Association of American Physicians & Surgeons, Inc. v. United States Department of Health & Human Services

224 F.Supp.2d 1115 (2002)

The ASSOCIATION OF AMERICAN PHYSICIANS & SURGEONS, INC., et al., Plaintiffs,
v.
UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES, et al., Defendants.

Civ. A. No. H-01-2963.

United States District Court, S.D. Texas, Houston Division.

June 17, 2002.

Karen Bryant Tripp, Houston, TX, Andrew Schlafly, AAPS General Counsel, Far Hills, NJ, for Plaintiffs.

Elizabeth J. Shapiro, U.S. Dept. of Justice, Civ. Div., Washington, DC, for Defendants.

MEMORANDUM AND ORDER

LAKE, District Judge.

Plaintiffs, The Association of American Physicians & Surgeons, Inc., Congressman Ron Paul, M.D., Dawn Richardson, Rebecca Rex, and Darrell McCormick, filed this action against defendants, the United States Department of Health and Human Services ("HHS") and Tommy G. Thompson, as Secretary of HHS, challenging the privacy regulations promulgated by HHS under Title II, Subtitle F, §§ 261-64 of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub.L. No. 104-191, 110 Stat.1936 (1996). Plaintiffs allege that the privacy regulations go beyond the legislative scope of HIPAA and violate the First, Fourth, and Tenth Amendments to the Constitution, the Regulatory Flexibility Act ("RFA"), 5 U.S.C. §§ 601 et seq., and the Paperwork Reduction Act ("PRA"), 44 U.S.C. §§ 3501 et seq. Plaintiffs seek declaratory relief and attorneys' fees. Pending before the court is Defendants' Motion to Dismiss (Docket Entry No. 10). For the reasons set forth below, defendants' motion will be granted.

I. Standard of Review

The Federal Rules of Civil Procedure authorize a court, upon suitable showing, to dismiss any action or any claim within an action for lack of subject matter jurisdiction or for failure to state a claim upon which relief can be granted. Fed.R.Civ.P. 12(b)(1) and 12(b)(6). Plaintiffs bear the burden of proof that jurisdiction exists. Menchaca v. Chrysler Credit Corp., 613 F.2d 507, 511 (5th Cir.1980). When a Rule 12(b)(1) motion is filed in conjunction with other Rule 12 motions, the court should consider the Rule 12(b)(1) jurisdictional attack before addressing any attacks on the merits. Hitt v. City of Pasadena, 561 F.2d 606, 608 (5th Cir.1977) (per curiam). Lack of subject matter jurisdiction may be determined from (1) the complaint alone, (2) the complaint supplemented by undisputed facts evidenced in the record, or (3) the complaint supplemented by undisputed facts plus the court's resolution of disputed facts. Barrera-Montenegro v. United States, 74 F.3d 657, 659 (5th Cir.1996).

In considering a motion to dismiss under Rule 12(b)(6), the district court must construe the allegations in the complaint favorably to the pleader and must accept as true all well-pleaded facts in the complaint. See Lowrey v. Texas A & M Univ. Sys., 117 F.3d 242, 247 (5th Cir.1997); Malina v. Gonzales, 994 F.2d 1121, 1125 (5th Cir. 1993). Unlike a motion for summary judgment, but similar to a motion under Rule 12(b)(1), dismissal of a claim should be granted only if "it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief." Torres de Maquera