediately deliver any medical records currently in its possession to the trial court under seal pending resolution of the trial on the merits of PPI's informational privacy claim. Notwithstanding the preliminary injunction, IMFCU may still refer the neglect complaint to an appropriate criminal investigative or prosecutive authority pursuant to federal law.^[1] Likewise, the attorney general and an IMFCU investigator may issue a subpoena for the medical records pursuant to Indiana law.^[2] This subpoena process would allow for judicial review of the requested medical records prior to disclosure, thereby allowing IMFCU to pursue its neglect investigation while safeguarding the privacy rights of PPI's minor patients.^[3]

Issue

The dispositive issue is whether the trial court abused its discretion in denying PPI's motion for preliminary injunction against Steve Carter, in his official capacity as Attorney General of the State of Indiana, and Allen K. Pope, in his official capacity as IMFCU's director (collectively, "Appellees"), for the purpose of denying IMFCU unlimited access to the medical records of PPI's minor patients.

Facts and Procedural History^[4]

The relevant facts are undisputed. To put them in context, we begin with an overview of the relevant portions of the Medicaid regulatory scheme as set forth in Title XIX of the Social Security Act and Indiana law.

Title XIX of the Social Security Act, enacted in 1965, authorizes Federal grants to States for medical assistance to low-income persons who are age 65 or over, blind, disabled, or members of families with dependent children or qualified pregnant women or children. The program is jointly financed by the Federal and State governments and administered by States. Within broad Federal rules, each State decides eligible groups, types and range of services, payment levels for services, and administrative and operating procedures. Payments for services are made directly by the State to the individuals or entities that furnish the services.

42 C.F.R. § 430.0. "Although the program is voluntary, once a state chooses to participate, it must comply with all federal Medicaid laws and regulations." Indiana Family & Soc. Servs. Admin. v. Hospitality House of Bedford, 704 N.E.2d 1050, 1053 (Ind.Ct.App.1998).

The Office of Medicaid Planning and Policy ("OMPP"), a subdivision of the Indiana Family and Social Services Administration ("IFSSA"), administers the Medicaid program in Indiana. Ind.Code § 12-15-1-1. "As a participating state, Indiana is required to submit a state plan to the U.S. Department of Health and Human Services to qualify for matching funds." Gomolisky v. Davis, 716 N.E.2d 970, 972 (Ind.Ct.App.1999) (citing 42 U.S.C. § 1396(a)), trans. denied (2000). The plan must demonstrate that the state operates a Medicaid fraud control unit, which must be "separate and distinct" from the state agency that administers the Medicaid program. See 42 U.S.C. § 1396a(a)(61); 42 U.S.C. § 1396b(q)(2).

The function of a Medicaid fraud control unit is to conduct

a statewide program for the investigation and prosecution of violations of all applicable State laws regarding any and all aspects of fraud in connection with (A) any aspect of the provision of medical assistance and the activities of providers of such assistance under the State plan under this subchapter; and (B) upon the approval of the Inspector General of the relevant Federal agency, any aspect of the provision of health care services and activities of providers of such services under any Federal health care program ..., if the suspected fraud or violation of law in such case or investigation is primarily related to the State plan under this subchapter.

42 U.S.C. § 1396b(q)(3). A Medicaid fraud control unit must have "procedures for reviewing complaints of abuse or neglect of patients in health care facilities" that receive Medicaid payments and "procedures for acting upon such complaints under the criminal laws of the State or for referring such complaints to other State agencies for action." 42 U.S.C. § 1396b(q)(4)(A). The U.S. Secretary of Health and Human Services may exclude an entity from participation in the Medicaid program if it "fails to grant immediate access, upon reasonable request[,]" to a state Medicaid fraud control unit "for the purpose of conducting activities described in [42 U.S.C. § 1396b(q)]." 42 U.S.C. § 1320a-7(b)(12).

42 C.F.R. § 1007.11 describes the duties and responsibilities of a state Medicaid fraud control unit in greater detail:

(a) The unit will conduct a Statewide program for investigating and prosecuting (or referring for prosecution) violations of all applicable State laws pertaining to fraud in the administration of the Medicaid program, the provision of medical assistance, or the activities of providers of medical assistance under the State Medicaid plan.

(b)(1) The unit will also review complaints alleging abuse or neglect of patients in health care facilities receiving payments under the State Medicaid plan and may review complaints of the misappropriation of patient's [sic] private funds in such facilities.

(2) If the initial review indicates substantial potential for criminal prosecution, the unit will investigate the complaint or refer it to an appropriate criminal investigative or prosecutive authority.

(3) If the initial review does not indicate a substantial potential for criminal prosecution, the unit will refer the complaint to an appropriate state agency.

....

(f) The unit will safeguard the privacy rights of all individuals and will provide safeguards to prevent the misuse of information under the unit's control.

Pursuant to federal law, IMFCU is a unit of the state attorney general's office. 42 U.S.C. § 1396b(q)(1)(A). Under Indiana law, IMFCU has the authority to "investigate, in accordance with federal law (42 U.S.C. 1396 et seq.): (A) Medicaid fraud; (B) misappropriation of a Medicaid patient's private funds; (C) abuse of Medicaid patients; and (D) neglect of Medicaid patients[.]" Ind.Code § 4-6-10-1.5(1). During an investigation or a prosecution of an alleged offense under Indiana Code Section 4-6-10-1.5, the attorney general and an IMFCU investigator "may issue, serve, and apply to a court to enforce, a subpoena for a witness to appear before the attorney general in person to produce books, papers, or other records, including records stored in electronic data processing systems, for inspection and examination." Ind.Code § 4-6-10-3.

PPI is a nonprofit corporation and a Medicaid service provider that operates forty health care clinics in Indiana.^[5] The clinics provide reproductive health services such as pregnancy testing, treatment for sexually transmitted diseases, abortions, and contraception. As a Medicaid service provider, PPI was required by law to sign an agreement with OMPP in which it agreed to:

(1) Keep any records necessary to disclose the extent of services the provider furnishes to recipients;

(2) On request, furnish to the Medicaid agency, the Secretary [of Health and Human Services], or the State Medicaid fraud control unit ... any information maintained under paragraph (b)(1) of this section and any information regarding payments claimed by the provider for furnishing services[.]

42 C.F.R. § 431.107(b).

During the first week of March 2005, an IMFCU investigator entered three different PPI clinics and presented the following demand letter signed by IMFCU Director Allen K. Pope:

Dear Health Care Provider:

The Indiana Medicaid Fraud Control Unit is investigating an incident report or complaint alleging possible patient abuse or neglect.

Investigator Gerry Hoffa of the Indiana Medicaid Fraud Control Unit is visiting your facility today to review original documents and obtain a copy of them as part of an investigation. The Indiana Medicaid Fraud Control Unit has the legal authority to review original documents upon demand. We are not required by law to provide advance notice of our investigations.

Gerry Hoffa might also be conducting interviews. Individuals will not be Mirandized before being interviewed for the reason that Indiana Medicaid Fraud Control Unit investigators do not place anyone under arrest.

Pursuant to the provisions of 42 USC 1320a-7(b)(11)-(12)^[6] and 42 CFR 431.107(b)(2), the Medicaid Fraud Control Unit of the Office of the Indiana Attorney General has the authority to review and copy all records required to be maintained by Medicaid providers under 405 IAC 1-5-1.

Failure on the part of any provider to comply with the provisions of 405 IAC 1-5-1 may constitute a violation of the Medicaid Program resulting in sanctions under IC XX-XX-XX-X and 42 USC 1320a-7(b) including possible exclusion of the provider from the Medicaid Program.

Should you have any questions or concerns about our investigator's activities, or about any other issue, please do not hesitate to call Supervisory Deputy Attorney General Anne Flannelly ... or me.

Appellant's App. at 32.

The IMFCU investigator requested records concerning eleven PPI patients. According to Medicaid billing records already in IMFCU's possession, each of those patients had received, when they were under the age of fourteen, Medicaid-reimbursed services "of a type usually only required by patients who are sexually active, such as prescriptions for birth control pills or other contraception and treatments for sexually transmitted diseases." Id. at 40 (Pope affidavit).^[7] Under Indiana law, any person, regardless of age, "who, with a child under fourteen (14) years of age, performs or submits to sexual intercourse or deviate sexual conduct commits child molesting, a Class B felony." Ind.Code § 35-42-4-3(a).^[8] In certain circumstances, such as when committed by a person at least twenty-one years of age or by using or threatening the use of deadly force, or if it results in serious bodily injury, the offense is a Class A felony. Id.

Indiana Code Section 31-33-5-1 states that "an individual who has reason to believe that a child is a victim of child abuse or neglect shall make a report as required by this article."^[9] Staff members of medical facilities and other entities who have reason to believe that a child is a victim of child abuse or neglect must immediately notify the individual in charge of the facility, who must then report the suspected abuse or neglect. Ind.Code § 31-33-5-2. An individual who knowingly fails to make a report of child abuse or neglect commits a Class B misdemeanor. Ind.Code § 31-33-22-1. All such reports must be made orally to either the Department of Child Services or the local law enforcement agency, each of which must inform the other that a report has been made. Ind. Code §§ 31-33-5-4, 7-5, 7-7. The reporter is not required to make any written documentation regarding the report. Reports are confidential and are not accessible to IMFCU. Ind.Code §§ 31-33-18-1, -2.

The PPI clinic in Franklin "did not have the requested records, but told the investigator where they were located." Appellant's App. at 8 (finding 10). The PPI clinic in Bloomington "provided the IMFCU investigator with a portion of one of the requested records and told the investigator where others could be located." Id. (finding 11). The PPI clinic in Lafayette "provided the investigator with copies of portions of [five] medical files[.]" Id. (finding 12). Shortly thereafter, a PPI volunteer informed Pope that PPI would not comply with further demands for patient records. On March 14, 2005, PPI filed against Appellees a complaint for declaratory and injunctive relief in which it alleged, among other things, that IMFCU had no statutory authority to conduct its investigation; that IMFCU's investigation violated PPI's right against unreasonable searches and seizures under the Fourth Amendment to the U.S. Constitution; and that IMFCU's investigation violated PPI's patients' Fourteenth Amendment informational privacy rights.^[10]

The parties filed a stipulation of facts, briefs, and evidentiary material. The parties stipulated that "IMFCU has requested and received, and plans to continue to request and receive, all records including medical records of PPI concerning 73 patients who received Medicaid reimbursed services from PPI health care centers between 2002 and 2004, when these patients were under the age of 14." Appellant's App. at 33. In its brief, IMFCU stated that "it is investigating whether PPI has neglected some of its patients by failing to report child abuse as required by state law." Appellant's App. at 9 (finding 14).^[11] IMFCU further stated that its neglect investigation might also yield evidence of Medicaid fraud, based on a corresponding failure "to provide a minimum quality of care to patients for whom it has submitted Medicaid reimbursement claims." Appellees' Br. at 25.

On April 18, 2005, the trial court held a hearing on PPI's motion for preliminary injunction. On May 31, 2005, the trial court denied PPI's motion in a twenty-two-page order containing numerous findings of fact and conclusions thereon. The trial court determined that entering an injunction during IMFCU's investigation "would so excessively involve the Court in the judgments of executive investigatory authority as to threaten a separation of powers violation." Appellant's App. at 14 (conclusion 19). The trial court also determined that IMFCU was authorized by statute to investigate neglect of patients in health care facilities based on an alleged failure to report child abuse; that through its Medicaid provider agreement, PPI had consented to IMFCU's demand for patient medical records, thereby negating its Fourth Amendment claim; that PPI did not have standing to raise a Fourteenth Amendment informational privacy claim on behalf of its patients; that any such claim was not reasonably likely to succeed at trial; and that "the public interest weighs in favor of permitting the IMFCU unfettered access to PPI's patient records as provided by law[.]" Id. at 26 (conclusion 61).

That same day, PPI filed a notice of appeal. On June 13, 2005, this Court granted PPI's motion for stay of proceedings pending appeal. On July 13, 2005, our supreme court denied Appellees' motion for immediate transfer.

Discussion and Decision

A. Standard of Review

The denial of a motion for preliminary injunction "rests within the sound discretion of the trial court, and our review is limited to whether there was a clear abuse of that discretion." Dep't of Fin. Insts. v. Mega Net Servs., 833 N.E.2d 477, 485 (Ind.Ct.App.2005).

When determining whether or not to grant a preliminary injunction, the trial court is required to make special findings of fact and state its conclusions thereon. Ind. Trial Rule 52(A). When findings and conclusions are made, the reviewing court must determine if the trial court's findings support the judgment. The trial court's judgment will be reversed only when clearly erroneous. Findings of fact are clearly erroneous when the record lacks evidence or reasonable inferences from the evidence to support them.

Hydraulic Exch. & Repair, Inc. v. KM Specialty Pumps, Inc., 690 N.E.2d 782, 785 (Ind.Ct.App.1998) (citations omitted). We also determine whether the trial court's conclusions are contrary to law. See Carson v. Ross, 509 N.E.2d 239, 241 (Ind.Ct.App.1987), trans. denied (1988). "We consider the evidence only in the light most favorable to the judgment and construe findings together liberally in favor of the judgment." Hydraulic Exch. & Repair, 690 N.E.2d at 785. Although we defer substantially to the trial court's findings of fact, we review questions of law de novo. Mayer v. BMR Props., Inc., 830 N.E.2d 971, 978 (Ind.Ct.App.2005).

In order to obtain a preliminary injunction, the moving party has the burden of showing by a preponderance of the evidence that: (1) the movant's remedies at law are inadequate, thus causing irreparable harm pending resolution of the substantive action; (2) the movant has at least a reasonable likelihood of success at trial by establishing a prima facie case; (3) the threatened injury to the movant outweighs the potential harm to the nonmovant resulting from the granting of the injunction; and (4) the public interest would not be disserved. The movant must prove each of these requirements to obtain a preliminary injunction. If the movant fails to prove even one of these requirements, the trial court cannot grant an injunction.

Id. (citations omitted). "The power to issue a preliminary injunction should be used sparingly, and such relief should not be granted except in rare instances in which the law and facts are clearly within the moving party's favor." Hydraulic Exch. & Repair, 690 N.E.2d at 785.

"[W]here the action to be enjoined is unlawful, the unlawful act constitutes per se `irreparable harm' for purposes of the preliminary injunction analysis." Short On Cash.Net of New Castle, Inc. v. Dep't of Fin. Insts., 811 N.E.2d 819, 823 (Ind.Ct.App.2004). Consequently, "the plaintiff need not make a showing of irreparable harm or a balance of the hardship in his favor." L.E. Servs., Inc. v. State Lottery Comm'n of Indiana, 646 N.E.2d 334, 349 (Ind.Ct.App.1995), trans. denied. Because the essence of PPI's argument is that IMFCU's actions are unlawful and/or unconstitutional, we will tailor our analysis accordingly.

B. Separation of Powers

As a threshold matter, we address PPI's challenge to the trial court's conclusion that issuing an injunction "would so excessively involve the Court in the judgments of executive investigatory authority as to threaten a separation of powers violation." Appellant's App. at 14 (conclusion 19). Article 3, Section 1 of the Indiana Constitution states: "The powers of the Government are divided into three separate departments; the Legislative, the Executive including the Administrative, and the Judicial: and no person, charged with official duties under one of these departments, shall exercise any of the functions of another, except as in this Constitution expressly provided." "The separation of powers doctrine recognizes that each branch of the government has specific duties and powers that may not be usurped or infringed upon by the other branches of government." Woolley v. Washington Twp. of Marion County Small Claims Court, 804 N.E.2d 761, 765-66 (Ind.Ct.App.2004). "Our supreme court has held repeatedly that courts should not intermeddle with the internal functions of either the Executive or Legislative branches of Government." Id. at 766 (citation and quotation marks omitted).

PPI observes that IMFCU is a creature of statute with no prosecutorial powers and limited investigative powers. Indeed, IMFCU acknowledges that it "may not initiate an investigation on its own; it must first receive a complaint that a provider is engaged in fraud, abuse, or neglect." Appellees' Br. at 17; see 42 U.S.C. § 1396b(q)(4)(A)(i); 42 C.F.R. § 1007.11(b)(2). PPI asserts that "[i]f IMFCU goes beyond these narrow statutory boundaries a trial court has both the right and duty to issue an injunction to force the administrative agency to stay within its prescribed authority." Appellant's Br. at 14. We agree.

"It is elementary that the authority of the State to engage in administrative action is limited to that which is granted it by statute[.]" Indiana State Bd. of Pub. Welfare v. Tioga Pines Living Ctr., Inc., 622 N.E.2d 935, 939 (Ind.1993), cert. denied (1994); see also Vehslage v. Rose Acre Farms, Inc., 474 N.E.2d 1029, 1033 (Ind.Ct.App.1985) ("It is black-letter law that generally, administrative agencies are creatures of statute, and only the legislature has the broad power to provide for their creation. Administrative boards, agencies, and officers have no common law or inherent powers, but only such authority as is conferred upon them by statutory enactment."). "Any act of an agency in excess of its power is ultra vires and void." Howell v. Indiana-American Water Co., 668 N.E.2d 1272, 1276 (Ind.Ct.App.1996), trans. denied (1997). "To maintain the proper balance between the departments of government, the courts have power to confine administrative agencies to their lawful jurisdictions." Wilmont v. City of S. Bend, 221 Ind. 538, 541-42, 48 N.E.2d 649, 650 (1943).

PPI did not ask the trial court to intervene in an ongoing criminal investigation or prosecution, but rather in an administrative investigation governed by statute. Cf. Younger v. Harris, 401 U.S. 37, 91 S.Ct. 746, 27 L.Ed.2d 669 (1971) (reversing federal injunction of state criminal proceeding). PPI properly asked the trial court to determine whether IMFCU's investigation falls within its statutory and constitutional authority and to issue an injunction if it does not. See Indiana State Bd. of Pub. Welfare v. Tioga Pines Living Ctr., Inc., 637 N.E.2d 1306, 1310 (Ind.Ct.App.1994) (upholding injunction prohibiting State from implementing proposed Medicaid reimbursement changes in violation of federal law); see also Univ. of Toledo v. U.S. Dep't of HEW, 464 F.Supp. 693, 696 (N.D.Ohio 1979) (upholding injunction against federal agency with no statutory authority to investigate employment practices; "It is elementary that an administrative inquiry must be within the authority of the investigating agency."). In sum, we find no separation of powers violation here.

C. Reasonable Likelihood of PPI's Success at Trial

We must now determine whether PPI has met its burden of showing that it has a reasonable likelihood of success at trial by establishing a prima facie case regarding the legality and constitutionality of IMFCU's demand for unlimited access to its patients' medical records. We first consider whether IMFCU has statutory authority to conduct its investigation of PPI.

C(1). IMFCU's Statutory Authority to Conduct Investigation

As previously mentioned, an individual in charge of a medical facility has a duty to report child abuse or neglect. Ind.Code § 31-33-5-2. An individual who knowingly fails to make a report commits a Class B misdemeanor. Ind.Code § 31-33-22-1. IMFCU "is investigating whether PPI has neglected some of its patients by failing to report child abuse as required by state law." Appellant's App. at 9 (finding 14). The sources of statutory authority for an investigation of patient neglect are 42 U.S.C. § 1396b(q)(4)(A)(i), which provides that a Medicaid fraud control unit must have "procedures for reviewing complaints of abuse or neglect of patients in health care facilities[,]" and 42 C.F.R. § 1007.11(b)(2), which provides that "[i]f the initial review indicates substantial potential for criminal prosecution, the unit will investigate the complaint or refer it to an appropriate criminal investigative or prosecutive authority."

Initially, we observe that "neglect," as used in this context, is not defined in the Medicaid statutes and regulations.^[12] PPI defines "neglect" in terms of Indiana's "neglect of a dependent" statute^[13] and relies on Indiana caselaw in asserting that "neglect" does not encompass the failure to report child abuse. See, e.g., Fisher v. State, 548 N.E.2d 1177, 1180 (Ind.Ct.App. 1990) (holding that appellant's failure to report child abuse, "for which he was rightly convicted and punished" as a separate crime, was insufficient to establish that he knowingly placed the child in a dangerous situation and therefore did not constitute the crime of "neglect of a dependent" as defined by Ind.Code § 35-46-1-4); Borne v. Nw. Allen County Sch. Corp., 532 N.E.2d 1196, 1203 (Ind.Ct.App.1989) (holding that child abuse reporting statutes do not create a private right of action for failure to report abuse), trans. denied (1990).

Appellees contend that PPI's reliance on Indiana law in defining "neglect" is misplaced, in that the "neglect of a dependent" statute addresses a different subject matter than the federal Medicaid enabling statutes and was enacted by a different legislative body. We agree with Appellees. See Erlenbaugh v. United States, 409 U.S. 239, 244, 93 S.Ct. 477, 34 L.Ed.2d 446 (1972) (stating that application of in pari materia rule of statutory construction "makes the most sense when the statutes were enacted by the same legislative body at the same time"). "It is a general rule of statutory construction that undefined words and phrases in a statute are given their plain, ordinary and usual meaning. Courts may consult English language dictionaries to ascertain the plain and ordinary meaning of a statutory term." Kiel Bros. Oil Co. v. Indiana Dep't of Envtl. Mgmt., 819 N.E.2d 892, 902 (Ind.Ct.App.2004) (citation omitted), trans. denied (2005). Rules of statutory construction also apply to administrative regulations. Indiana Port Comm'n v. Consol. Grain & Barge Co., 701 N.E.2d 882, 890 (Ind.Ct.App.1998), trans. denied (1999). Although a reviewing court is not bound by an agency's interpretation of statutes and regulations that it is charged with enforcing, Union Twp. Sch. Corp. v. State ex rel. Joyce, 706 N.E.2d 183, 190 (Ind.Ct. App.1998), trans. denied (1999), "once an administrative agency's interpretation of a regulatory statute is deemed reasonable, the reviewing court shall terminate its analysis and not address the reasonableness of a conflicting interpretation." Indiana Dep't of Envtl. Mgmt. v. Boone County Resource Recovery Syst., Inc., 803 N.E.2d 267, 274 (Ind.Ct.App.2004), trans. denied.

In its order, the trial court noted that "Merriam-Webster's Dictionary of Law (1996) (as provided at Dictionary.com) defines neglect as `a disregard of duty resulting from carelessness, indifference, or willfulness; especially: a failure to provide a child under one's care with proper food, clothing, shelter, supervision, medical care, or emotional stability.'" Appellant's App. at 18 (conclusion 33). The court also noted that "Black's Law Dictionary (1990) defines `neglect' to mean, among other things, `to omit, fail, or forbear to do a thing that can be done, or that is required to be done ....'" Id. (conclusion 34). In light of these definitions, we agree with the trial court that "IMFCU reasonably interprets `neglect' of a patient to include a healthcare provider's failure to report the suspected sexual abuse of the patient when it has a duty to do so under state law." Id. at 16 (conclusion 28). We also agree with the trial court that "[w]ith respect to failure to report abuse, the violation is ongoing; it begins while the patient is `in' the clinic and continues to occur `in' the clinic (where the personnel continue to work while not reporting the abuse) after the patient leaves. It is all the while `in' the clinic." Id. at 20 (conclusion 40). Consequently, we need not address the reasonableness of PPI's conflicting interpretation.

In sum, we conclude that IMFCU is authorized by statute to investigate a complaint of the neglect of a patient in a health care facility,^[14] based on an alleged failure to report child abuse pursuant to Indiana law, if the review indicates substantial potential for criminal prosecution.^[15]See 42 U.S.C. § 1396b(q)(4)(A)(i), 42 C.F.R. § 1007.11(b)(2). We must now determine the proper constitutional scope of IMFCU's investigative authority in this case.

C(2). Constitutional Scope of IMFCU's Investigative Authority

To reiterate, Pope's demand letter^[16] to the PPI clinics states, "Pursuant to the provisions of 42 USC 1320a-7(b)(11)-(12) and 42 CFR 431.107(b)(2), the Medicaid Fraud Control Unit of the Office of the Indiana Attorney General has the authority to review and copy all records required to be maintained by Medicaid providers under 405 IAC 1-5-1."^[17] Appellant's App. at 32. 42 U.S.C. § 1320a-7(b)(12) says that the Secretary of Health and Human Services may exclude from participation in the Medicaid program "[a]ny entity that fails to grant immediate access, upon reasonable request ... [t]o a State medicaid fraud control unit ... for the purpose of conducting activities described in [42 U.S.C. § 1396b(q)]."^[18] Those activities include "reviewing complaints of abuse or neglect of patients in health care facilities" and "acting upon such complaints under the criminal laws of the State[.]" 42 U.S.C. § 1396b(q)(4)(A).

Also, a Medicaid provider must sign an agreement with the state Medicaid agency to do the following:

(1) Keep any records necessary to disclose the extent of services the provider furnishes to recipients;

(2) On request, furnish to the Medicaid agency, the Secretary, or the State Medicaid fraud control unit ... any information maintained under paragraph (b)(1) of this section and any information regarding payments claimed by the provider for furnishing services.^[19]

42 C.F.R. § 431.107(b). PPI signed such an agreement in this case.^[20] The trial court concluded that by signing the agreement, PPI had "expressly promise[d]" to

fully cooperate with any investigations by state and local officials—without limitation—and will provide any documents requested by any state and local officials that such officials deem necessary to assure compliance with state and federal laws—again without limitation. These are broad pledges, and they do not contemplate any reservation of rights by PPI to challenge the grounds for the IMFCU's records requests[.]

Appellant's App. at 21 (conclusion 44).

On appeal, PPI contends that IMFCU's demand for unlimited access to its patients' medical records pursuant to the above mentioned Medicaid provisions violates the Fourth and Fourteenth Amendments to the U.S. Constitution. We address each contention in turn.

C(2)(a). Fourth Amendment Claim — Unreasonable Search and Seizure^[21]

"The Fourth Amendment protects persons from unreasonable search and seizure[.]" Polk v. State, 822 N.E.2d 239, 245 (Ind.Ct.App.2005). "In order for the Fourth Amendment to be implicated by a governmental search, a person must have a legitimate expectation of privacy in the thing searched. A legitimate expectation of privacy involves two components: (1) an actual, subjective expectation of privacy (2) that society recognizes as reasonable." Hannoy v. State, 789 N.E.2d 977, 990 (Ind.Ct.App.2003) (citation omitted), on reh'g, 793 N.E.2d 1109, trans. denied.

Although the expectation of privacy with regard to commercial premises is less than the expectation of privacy with regard to private homes, New York v. Burger, 482 U.S. 691, 107 S.Ct. 2636, 96 L.Ed.2d 601 (1987), the United States Supreme Court has established that the Fourth Amendment prohibition against unreasonable searches does apply to commercial businesses. Marshall v. Barlow's, Inc., 436 U.S. 307, 311, 98 S.Ct. 1816, 56 L.Ed.2d 305 (1978) ("The Warrant Clause of the Fourth Amendment protects commercial buildings as well as private homes. To hold otherwise would belie the origin of that amendment, and the importance of the American colonial experience.").

State v. Foreman, 662 N.E.2d 929, 934 (Ind.1996) (footnote and parallel citations omitted). "Generally, a search warrant is a prerequisite to a constitutionally proper search and seizure." Lyons v. State, 735 N.E.2d 1179, 1184 (Ind.Ct.App.2000), trans. denied (2002). "A valid consent to search is an exception to the warrant requirement. The theory underlying this exception is that, when an individual gives the State permission to search either his person or his property, the governmental intrusion is presumably reasonable." Id. at 1185 (citation omitted).

PPI raises several Fourth Amendment arguments, only one of which we find necessary to address:

PPI has given IMFCU limited consent to enter its premises and seize its records if it is conducting an investigation within its authorized powers. However..., nothing in the statute, regulations or provider agreement give[s] IMFCU permission to go beyond its statutory boundaries in entering and searching PPI clinics. IMFCU is acting in excess of its authority and PPI, by participating in the Medicaid program, has not given its consent to the search and seizure of its records.

Appellant's Br. at 24. We have already determined that IMFCU is acting within its statutory authority to investigate complaints of patient neglect in health care facilities based on PPI's alleged failure to report child abuse as required by Indiana law. We have also determined that federal law requires PPI to furnish IMFCU, on request, with "any records necessary to disclose the extent of services [it] furnishes to recipients[.]" 42 C.F.R. § 431.107(b). To the extent that PPI challenges the scope of IMFCU's request, we believe that this challenge is more properly addressed in the context of its Fourteenth Amendment informational privacy argument.^[22]

C(2)(b). Fourteenth Amendment Claim — Informational Privacy^[23]

PPI asserts that its patients have a constitutional right to privacy in the information contained in their medical records and that IMFCU's demand for unlimited access to those records violates that right. Appellees contend that PPI has no standing to assert such a claim on behalf of its patients. This Court has stated that "[a] litigant may raise a claim on behalf of a third party if the litigant can demonstrate that he has suffered a concrete, redressable injury, that he has a close relation with the third party, and that there exists some hindrance to the third party's ability to protect his own interests." Osmulski v. Becze, 638 N.E.2d 828, 833-34 (Ind.Ct.App.1994). In an injunction context such as this, we are often concerned with a "threatened injury" to the litigant who seeks standing. See Mayer, 830 N.E.2d at 978.

PPI observes that IMFCU is threatening its Medicaid funding,

the loss of which would be catastrophic to its many indigent patients who are dependent on PPI, and Medicaid reimbursement, for their reproductive health care. Its patients whose records are being seized are young persons who are not situated to protect their own rights. PPI and its patients are closely tied in their interests to prevent unwarranted disclosures of their medical records.

Appellant's Br. at 27. Appellees observe that PPI's patients also have an interest in being protected from sexual abuse. This observation is valid as far as it goes, but it does not negate the closely aligned privacy interests of PPI and its patients, most of whom are likely minors with limited means who might be hesitant to assert their privacy rights because of fear of parental reprisal and/or the sensitive nature of the medical information at issue. We therefore conclude that PPI has standing to assert a Fourteenth Amendment informational privacy claim on behalf of its patients. See Aid for Women v. Foulston, 441 F.3d 1101, 1111-15 (10th Cir.2006) (concluding that child health care plaintiffs' and minor patients' interests were sufficiently close and that minors were sufficiently hindered from asserting their own claims to satisfy third-party standing test in challenge to particular application of sexual abuse reporting statute).^[24]

To lend some perspective to our analysis of PPI's informational privacy claim, we turn to Judge Posner's "brief sketch of the history of the legal concept of privacy" in Anderson v. Romero, 72 F.3d 518 (7th Cir.1995), which involved prison officials' disclosure of a prisoner's HIV status:

The concept originated in a famous article by Warren and Brandeis that found latent in a number of areas of the common law, ranging from copyright to trespass, a policy of protecting people against the invasion of their "private space" (not Warren and Brandeis's term) and the involuntary revelation of personal, private facts about them. Samuel D. Warren & Louis D. Brandeis, "The Right to Privacy," 4 Harv. L. Rev. 193 (1890). After a lag, the concept proposed by Warren and Brandeis fructified in a distinct, many-branched tort of invasion of the right of privacy, a tort that could be committed by wiretapping and other electronic eavesdropping, by publicity that cast a person in a false light, by publicizing intimate details of a person's life or person, by intrusive surveillance (as by searching through a person's private papers), and even by using a celebrity's name or likeness in advertising without the celebrity's consent. Haynes v. Alfred A. Knopf, Inc., 8 F.3d 1222, 1229 (7th Cir.1993). Until quite recently only the first and the fourth of these forms of invasion of privacy—electronic surveillance and intrusive surveillance—were thought to have a constitutional dimension. The search of a person's home or person for contraband or other incriminating evidence of crime has been subject to the restrictions of the Fourth Amendment since 1789. The Supreme Court first wrestled with the question whether electronic eavesdropping is also governed by the Fourth Amendment in Olmstead v. United States, 277 U.S. 438, 48 S.Ct. 564, 72 L.Ed. 944 (1928),^[25] and held that it was not unless the installation of the listening device involved a trespass, which in the ordinary case it would not. See also Goldman v. United States, 316 U.S. 129, 62 S.Ct. 993, 86 L.Ed. 1322 (1942). This interpretation of the Fourth Amendment, limiting it to the protection of property rights, was later rejected in a decision that emphasized the role of the amendment in protecting privacy. Katz v. United States, 389 U.S. 347, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967). Meanwhile the term "privacy" was beginning to be used in the law in a completely different sense from concealment or seclusion—as the name of the right, not specifically enumerated in the Constitution but held to be implicit in it, to sexual freedom and reproductive autonomy, the right whose culminating expression was the right to abortion recognized in Roe v. Wade, 410 U.S. 113, 93 S.Ct. 705, 35 L.Ed.2d 147 (1973).

A right to conceal one's medical history is readily derivable from the branch of the tort of invasion of privacy that protects people against the indiscriminate publicizing of intimate details of their personal lives. But that branch has evolved mainly as a part of the common law, rather than of the constitutional law, of privacy. Nothing in the Fourth Amendment or in the cases recognizing a right of sexual and reproductive autonomy bears directly on the interest in the privacy of one's medical records. Although there are cases in which a demand for medical records might be met by a defense based on the Fourth Amendment or even the right of sexual privacy, this case is not one of them.

The strongest precedent in the Supreme Court for recognizing a constitutional right to conceal one's medical history is Whalen v. Roe, 429 U.S. 589, 97 S.Ct. 869, 51 L.Ed.2d 64 (1977). The holding was that a statute which required the maintenance of records of the identity of people for whom physicians prescribed certain dangerous though lawful drugs did not invade any constitutional right of privacy. The Court implied, however, that the disclosure by or under the compulsion of government of a person's medical records might invade a constitutional right of privacy, presumably a "substantive due process" right, though the opinion is very vague on this, perhaps deliberately so. See id. at 598-600, 605-06, 97 S.Ct. 869. A subsequent case, Nixon v. Administrator of General Services, 433 U.S. 425, 457-58, 97 S.Ct. 2777, 53 L.Ed.2d 867 (1977), is more explicit about the existence of a constitutional right of privacy of personal papers, though they were not in that case medical records and, again, the plaintiff lost. A number of cases in the lower federal courts, including our own, building on Whalen and Nixon, recognize a qualified constitutional right to the confidentiality of medical records and medical communications. See, e.g., Pesce v. J. Sterling Morton High School, 830 F.2d 789, 795-98 (7th Cir.1987); Schaill by Kross v. Tippecanoe County School Corp., 864 F.2d 1309, 1322 n. 19 (7th Cir.1988); Doe v. City of New York, 15 F.3d 264, 267 (2d Cir.1994); F.E.R. v. Valdez, 58 F.3d 1530, 1535 (10th Cir. 1995); United States v. Westinghouse Electric Corp., 638 F.2d 570, 577-80 (3d Cir.1980). (Doe actually involved the plaintiff's HIV status.) The existence of the right was described as an open question in Borucki v. Ryan, 827 F.2d 836, 848 (1st Cir.1987), and the right has been expressly rejected by the Sixth Circuit. J.P. v. DeSanti, 653 F.2d 1080, 1087-91 (6th Cir.1981);^[26]Doe v. Wigginton, 21 F.3d 733, 740 (6th Cir.1994). But it is recognized by our court and was in 1992.

Id. at 521-22 (parallel citations omitted).^[27]

In a subsequent Seventh Circuit case, Judge Flaum observed that "[t]he `concept of ordered liberty' protected by the Fourteenth Amendment's Due Process Clause has been interpreted to include `the individual interest in avoiding disclosure of personal matters.'" Denius v. Dunlap, 209 F.3d 944, 955 (7th Cir.2000) (quoting Whalen, 429 U.S. at 599-600, 97 S.Ct. 869).^[28] Judge Flaum noted, however, that "the scope and contours" of the federal right of confidentiality in certain types of information had not been defined in the Seventh Circuit:

For example, it is not clear whether the right of confidentiality covers all confidential information or only confidential information relating to certain matters. In this Circuit, the right clearly covers medical records and communications. See [Anderson, 72 F.3d at 522] (noting the recognition of this right as early as 1992); [Schaill, 864 F.2d at 1322 n. 19] (recognizing "a substantial privacy interest in the confidentiality of medical information."). But, it is not clear whether other confidential information, such as that contained in financial records, also receives similar protection under this right. Furthermore, while it is apparent that some form of balancing test would be used to determine when this right of confidentiality has been violated, that test has not been defined in this Circuit.

Id. at 955-56.

PPI cites several state court decisions recognizing some form of a federal constitutional privacy right with respect to medical information. Appellant's Br. at 30 (citing Doe v. Maryland Bd. of Social Work Examiners, 384 Md. 161, 862 A.2d 996, 1008 (2004); Hillman v. Columbia County, 164 Wis.2d 376, 474 N.W.2d 913, 923 (1991); In re Xeller, 6 S.W.3d 618, 625 (Tex.Ct.App.1999); King v. State, 272 Ga. 788, 535 S.E.2d 492 (2000)). Recently, the Kansas Supreme Court acknowledged such a right in a case involving the state attorney general's subpoena of ninety unredacted patient files of women and girls who obtained abortions at two medical clinics. See Alpha Med. Clinic v. Anderson, 280 Kan. 903, 128 P.3d 364, 376 (2006) (citing, inter alia, Whalen). Appellees have cited no contrary authority from our sister states.

Thus far, Indiana courts have not answered the question of whether a federal constitutional privacy right exists with respect to medical records. In Oman v. State, 737 N.E.2d 1131 (Ind.2000), cert. denied (2001), our supreme court addressed, among other things, the propriety of a prosecutor's subpoena duces tecum issued for a firefighter's toxicological test results following a collision between two fire trucks. In considering whether the firefighter's expectation of privacy in the test results was reasonable under federal law, the Oman court acknowledged Whalen's statement that "[a] person has an `individual interest in avoiding disclosure of personal matters.'" Id. at 1145 (quoting Whalen, 429 U.S. at 599, 97 S.Ct. 869). The court also noted that "with regard to an individual's reasonable expectation of privacy in his or her medical records, federal courts following the Supreme Court's lead in [Whalen] and apply a balancing test, considering the potential conflict between the patient's right to privacy and the asserted right of access to the records." Id. (footnote omitted).

Although the Oman court did not specifically hold that a federal constitutional right of privacy in medical information exists, today we join our colleagues on the Seventh Circuit and elsewhere in concluding that it does.^[29] In reaching this determination, we are mindful of Whalen's observation that mandatory disclosures of private information to state employees

are not significantly different from unpleasant invasions of privacy that are associated with many facets of health care. Unquestionably, some individuals' concern for their own privacy may lead them to avoid or to postpone needed medical attention. Nevertheless, disclosures of private medical information to doctors, to hospital personnel, to insurance companies, and to public health agencies are often an essential part of modern medical practice even when the disclosure may reflect unfavorably on the character of the patient.

Whalen, 429 U.S. at 602, 97 S.Ct. 869 (footnote omitted). Since Whalen was decided in 1977, however, the courts, Congress,^[30] and American society at large have become increasingly concerned about protecting the confidentiality of personal information in general and medical information in particular, both because of its especially sensitive nature and because of the chilling effect that unwarranted disclosure may have upon patients and physicians alike.^[31]See, e.g., Commonwealth v. Kobrin, 395 Mass. 284, 479 N.E.2d 674, 680 n. 15 (1985) (limiting disclosure of psychiatric records subpoenaed in Medicaid fraud investigation; noting that unrestricted state access to psychiatric records "may induce psychiatrists to limit their recordkeeping even further to sparse and perfunctory notations. `Psychiatrists may be disinclined to record in their files extremely personal, sensitive confidences of a patient if they know those files may be reviewed and copied by state officials at any time. The threat of searches may therefore decrease the likelihood that the very information most valuable to another treating psychiatrist, a history of the patient's emotional and mental problems, will be available.'") (citation omitted). Any patient confidences contained in PPI's medical records might be equally as personal and sensitive as those mentioned in Kobrin, given the nature of the treatment sought.

At this point, we pause to observe that neither party specifically addresses whether or to what extent minors possess a constitutional right of privacy in their medical information. The Tenth Circuit recently discussed this issue in Aid for Women v. Foulston, 441 F.3d 1101:

In Carey v. Population Services, International, a plurality of the Supreme Court opined that "the right to privacy in connection with decisions affecting procreation extends to minors as well as adults." 431 U.S. 678, 693, 97 S.Ct. 2010, 52 L.Ed.2d 675 (1977). Other circuits have also recognized that minors possess privacy rights. See Planned Parenthood of S. Az. v. Lawall, 307 F.3d 783, 789 (9th Cir.2002) (recognizing "a young woman's privacy interest in avoiding disclosure of sensitive personal information."); Doe v. Irwin, 615 F.2d 1162, 1166 (6th Cir.1980) ("Though the state has somewhat broader authority to regulate the conduct of children than that of adults, minors do possess a constitutionally protected right of privacy."); Wynn v. Carey, 582 F.2d 1375, 1384 (7th Cir. 1978) ("[A] minor possesses the right of privacy, defined as the right of the individual... to be free of unwarranted governmental intrusion into ... the decision whether to bear or beget a child, [but] that right is not unqualified.") (internal citations omitted) (alterations in original); see also Planned Parenthood of Cent. Mo. v. Danforth, 428 U.S. 52, 74, 96 S.Ct. 2831, 49 L.Ed.2d 788 (1976) ("Constitutional rights do not mature and come into being magically only when one attains the state-defined age of majority."). We agree with our sister circuits and conclude that minors do have a right to informational privacy.

Id. at 1116-17 (parallel citations and footnotes omitted) (alterations in Aid for Women). The majority noted, however, that it need not "determine the precise parameters of this right" in that case. Id. at 1117 n. 17.

At issue in Aid for Women was the constitutionality of a particular application of Kansas's child abuse reporting statute. Enacted in 1982, the statute requires that specified professionals report child sexual abuse to the appropriate state agency only when they have reason to suspect that the child has been injured as a result of the abuse. In 1992, Kansas's then-attorney general issued an opinion stating that the reporting statute "`does not require reporting of all suspected child abuse; it requires reporting in situations where there is "reason to suspect the child has been injured" as a result of the abuse.'" Id. at 1107. In 2003, the current attorney general, Phill Kline, issued a conflicting opinion ("the Kline Opinion") stating that "`injury as a result of sexual abuse should be inferred as a matter of law whenever sexual intercourse, whether voluntary or involuntary, has occurred with a child under the age of 16.'" Id. at 1108 (emphasis in Aid for Women). The Kline Opinion went on to say that

"situations that might trigger a mandated reporter's obligation, because sexual activity of a minor becomes known, include a teenage girl or boy who seeks medical attention for a sexually transmitted disease, a teenage girl who seeks medical attention for a pregnancy, or a teenage girl seeking birth control who discloses she has already been sexually active."

Id.

Soon thereafter, a group of plaintiffs, including physicians and nurses, filed suit against Kline and Kansas's county and district attorneys. "The complaint sought `declaratory and injunctive relief ... against application of the reporting statute to incidents of consensual sexual activity between ... a minor under 16 and a person of similar age [where the plaintiffs] conclude in their professional judgment that the sexual activity has not caused the minor injury.'" Id. (alterations in Aid for Women). The plaintiffs alleged, among other things, that the reporting statute as applied pursuant to the Kline Opinion was unconstitutional because it "`violates the rights of adolescents under 16 to maintain the confidentiality of private information about their sexual behavior and medical and psychological health care, including the fact that they have sought reproductive or mental health care or counseling, without serving any legitimate, important or compelling state interest.'" Id.

In July 2004, the district court granted the plaintiffs' request for a preliminary injunction,^[32] concluding that they

had standing to assert both their own constitutional rights and the rights of their patients and clients, and that those patients and clients "possess a right to informational privacy concerning personal sexual matters that might be revealed through mandatory reporting." The [district] court then concluded that mandatory reporting as required by the reporting statute violates the minor patients' and clients' privacy rights without serving a significant state interest.

Id. at 1109 (citation omitted). Defendants appealed.

In January 2006, a panel of the Tenth Circuit agreed with the district court that the plaintiffs had standing to challenge the application of the Kansas reporting statute on behalf of their minor patients and clients. A majority of the panel disagreed, however, with the district court's determination that the plaintiffs had demonstrated that they were likely to succeed on their informational privacy claim. The majority noted that sexual activity by minors is illegal and that "[m]inors' privacy rights in personal sexual activity are not as strong as adults' rights would be." Id. at 1120. The majority then determined that the district court had failed to analyze adequately the remaining preliminary injunction factors, vacated the injunction, and remanded for further proceedings.

Judge Herrera dissented from the majority as to the likelihood of success of the plaintiffs' informational privacy claim, noting that states cannot extinguish federal privacy rights simply by criminalizing certain behavior. Id. at 1123 (Herrera, J., dissenting) (citing, inter alia, Griswold v. Connecticut, 381 U.S. 479, 485-86, 85 S.Ct. 1678, 14 L.Ed.2d 510 (1965), and Lawrence v. Texas, 539 U.S. 558, 578, 123 S.Ct. 2472, 156 L.Ed.2d 508 (2003)). As such, "[t]he fact that Kansas criminalizes voluntary sexual conduct does not deprive minors of their pre-existing right to privacy in their voluntary sexual or confidential medical information. That Kansas criminalizes such conduct may inform the court's judgment regarding the scope of federal constitutional rights, but cannot alone extinguish a federal privacy right." Id. at 1125 (Herrera, J., dissenting). Judge Herrera further observed that "victims of sexual crimes have a heightened, and not diminished, right of privacy. See, e.g., Michigan v. Lucas, 500 U.S. 145, 149, 111 S.Ct. 1743, 114 L.Ed.2d 205 (1991) (noting that a victim's right to privacy in information regarding her sexual assault may outweigh even a defendant's constitutional right to confrontation)[.]" Id. (Herrera, J., dissenting). Moreover, "the information to be disclosed is not otherwise in the public record or legitimately in the state's possession. Instead, it is contained solely in minors' confidential conversations with their healthcare providers—conversations that are shrouded in multiple state and federal protections based upon the relationship between healthcare professionals and their patients." Id. at 1125-26 (Herrera, J., dissenting). Ultimately, Judge Herrera concluded that the minors' legitimate expectation of informational privacy outweighed any state interest in disclosing or obtaining that information and that the plaintiffs were therefore likely to succeed on the merits of their privacy claim.

On January 30, 2006, three days after the Tenth Circuit decided Aid for Women, the district court held a seven-day trial on the merits of the plaintiffs' informational privacy claim and three other constitutional claims. On April 18, 2006, the district court found in favor of the plaintiffs' informational privacy claim^[33] and permanently enjoined enforcement of the reporting statute "in any manner inconsistent with [its] decision, which includes the Kline Opinion."^[34]Aid for Women v. Foulston, 427 F.Supp.2d 1093, 1097 (D.Kan.2006) ("Aid for Women II"), appeal docketed (May 16, 2006). The Aid for Women defendants have appealed the district court's ruling, and the plaintiffs have cross-appealed. As of this writing, those appeals remain pending.

Returning to the facts of this case, we acknowledge that we are concerned with Medicaid regulations that are the basis for IMFCU's demand for the medical records of PPI's patients, rather than with Indiana's child abuse reporting statutes. Nonetheless, the information sought by IMFCU and the privacy interests at stake for PPI's minor patients are sufficiently similar to those at issue in Aid for Women that we find that case instructive in resolving the primary questions before us: namely, whether and to what extent PPI's minor patients have a constitutional right of privacy in the information contained in their medical records.

In this case, IMFCU is demanding unlimited access to PPI's minor patients' medical records to determine whether the patients are in fact "victims of child abuse or neglect" for purposes of the child abuse reporting statutes and, if so, whether PPI in fact fulfilled its statutory duty to report the suspected abuse. Obviously, the record before us does not disclose the circumstances that prompted the medical treatment sought by PPI's minor patients, although we note that Appellees have not specifically alleged that the patients are victims of offenses such as rape, incest, or child molesting committed by the use of force or by an adult. Regardless of whether the medical records might contain information regarding illegal sexual activity, we conclude that PPI's minor patients have a right of privacy in that information.

In so concluding, we find persuasive Judge Herrera's observations that a state cannot extinguish a federal privacy right by criminalizing certain conduct and that

a minor has a strong interest in maintaining a confidential relationship with his or her healthcare provider and not having the threat of disclosure of confidential information impede that relationship or serve as a deterrent to obtaining healthcare in the first place. Moreover, the privacy interest is even greater when it is viewed from the perspective of minors who are victims, and not perpetrators, of the criminalized conduct, because victims of criminal activity have a heightened expectation of privacy.

Aid for Women, 441 F.3d at 1125, 1128 (Herrera, J., dissenting) (citation omitted). Indeed, under Indiana law, child abuse reports are confidential and are not available to IMFCU. Ind.Code §§ 31-33-18-1, -2.

We also find persuasive Judge Herrera's observation that

[a] minor's expectation of privacy in his or her relationship with a healthcare provider is particularly compelling given the multiple state and federal protections for the confidentiality of the relationship. To whatever extent a statute gives notice of a lack of privacy regarding the conduct it criminalizes, it does not do so with respect to information about such conduct disclosed to healthcare providers. Thus, for example, an individual has no legitimate expectation that information about illegal drug use gathered in a police investigation would remain private, but a person consulting with a physician in an effort to seek treatment for drug addiction has a legitimate expectation of privacy as to that information.

Aid for Women, 441 F.3d at 1124 n. 6 (Herrera, J., dissenting) (citation omitted). Likewise here, we conclude that a minor consulting with a health care professional in an effort to seek treatment for a reproductive health condition related to sexual activity has a legitimate expectation of privacy as to that information.

That right is not unlimited, however, and must be balanced against IMFCU's interest in investigating patient neglect. See Fraternal Order of Police Lodge No. 5 v. City of Philadelphia, 812 F.2d 105, 110 (3rd Cir.1987) ("[T]here is no absolute protection against disclosure. Disclosure may be required if the government interest in disclosure outweighs the individual's privacy interest."). As the Third Circuit noted in Fraternal Order of Police, courts have taken various approaches in balancing these competing interests:

In addressing claimed violations of confidentiality interests, the Supreme Court has applied a flexible balancing approach. For example, in Nixon v. Administrator of General Services, 433 U.S. 425, 458, 97 S.Ct. 2777, 53 L.Ed.2d 867 (1977), the Court stated: "But the merit of appellant's claim of invasion of his privacy ... must be considered in light of the specific provisions of the Act, and any intrusion must be weighed against the public interest in subjecting the Presidential materials of appellant's administration to archival screening." Most circuits appear to apply an "intermediate standard of review" for the majority of confidentiality violations, see Barry v. City of New York, 712 F.2d 1554, 1559 (2d Cir.), cert. denied, 464 U.S. 1017, 104 S.Ct. 548, 78 L.Ed.2d 723 (1983), with a compelling interest analysis reserved for "severe intrusions" on confidentiality. See Thorne v. City of El Segundo, 726 F.2d 459, 469 (9th Cir. 1983), cert. denied, 469 U.S. 979, 105 S.Ct. 380, 83 L.Ed.2d 315 (1984); see also Whalen, 429 U.S. at 606-07, 97 S.Ct. 869 (Brennan, J., concurring) ("a statute that did effect such a [serious] deprivation [of privacy] would only be consistent with the Constitution if it were necessary to promote a compelling state interest"). But see Mangels v. Pena, 789 F.2d 836, 839 (10th Cir.1986) (compelling interest analysis for all privacy violations).

Id. (parallel citations omitted) (alterations in Fraternal Order of Police); see also Denius, 209 F.3d at 956 and n. 7 (discussing different balancing tests in confidentiality cases); United States v. Dist. of Columbia, 44 F.Supp.2d 53, 60-61 (D.C.Cir.1999) ("Various courts have developed slightly different tests to determine whether encroachment upon an individual's right to privacy rises to the level of a constitutional violation. In essence, however, all courts agree that the constitutionality of a government action that encroaches upon the privacy rights of an individual is determined by balancing the nature and extent of the intrusion against the government's interest in obtaining the information it seeks.") (citations omitted).

Given that the U.S. Supreme Court has thus far not applied a compelling interest analysis in addressing informational privacy claims, we choose to apply the flexible balancing test that was developed by the Third Circuit in Westinghouse, 638 F.2d 570, and has been followed by "[a] number of [its] sister circuits[.]" Denius, 209 F.3d at 956 n. 7. The Westinghouse court framed the test as follows:

The factors which should be considered in deciding whether an intrusion into an individual's privacy is justified are the type of record requested, the information it does or might contain, the potential for harm in any subsequent nonconsensual disclosure, the injury from disclosure to the relationship in which the record was generated, the adequacy of safeguards to prevent unauthorized disclosure, the degree of need for access, and whether there is an express statutory mandate, articulated public policy, or other recognizable public interest militating toward access.

Id. at 578.^[35]

In this case, IMFCU is demanding unlimited access to the medical records of seventy-three PPI patients, all of whom received "Medicaid-reimbursed services of a type usually only required by patients who are sexually active, such as prescriptions for birth control pills or other contraception and treatments for sexually transmitted diseases." Appellant's App. at 40. Those records may contain sensitive patient confidences and medical test results relating to their reproductive health and sexual history, which may or may not include sexual intercourse. The records may also contain—but are not required by law to contain—documentation that PPI employees either did or did not orally report suspected sexual abuse of a patient pursuant to Indiana law. Although the absence of such documentation would not conclusively establish that PPI failed to report the suspected abuse, either the absence or the presence thereof would, as the trial court concluded, "contribute to the entire body of evidence gathered by the IMFCU" during its investigation. Id. at 50 (conclusion 38).

Turning to the remaining factors, we believe that there is significant potential for harm in a subsequent nonconsensual disclosure, given the sensitive nature of the records at issue. We have already touched on the chilling effect that disclosure of the records would have upon PPI's patients, who might be reluctant to continue their relationship with PPI if they believed that their unredacted medical records were subject to disclosure. See Northwestern Mem'l Hosp. v. Ashcroft, 362 F.3d 923, 929 (7th Cir.2004) (stating that if hospital could not shield late-term abortion patients' records from disclosure in judicial proceedings, "the hospital will lose the confidence of its patients, and persons with sensitive medical conditions may be inclined to turn elsewhere for medical treatment").

As for the adequacy of safeguards to prevent unauthorized disclosure, IMFCU notes that it "has a duty to safeguard the privacy rights of individuals and provide safeguards to prevent misuse of information under its control." Appellees' Br. at 34 (citing 42 C.F.R. § 1007.11(f)). We first observe that the regulation itself suggests that individuals have a right to privacy in their medical information. That said, we are unaware of any civil or criminal penalties for a breach of IMFCU's duty to safeguard that right. Also, with respect to the medical records already in IMFCU's possession, the most that Appellees would say at oral argument is that they would be kept in IMFCU's office, which falls far short of the extensive precautions taken by New York's legislature and health department in Whalen.^[36] Moreover, there is no indication that IMFCU restricts access to the records to those involved in the investigation or that its employees have received any training in confidentiality regulations or procedures. Cf. Tucson Woman's Clinic v. Eden, 379 F.3d 531, 552 (9th Cir.2004) (making similar observations regarding regulatory scheme allowing Arizona Department of Health Services to access and retain copies of unredacted medical records of abortion clinic patients).

Regarding IMFCU's degree of need for access to the medical records, we first note that IMFCU is not one of the agencies to whom suspected child abuse must be reported, and it does not have access to such reports, which must be kept confidential. Thus, even if IMFCU had access to the patients' unredacted medical records, it is not altogether clear that it could confirm with the proper authorities whether (and by whom) an abuse report was actually made. If IMFCU could obtain such independent confirmation, then its degree of need for access to the medical records would be even lower. Appellees claim that IMFCU must be given access to the records in any event so that it can certify with the Office of Inspector General of the Department of Health and Human Services that it has complied with its duty to investigate complaints of patient neglect. Appellees' Br. at 13. We note, however, that 42 C.F.R. § 1007.11(b)(2) gives IMFCU the option of either investigating a complaint or referring it "to an appropriate criminal investigative or prosecutive authority[,]" such as a local law enforcement agency or a prosecutor's office that would have actual knowledge of whether an abuse report has been made in a particular case.^[37] The availability of this much less intrusive (and much more expeditious) option for investigating complaints of patient neglect militates against Appellees' claims of a vital need for IMFCU's access to the medical records of PPI's patients.

The availability of this option also diminishes the importance of any public policy or interest favoring IMFCU's access to the records. We readily acknowledge the significant public interest in investigating complaints of patient neglect and allegations of child sexual abuse. The foregoing discussion makes clear, however, that granting IMFCU unlimited access to patients' medical records is neither the only, nor the most effective, nor the least intrusive means of serving those interests.^[38] In view of these considerations, we conclude that PPI has demonstrated a reasonable likelihood of success at trial on the merits of its Fourteenth Amendment informational privacy claim.^[39]

This is not to say, however, that IMFCU's investigation must inevitably come to a halt. As stated above, IMFCU has the option of referring the complaint "to an appropriate criminal investigative or prosecutive authority." 42 C.F.R. § 1007.11(b)(2). Also, as mentioned at the beginning of this opinion, and as acknowledged by Appellees at oral argument, Indiana Code Section 4-6-10-3 authorizes the attorney general and an IMFCU investigator to "issue, serve, and apply to a court to enforce, a subpoena for a witness to appear before the attorney general in person to produce books, papers, or other records, including records stored in electronic data processing systems, for inspection and examination." Of course, such a subpoena would be subject to a motion to modify or a motion to quash based on informational privacy concerns.^[40] We have found precedent for limiting disclosure on that basis, which the court enforcing the subpoena would be well advised to consult before ruling on any such motion. See Alpha Medical Clinic, 128 P.3d at 379 (limiting disclosure of abortion patients' medical records);^[41]Kobrin, 479 N.E.2d at 681-82 (limiting disclosure of psychiatric patients' medical records).^[42] Allowing a neutral third party to review the requested medical records prior to disclosure will both allow IMFCU to pursue its neglect investigation and safeguard the privacy rights of PPI's minor patients.

Finally, we observe that the parties' arguments regarding informational privacy highlight the significant tensions inherent in the all-or-nothing positions that have brought the parties to this point. Both Appellees and PPI are acting in what they perceive to be the best interests of the minor patients at issue, and each is requesting to steer its own course without the interference of the other. In essence, Appellees argue, "Trust us—we will protect the patients' privacy rights during our investigation," while PPI argues, "Trust us—we are complying with the child abuse reporting statutes." Having concluded that PPI's minor patients have a limited right of privacy in the information contained in their medical records, we believe that the subpoena process will offer the best means of ensuring that the Medicaid laws are being followed and that the privacy rights of PPI's patients are being protected.

D. Public Interest

As our analysis of PPI's privacy claim makes clear, we believe that the public interest would not be disserved by upholding the informational privacy rights of PPI's minor patients in this case. There are less intrusive means by which IMFCU may determine whether PPI's minor patients were the victims of child abuse or neglect and whether PPI fulfilled its statutory duty to report.

E. Conclusion

In conclusion, we reverse the denial of PPI's request for preliminary injunction and remand for further proceedings consistent with this opinion. On remand, the trial court shall immediately enter a preliminary injunction in favor of PPI against IMFCU's demand for unlimited access to its patients' medical records. As for the medical records currently in IMFCU's possession, we hereby order IMFCU to return those records immediately to the trial court under seal pending resolution of the trial on the merits of PPI's informational privacy claim. Notwithstanding the preliminary injunction, IMFCU may still refer any neglect complaint "to an appropriate criminal investigative or prosecutive authority" pursuant to 42 C.F.R. § 1007.11(b)(2). Likewise, the attorney general and an IMFCU investigator may issue a subpoena for the medical records pursuant to Indiana Code Section 4-6-10-3.

Reversed and remanded.

NAJAM, J., concurs.

BARNES, J., concurs with separate opinion.

BARNES, Judge, concurring with separate opinion.

I agree with the majority that PPI's patients have a Fourteenth Amendment right to privacy in their medical records and that PPI has standing to assert that right on behalf of its patients. I write separately, however, to emphasize my belief that any IMFCU subpoena of PPI patients' medical records must at a minimum be reasonable as required by Oman v. State, 737 N.E.2d 1131, 1137 (Ind.2000), cert. denied, 534 U.S. 814, 122 S.Ct. 38, 151 L.Ed.2d 12 (2001).

Initially, however, I must make several assumptions regarding the IMFCU's statutory authority to conduct this investigation. First, I assume that a valid complaint was in fact made to the IMFCU before it began its investigation of PPI. As the majority notes, no complaint was included in Appellant's Appendix. Thus, I am left to speculate as to the contents of the complaint and wonder if such a complaint was made, was the impetus of the complaint a valid concern regarding protecting children, or some other agenda?

The affidavit of the IMFCU director, Allen Pope, lends little assistance in this regard. In it, Pope stated that he informed a representative of PPI that the "IMFCU wanted to review 73 patients' records at 19 PPI locations." App. p. 40. Pope further stated that he had reviewed the "Medicaid billing records for each of the 73 PPI patients whose records we seek, and according to those records each of those patients received, when they were under age 14, Medicaid reimbursed services of a type usually only required by patients who are sexually active . . . ." Id. Pope's affidavit makes no reference to a complaint. I wonder, then, how a complaint containing allegations of such a personal nature could provide a sufficient basis for the broad scope of the IMFCU's investigation. I must assume that a complaint was filed with the IMFCU alleging something to the effect that PPI failed to report the suspected sexual activity of seventy-three children under the age of fourteen at nineteen locations. This is a very big leap.

Second, I must assume that PPI's alleged failure to report suspected child abuse occurring outside of a health care facility, and not a health care provider's failure to care for a patient in a health care facility, is the type of neglect contemplated in 42 U.S.C. § 1396b(q)(4). Although I am inclined to consider the type of neglect anticipated by the statute as some omission more substantial than the alleged failure to report, such as the failure to provide adequate medical care or a safe environment for patients or the receipt of some sort of unauthorized payments, for the sake of this argument I assume that the IMFCU's "understanding" of neglect meets the statutory definition. Appellees' Br. p. 19.

Third, I assume that the IMFCU's review of the complaint indicated a substantial potential for criminal prosecution before it began its investigation. See 42 C.F.R. § 1007.11(b)(2) ("If the initial review indicates substantial potential for criminal prosecution, the unit will investigate the complaint or refer it to an appropriate criminal investigative or prosecutive authority."); see also 42 U.S.C. § 1396b(q)(4)(iii) (requiring the IMFCU to have procedures for acting upon such complaints under the criminal laws of Indiana or for referring such complaints to other State agencies). As the majority acknowledges, "even if IMFCU had access to the patient's unredacted medical records, it is not altogether clear that it could confirm with the proper authorities whether (and by whom) an abuse report was actually made." Slip op. at 43. This is because reports of suspected abuse are not made to the IMFCU and it does not have access to such confidential reports. See Ind.Code § 31-33-5-4; I.C. §§ 31-33-18-1, 31-33-18-2. Moreover, Indiana Code Section 31-33-5-4 requires that reports of abuse be made orally. Thus, I am extremely doubtful that there is a paper trail indicating that the suspected abuse was or was not reported because there need be no tangible record to reflect that.

Further, there is not a whit, not an iota, and not a scintilla of evidence in the record that PPI has failed to report suspected abuse. In fact, PPI president and CEO, Betty Cockrum, stated in her affidavit:

20. PPI is acutely aware that Indiana law provides that any child under the age of fourteen (14) who engages in sexual activity is the victim of child molesting and is therefore deemed to be a victim of abuse.

21. PPI is also aware that it has the obligation of reporting child abuse to the appropriate authorities, who are not the IMFCU.

22. We have steps to conduct audits of all of our records and patient contacts to make sure that we follow the law and abide this reporting requirement.

App. p. 30. In my opinion, based on this evidence and the statutory reporting requirements, the IMFCU's contention during our oral argument that the records may contain notations indicating that abuse was suspected but not reported amounts to idle speculation at best and a somewhat flimsy excuse to "investigate" at worst.

Similarly, the IMFCU's argument that its "right to investigate PPI's records is not dependent upon a prior evaluation of the records' worth as investigatory material[,]" is flawed. Appellees' Br. p. 26. Because of the dearth of evidence that is likely to be included in the patients' records regarding the report or failure to report suspected abuse, I find it highly improbable that the IMFCU's review of the complaint indicated a substantial potential for the criminal prosecution of PPI's alleged failure to report. In the probable absence of that information, I am not entirely convinced that 42 C.F.R. §. 1007.11(b)(2) authorizes IMFCU to investigate the complaint. However, for argument's sake, I will assume that the IMFCU's review of the complaint did in fact indicate a substantial likelihood of criminal prosecution, though that assumption is shaky at best.

Lastly, the IMFCU reminds us of the great public interest favoring the reporting, investigation, and prosecution of child abuse. To be clear, child molestation is a heinous crime that must be dealt with severely under our criminal statutes as they are written. Also, it is unfathomable, unacceptable, and abhorrent to me that a suspicion of child abuse goes unreported. However, it does not appear to me that the IMFCU is authorized to investigate or prosecute the criminal offenses of failing to report abuse or the underlying abuse itself. Presumably, such responsibility falls upon the local county prosecutors. Instead, I believe that the only function of the IMFCU is to investigate Medicaid fraud, the abuse of Medicaid patients, and the neglect of Medicaid patients. See 42 U.S.C. § 1396b(q); I.C. § 4-6-10-1.5; see also I.C. § 12-15-23-6 (describing to whom an IMFCU investigation may be referred).

As the Appellees point out, "Indiana's participation in the federal Medicaid program is conditioned upon the State's supplying sufficient protections against program abuse." Appellees' Br. p. 13. "Therefore, the IMFCU must remain functional for the State to remain in compliance with its Medicaid grant or risk grant revocation, which would leave Indiana without 65% of its Medicaid budget." Id. Given the IMFCU's lack of prosecutorial authority and the fact that it exists in part to ensure Indiana continues to receive Medicaid funding, I assume the IMFCU's investigation is based on its desire to secure continued federal Medicaid funding as well as a laudable goal of protecting children from abuse.

Based on these assumptions, I reluctantly agree with the majority that the IMFCU is authorized to investigate the complaint. I also agree unhesitatingly with the majority's conclusions that PPI has standing to assert its patients' Fourteenth Amendment right of privacy claims and that PPI's minor patients have a Fourteenth Amendment right of privacy in their medical records. Similarly, I agree that PPI has demonstrated a reasonable likelihood of success at trial. Finally, I agree that Indiana Code Section 4-6-10-3 authorizes an IMFCU investigator to issue a subpoena should the IMFCU desire to continue its investigation.

I also strongly believe, however, that any subpoena sought by the IMFCU must be carefully reviewed by a court and issued only under limited circumstances. As a matter of first impression, in In re Order for Indiana Bell to Disclose Records, 274 Ind. 131, 409 N.E.2d 1089 (1980), our supreme court decided whether a prosecutor acting without a grand jury may subpoena a witness to reveal information concerning the activities of a suspected felon. See Oman, 737 N.E.2d at 1137. The court held, "a prosecutor is not limited to issuing a grand jury subpoena to acquire evidence in a criminal case, but can, through an appropriate court, subpoena witnesses." Indiana Bell, 274 Ind. at 135, 409 N.E.2d at 1092.

Our supreme court refined this holding in Oman, in which Oman was the driver of one of two fire trucks that collided en route to a fire call. Oman, 737 N.E.2d at 1133. After the accident, Oman submitted to a urinalysis as a condition of his employment. Id. On a tip that Oman had tested positive for marijuana, a deputy prosecutor subpoenaed the lab for the test results, and Oman was charged with driving while intoxicated. Id. at 1133-34. Our supreme court was asked to address the scope of a prosecutor's investigative subpoena powers.

The Oman court first enunciated a new rule: "A prosecutor acting without a grand jury must seek leave of court before issuing a subpoena duces tecum to a third party for the production of documentary evidence." Id. at 1138. The court reached this conclusion relying on the plain language of the pertinent statute evincing a legislative intent for court involvement. Id. at 1136. Indiana Code Section 33-39-1-4(a) provides in part:

When a prosecuting attorney receives information of the commission of a felony or misdemeanor, the prosecuting attorney shall cause process to issue from a court (except the circuit court) having jurisdiction to issue the process to the proper officer, directing the officer to subpoena the persons named in the process who are likely to have information concerning the commission of the felony or misdemeanor.

(Emphasis added).

Indiana Code Section 4-6-10-3 authorizes an investigator of the IMFCU to issue, serve, and apply to a court to enforce a subpoena, and I believe the IMFCU must also seek leave of court when issuing a subpoena. I reach this conclusion based on what appears to be the heightening of judicial supervision of investigative subpoenas where the investigating authority has both investigative and accusatory duties. See Oman, 737 N.E.2d at 1140. Further, because the IMFCU may apply to a court to enforce a subpoena, this conclusion is consistent with Oman's directive that the reasonableness standard applies to "a party requesting a trial court to enforce, modify, or quash subpoenas duces tecum already issued." Id. at 1139.

Most importantly, judicial oversight would ensure that the IMFCU's investigative subpoenas are reasonable. As Oman recognized, "`fourth amendment requirements of probable cause have been interpreted as applicable to subpoenas duces tecum to the extent that the grand jury or prosecutor in issuing such subpoenas may not act arbitrarily or in excess of their statutory authority.'" Id. at 1139 (citation omitted). The court concluded, "a properly issued investigative subpoena—one that is reasonable under the Fourth Amendment—must only be: (1) relevant in purpose; (2) sufficiently limited in scope, and (3) specific in directive so that compliance will not be unreasonably burdensome." Id. at 1141.

In analyzing these factors, the Oman court first concluded that the subpoena at issue was sufficiently limited in scope because it only sought Oman's test results. Id. at 1147. The court also concluded that the subpoena was specific in directive and not unduly burdensome because the prosecutor only sought the results from the test taken on the day of the accident. Id. Finally, the court concluded that the subpoena was relevant in purpose to a valid criminal investigation. Id. In reaching this conclusion, the court observed that the subpoena was not used to gather information that formed the initial evidentiary basis for the criminal prosecution of the offense because the accident was documented in two different reports "that formed the requisite initial evidentiary basis for the prosecutor's legitimate inquiry into a possible DUI offense." Id. at 1147-48. The court emphasized:

A prosecutor's subpoena duces tecum issued to a third party for the production of an employer-mandated drug test result is not relevant in purpose to a valid criminal investigation if the employee's positive test result forms the initial evidentiary basis for charging an individual with the commission of a crime.

Id. at 1148. After analyzing these factors, our supreme court found that the subpoena of Oman's urinalysis results was reasonable. Id.

In my opinion, whether an IMFCU subpoena of PPI patients' medical records would be reasonable is a question yet to be resolved. This is especially true when considering that unlike Oman, who was suspected of committing a crime, the records sought here are the medical records of children thought to be possible victims of abuse, not the perpetrators. With that in mind and given the information before us today, I am skeptical that any subpoena would be sufficiently limited in scope and relevant in purpose to a valid criminal investigation.

First, as PPI points out, there may be many reasons why a person who is not sexually active would request birth control, which was one of the bases indicated by Pope for requesting the records. Accordingly, it appears to me that some of the services provided to PPI patients providing the basis for the IMFCU's investigation could be entirely unrelated to the alleged failure to report abuse. Thus, I believe it is uncertain whether the requests are sufficiently limited in scope so as to protect the alleged victims' privacy rights.

Second, unlike in Oman where there were two different reports documenting the accident before the prosecutor subpoenaed Oman's medical records, the IMFCU's investigation is based on a complaint whose contents are entirely unknown to anyone other than the IMFCU. With regard to the billing records referred to in Pope's affidavit, it is unclear to me how these provide the initial evidentiary basis for its investigation of neglect resulting from PPI's alleged failure to report suspected abuse. The mere fact that PPI prescribed birth control is not in and of itself evidence that it failed to report suspected abuse.

Although in its order the trial court focused on the burden imposed on PPI, I believe the proper focus, as it was in Oman, is the burden on PPI patients as a result of the disclosure of their medical records. The expectation of privacy in medical records is an expectation of constitutional proportion, as the majority clearly sets forth, and is not to be easily dismissed. In my opinion, the relevancy prong of the Oman test will need to be carefully considered to prevent the IMFCU from gaining unfettered access to and going on a "fishing expedition" in PPI patients' medical records.

In conclusion, assuming that the IMFCU is authorized to conduct its investigation, I agree with the majority that PPI's minor patients have a Fourteenth Amendment privacy right in their medical records. I also agree that should the IMFCU decline to refer the complaint to an appropriate criminal investigative or prosecutive authority and issue a subpoena as it is statutorily permitted to do, such subpoena would be subject to a motion to modify or a motion to quash based on informational privacy concerns. I would go one step further, however, and clearly require that any subpoena must be, at a minimum, reasonable as defined in Oman. In other words, before a subpoena is issued, I believe a court should be satisfied that (1) there is an independent basis for suspecting criminal wrongdoing and the records sought will be relevant to any such investigation; (2) disclosure of the records is sufficiently limited so as not to unduly infringe upon the constitutional rights of PPI patients; and (3) that the record's request is sufficiently specific so as to not be unreasonably burdensome to PPI.

NOTES

[1] See 42 C.F.R. § 1007.11(b)(2).

[2] See Ind.Code § 4-6-10-3. At oral argument, the solicitor general acknowledged that use of this subpoena process would not impede IMFCU's neglect investigation.

[3] While we share many of the concerns expressed by Judge Barnes in his concurring opinion, the current procedural posture of this case does not require that we determine whether the attorney general and IMFCU will be able to satisfy the Fourth Amendment subpoena requirements of Oman v. State, 737 N.E.2d 1131 (Ind.2000), cert. denied (2001), in order to obtain the medical records on remand. Judge Barnes's opinion should help the parties and the trial court as they review the criteria necessary for issuance of a valid subpoena.

[4] We heard oral argument on December 14, 2005. We thank the parties for their written and oral presentations.

[5] According to PPI president and CEO Betty Cockrum, "[i]n calendar year 2004, PPI served 7,969 Medicaid recipients and received $959,358 in reimbursement from Medicaid." Appellant's App. at 42 (supplemental affidavit).

[6] 42 U.S.C. § 1320a-7(b)(12) says that the Secretary of Health and Human Services may exclude from participation in the Medicaid program "[a]ny entity that fails to grant immediate access, upon reasonable request ... [t]o a State medicaid fraud control unit ... for the purpose of conducting activities described in [42 U.S.C. § 1396b(q)]." "Failure to grant immediate access" is defined in pertinent part as "the failure to produce or make available for inspection and copying requested records upon reasonable request, or to provide a compelling reason why they cannot be produced, within 24 hours of such request[.]" 42 C.F.R. § 1001.1301(a)(3). "Reasonable request" is defined in pertinent part as follows:

a written request for documents, signed by a designated representative of the ... State Medicaid fraud control unit, and made by a properly identified agent of ... a State Medicaid fraud control unit during reasonable business hours, where there is information to suggest that the individual or entity has violated statutory or regulatory requirements under titles V, XI, XVIII, XIX or XX of the Act. The request will include a statement of the authority for the request, the rights of the individual or entity in responding to the request, the definition of reasonable request and immediate access, and the effective date, length, and scope and effect of the exclusion that would be imposed for failure to comply with the request, and the earliest date that a request for reinstatement would be considered.

Id. We note that Pope's demand letter does not comply with 42 C.F.R. § 1001.1301(a)(3) in several respects, in that it does not include "the rights of the individual or entity in responding to the request, the definition of reasonable request and immediate access, and the effective date, length, and scope and effect of the exclusion that would be imposed for failure to comply with the request, and the earliest date that a request for reinstatement would be considered."

[7] PPI asserts that

[a]lthough the presence of a sexually transmitted disease could lead one to conclude that the patient had been sexually active, there are many reasons why a person who was not sexually active would nevertheless request birth control from PPI. For example, birth control pills can be used to: reduce symptoms associated with menstruation; alleviate the symptoms of premenstrual syndrome; reduce excessive body hair; alleviate iron deficiencies from heavy menses; cause shorter and lighter periods; help regulate irregular periods; treat ovarian cysts; reduce and prevent acne breakout; alleviate symptoms associated with fibroids; decrease the chance for getting certain ovarian and uterine cancers.

Appellant's Br. at 7 n. 4 (citations omitted). Appellees do not challenge this assertion.

[8] "Deviate sexual conduct" is "an act involving: (1) a sex organ of one person and the mouth or anus of another person; or (2) the penetration of the sex organ or anus of a person by an object." Ind.Code § 35-41-1-9. Child molesting also includes fondling or touching with the intent to arouse or to satisfy the sexual desires of either person. Ind.Code § 35-42-4-3(b).

[9] Indiana Code Section 31-9-2-133 defines "victim of child abuse or neglect" as follows:

(a) "Victim of child abuse or neglect", for purposes of ... IC 31-33, refers to a child in need of services as described in:

(1) IC XX-XX-X-X through IC XX-XX-X-X [IC XX-XX-X-X applies to victims of various sex offenses, including rape, criminal deviate conduct, child molesting, and incest];

(2) IC XX-XX-X-XX; or

(3) IC XX-XX-X-XX.

(b) The term does not include a child who is alleged to be a child in need of services if the child is alleged to be a victim of a sexual offense under IC XX-XX-X-X [child molesting] unless the alleged offense under IC XX-XX-X-X involves the fondling or touching of the buttocks, genitals, or female breasts.

See also Ind.Code § 31-9-2-14 (defining "child abuse or neglect" with similar limitations). Common to all the statutes describing "child in need of services" is the requirement that the child need "care, treatment, or rehabilitation that: (A) the child is not receiving; and (B) is unlikely to be provided or accepted without the coercive intervention of the court."

[10] PPI did not include a copy of the complaint in its appellant's appendix.

[11] The trial court's order indicates that IMFCU received a complaint regarding PPI. Appellant's App. at 7 (finding 8). We note, however, that neither the trial court's order nor Appellees' brief specifically states that IMFCU's initial review of the complaint "indicate[d] substantial potential for criminal prosecution," as would be required for an investigation conducted pursuant to 42 C.F.R. § 1007.11(b)(2).

[12] 42 C.F.R. § 488.301, which governs Medicaid surveys of long-term care facilities, defines "neglect" as "failure to provide goods and services necessary to avoid physical harm, mental anguish, or mental illness." Certainly, reporting suspected child abuse may be necessary to avoid physical harm or mental anguish.

[13] See Ind.Code § 35-46-1-4(a) ("A person having the care of a dependent, whether assumed voluntarily or because of a legal obligation, who knowingly or intentionally: (1) places the dependent in a situation that endangers the dependent's life or health; (2) abandons or cruelly confines the dependent; (3) deprives the dependent of necessary support; or (4) deprives the dependent of education as required by law; commits neglect of a dependent, a Class D felony.").

[14] We find it interesting, however, that Pope's affidavit regarding IMFCU's investigation does not mention a complaint, but rather the PPI patients' billing records. See Appellant's App. at 40.

[15] Consequently, we need not address Appellees' argument that IMFCU's investigation "may also uncover evidence of fraud on the theory that PPI's Medicaid reimbursement claims falsely certified compliance with statutory standards of care in cases where PPI failed to report abuse." Appellees' Br. at 25. Although an investigation may uncover any number of things, Appellees' after-the-fact fraud allegations may lead some to question the motives behind IMFCU's investigation of PPI.

[16] As previously mentioned, Pope's demand letter does not comply with applicable Medicaid regulations in several respects, in that it does not include "the rights of the individual or entity in responding to the request, the definition of reasonable request and immediate access, and the effective date, length, and scope and effect of the exclusion that would be imposed for failure to comply with the request, and the earliest date that a request for reinstatement would be considered." 42 C.F.R. § 1001.1301(a)(3). PPI does not challenge the propriety of IMFCU's investigation on this basis, however.

[17] 405 IAC 1-5-1(a) states, "Medicaid records must be of sufficient quality to fully disclose and document the extent of services provided to individuals receiving assistance under the provisions of the Indiana Medicaid program." 405 IAC 1-5-1(b) specifies "information and documentation" that must be included in the records, such as "[t]he identity of the individual to whom service was rendered[,]" "[t]he diagnosis of the medical condition of the individual to whom service was rendered," and "[a] detailed statement describing services rendered." We note that 405 IAC 1-5-1 does not specifically require documentation of a child abuse report, which must be made orally pursuant to Indiana Code Section 31-33-5-4.

[18] 42 U.S.C. § 1320a-7(b)(11) provides for an entity's exclusion from the Medicaid program based on a failure to provide information regarding payments for services or a refusal to permit an examination of its records to verify such information.

[19] One of the regulation's enabling statutes, 42 U.S.C. § 1396a(a)(27), says that a State plan must

provide for agreements with every person or institution providing services under the State plan under which such person or institution agrees (A) to keep such records as are necessary fully to disclose the extent of the services provided to individuals receiving assistance under the State plan, and (B) to furnish the State agency or the Secretary with such information, regarding any payments claimed by such person or institution for providing services under the State plan, as the State agency or the Secretary may from time to time request[.]

(Emphases added.) In view of the italicized language and the fact that a Medicaid fraud control unit must be "separate and distinct" from a state Medicaid agency, see 42 U.S.C. § 1396b(q)(2), it appears that 42 C.F.R. § 431.107(b) expands the scope of 42 U.S.C. § 1396a(a)(27) in several respects. PPI suggests as much in a footnote in its reply brief but makes no specific argument on this point. See Appellant's Reply Br. at 7 n. 2.

[20] The Medicaid provider agreement states that PPI agrees to do the following:

18. fully cooperate with federal and state officials and their agents as they conduct periodic inspections, reviews and audits.

19. make available upon demand by federal and state officials and their agents all records and information necessary to assure the appropriateness of Medicaid and CHIP [Children's Health Insurance Program] payments made to Provider, to assure the proper administration of the Medicaid Program and CHIP, and to assure Provider's compliance with all applicable statutes and regulations. [A non-exhaustive list of such records and information follows.]

Appellant's App. at 36-37. To the extent that the provider agreement appears to grant IMFCU more expansive investigatory powers than those granted under state and federal law, we note that "[w]hen the right to do a thing depends upon legislative authority, and the Legislature has failed to authorize it, or has forbidden it, no amount of acquiescence, or consent, or approval of the doing of it by a ministerial officer, can create a right to do the thing which is unauthorized or forbidden." Dep't of Ins. of Indiana v. Church Members Relief Ass'n, 217 Ind. 58, 60, 26 N.E.2d 51, 52 (1940).

[21] The Fourth Amendment states, "The right of the people to be secure in their persons, homes, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

[22] Because PPI's Fourth Amendment claim is premised on its unsuccessful argument that IMFCU has no statutory authority to conduct its investigation, we do not reach the question of whether IMFCU's request for records is a constitutionally permissible administrative search. See New York v. Burger, 482 U.S. at 699-703, 107 S.Ct. 2636 (discussing concept of and requirements for warrantless search of commercial premises in a "closely regulated" industry pursuant to a regulatory scheme); City of Indianapolis v. Edmond, 531 U.S. 32, 37, 121 S.Ct. 447, 148 L.Ed.2d 333 (2000) ("We have also allowed searches for certain administrative purposes without particularized suspicion of misconduct, provided that those searches are appropriately limited.").

[23] The Fourteenth Amendment provides in relevant part that no state shall "deprive any person of life, liberty, or property, without due process of law[.]"

[24] The Tenth Circuit noted that "minors are generally not legally sophisticated and are often unable even to maintain suits without a representative or guardian." Aid for Women, 441 F.3d at 1114. The court further noted that "minors may be hindered by the fear of reprisal from parents should information about their sexual activity be disclosed." Id.

[25] In his renowned dissent in Olmstead, Justice Brandeis wrote,

The makers of our Constitution undertook to secure conditions favorable to the pursuit of happiness. They recognized the significance of man's spiritual nature, of his feelings and of his intellect. They knew that only a part of the pain, pleasure and satisfactions of life are to be found in material things. They sought to protect Americans in their beliefs, their thoughts, their emotions and their sensations. They conferred, as against the government, the right to be let alone—the most comprehensive of rights and the right most valued by civilized men.

Olmstead, 277 U.S. at 478, 48 S.Ct. 564 (Brandeis, J., dissenting).

[26] In J.P., the Sixth Circuit stated,

Absent a clear indication from the Supreme Court we will not construe isolated statements in Whalen and Nixon more broadly than their context allows to recognize a general constitutional right to have disclosure of private information measured against the need for disclosure. Analytically we are unable to see how such a constitutional right of privacy can be restricted to anything less than the general "right to be let alone" that Justice Brandeis called for in [Olmstead].

J.P., 653 F.2d at 1089-90 (footnote omitted). Appellees point to the circuit split on this issue but fail to acknowledge that the Sixth Circuit espouses what appears to be the minority view.

[27] The Ninth Circuit has also recognized such a right. See, e.g., Norman-Bloodsaw v. Lawrence Berkeley Lab., 135 F.3d 1260, 1269 (9th Cir.1998) ("The constitutionally protected privacy interest in avoiding disclosure of personal matters clearly encompasses medical information and its confidentiality.").

[28] In Whalen, the U.S. Supreme Court noted that "[t]he cases sometimes characterized as protecting `privacy' have in fact involved at least two different kinds of interests. One is the individual interest in avoiding disclosure of personal matters, and another is the interest in independence in making certain kinds of important decisions." 429 U.S. at 599-600, 97 S.Ct. 869 (footnotes omitted). PPI specifically addresses only the former in its brief, although, as indicated below, there is some overlap among informational and decisional privacy issues with respect to the reproductive health care of PPI's patients.

[29] In this case, we need not address whether a right of privacy in medical information exists under Article 1, Section 1 of the Indiana Constitution, which states that "all people" have "certain inalienable rights; that among these are life, liberty, and the pursuit of happiness[.]" According to our supreme court, the right of privacy "is a well-established doctrine, derived from natural law and guaranteed by both the Federal and State Constitutions." Voelker v. Tyndall, 226 Ind. 43, 45, 75 N.E.2d 548, 549 (1947).

[30] Neither party's brief mentions the federal Health Insurance Portability and Accountability Act ("HIPAA"), enacted by Congress in 1996, which "protects individuals from unwarranted dissemination of medical and mental health records without consent." In re Involuntary Termination of Parent Child Relationship of A.H., 832 N.E.2d 563, 567 (Ind.Ct. App.2005). "The statute restricts access to medical records without the individual's direct consent. However, exceptions do exist, which include the reporting of child abuse." Id. at 567-68 (citing 45 C.F.R. § 164.512). "Additionally, it is apparent that the provisions of HIPAA override or preempt State laws." Id. at 568 (citing 45 C.F.R. § 160.203). At oral argument, both parties stated that HIPAA does not apply in this case. Nevertheless, HIPAA indicates that Congress has recognized the vital importance of, if not a constitutional right to, personal privacy with respect to medical information.

[31] See United States v. Westinghouse Elec. Corp., 638 F.2d at 576 ("Proliferation in the collection, recording and dissemination of individualized information has made the public, Congress and the judiciary increasingly alert to the threat such activity can pose to one of the most fundamental and cherished rights of American citizenship, falling within the right characterized by Justice Brandeis as `the right to be let alone.' Much of the concern has been with governmental accumulation of data and the ability of government officials to put information technology to uses detrimental to individual privacy, which have been facilitated by the spread of data banks and by the increasing storage in computers of sensitive information relating to the personal lives and activities of private citizens.") (citing Olmstead, 277 U.S. at 478, 48 S.Ct. 564 (Brandeis, J., dissenting)).

[32] See Aid for Women v. Foulston, 327 F.Supp.2d 1273 (D.Kan.2004), vacated and remanded by 441 F.3d 1101 (10th Cir.2006).

[33] The district court quickly disposed of the plaintiffs' remaining constitutional claims, concluding that the reporting statute "is not vague, does not implicate equal protection concerns, and does not invade decisional privacy." Aid for Women II, 427 F.Supp.2d at 1104.

[34] The district court concluded that the Kline Opinion contradicted the plain language of the reporting statute. See Aid for Women II, 427 F.Supp.2d at 1102 ("If `injury' is the equivalent of `sexual abuse,' as the Attorney General contends, then the requirement of an `injury' in the reporting statute is rendered meaningless. The statutory language does not require reporting of all illegal sexual activity of minors; it requires reporting of such sexual activity if there is `reason to suspect injury.' Therefore, the statute requires reporting of all illegal sexual activity that causes injury, not all illegal sexual activity.").

[35] In applying the Third Circuit's Westinghouse test, a panel of the Ninth Circuit stated,

This list is not exhaustive, and the relevant considerations will necessarily vary from case to case. In each case, however, the government has the burden of showing that its use of the information would advance a legitimate state interest and that its actions are narrowly tailored to meet the legitimate interest. In most cases, it will be the overall context, rather than the particular item of information, that will dictate the tipping of the scales.

In re Crawford, 194 F.3d 954, 959 (9th Cir. 1999) (citation and quotation marks omitted). We see no reason to supplement the Westinghouse "list" in this case.

[36] The prescription forms at issue in Whalen were computerized and stored in a vault in the receiving room "for a five-year period and then destroyed as required by the statute." Whalen, 429 U.S. at 593, 97 S.Ct. 869 (footnote omitted).

The receiving room is surrounded by a locked wire fence and protected by an alarm system. The computer tapes containing the prescription data are kept in a locked cabinet. When the tapes are used, the computer is run "off-line," which means that no terminal outside of the computer room can read or record any information. Public disclosure of the identity of patients is expressly prohibited by the statute and by a Department of Health regulation. Willful violation of these prohibitions is a crime punishable by up to one year in prison and a $2,000 fine.

Id. at 594-95, 97 S.Ct. 869 (footnotes omitted). The Whalen court noted that there was "no support in the record ... for an assumption that the security provisions of the statute will be administered improperly." Id. at 601, 97 S.Ct. 869 (footnote omitted). Here, the trial court found no basis for making such an assumption, although it did express some concern in this regard. See Appellant's App. at 23 ("Although of some concern to the court, there is no evidence that the IMFCU mishandles or is likely to mishandle the documents and information it receives from physicians and clinics.") (conclusion 52).

[37] Once again, we note that Pope's affidavit regarding IMFCU's investigation does not mention a complaint, but rather the PPI patients' billing records. If in fact the complainant(s) had reason to believe that the patients were victims of child abuse and that PPI did not report the abuse, we trust that the complainant(s) reported the suspected abuse as required by law. See Ind.Code § 31-33-5-3 ("This chapter does not relieve an individual of the obligation to report on the individual's own behalf, unless a report has already been made to the best of the individual's belief.").

[38] In Planned Parenthood of Central Missouri v. Danforth, 428 U.S. 52, 96 S.Ct. 2831, 49 L.Ed.2d 788, mentioned in Aid for Women, the U.S. Supreme Court addressed the constitutionality of a statute that required, among other things, written parental consent to the abortion of an unmarried woman under age eighteen during the first twelve weeks of pregnancy unless the abortion was necessary to preserve the mother's life. The majority held that the state could not impose such a "blanket provision[.]" noting that

[c]onstitutional rights do not mature and come into being magically only when one attains the state-defined age of majority. Minors, as well as adults, are protected by the Constitution and possess constitutional rights. The court indeed, however, long has recognized that the State has somewhat broader authority to regulate the activities of children than of adults. It remains, then, to examine whether there is any significant state interest in conditioning an abortion on the consent of a parent or person in loco parentis that is not present in the case of an adult.

Id. at 74-75, 96 S.Ct. 2831 (citations omitted). The majority concluded that there was not. In Carey v. Population Services, International, 431 U.S. 678, 97 S.Ct. 2010, 52 L.Ed.2d 675, the plurality used similar language in addressing the constitutionality of a statute prohibiting distribution of contraceptives to persons under age sixteen. See id. at 693, 97 S.Ct. 2010 ("State restrictions inhibiting privacy rights of minors are valid only if they serve `any significant state interest . . . that is not present in the case of an adult.'") (quoting Planned Parenthood of Central Mo., 428 U.S. at 75, 96 S.Ct. 2831). In this case, we can think of no significant state interest in requiring full disclosure of a minor's medical information in a Medicaid patient neglect investigation that is not present in the case of an adult.

[39] Appellees suggested for the first time at oral argument that PPI's minor patients waived their informational privacy rights when they applied for the Medicaid program. There is no evidence in the record regarding the terms and conditions of any such waiver. While it seems clear that disclosure of certain personal information is necessary to facilitate the operation and oversight of the Medicaid program, we note that "any waiver of an individual's right to privacy justifies an invasion only to the extent warranted by the circumstances which brought about the waiver." Pohle v. Cheatham, 724 N.E.2d 655, 659 (Ind. Ct.App.2000).

[40] Our supreme court has stated that "[a] reasonable investigative subpoena duces tecum is one that is (1) sufficiently limited in scope, (2) relevant in purpose, and (3) specific in directive so that compliance will not be unreasonably burdensome." Oman, 737 N.E.2d at 1147.

[41] See Alpha Medical Clinic, 128 P.3d at 379 ("Only if [the district judge] is satisfied that the attorney general is on firm legal ground should he permit the inquisition to continue and some version of the subpoenas to remain in effect. Then he must also enter a protective order that sets forth at least the following safeguards: (1) Petitioners' counsel must redact patient-identifying information from the files before they are delivered to the judge under seal; (2) the documents should be reviewed initially in camera by a lawyer and a physician or physicans appointed by the court, who can then advise the court if further redactions should be made to eliminate information unrelated to the legitimate purposes of the inquisition. This review should also determine whether any of the files demonstrate nothing more than the existence of a reasonable medical debate about some aspect of the application of the criminal abortion and/or mandatory child abuse reporting statutes, which the attorney general's office has already acknowledged would not constitute a crime. If so, those files should be returned to petitioners; and (3) any remaining redacted files should be turned over to the attorney general,"; district judge could later approve subpoenas for patient-identifying information if necessary).

[42] See Kobrin, 479 N.E.2d at 681 ("Because their unrestricted production would implicate privacy interest without being necessary to a determination whether the Medicaid program has been defrauded, the `communications' of Dr. Kobrin's patients warrant protection. But the scope of protected `communications' in the context of a Medicaid fraud investigation may not be so broad as to embrace that information `necessary to satisfy the important public interest in seeing that Medicaid funds are properly applied.'") (citation omitted).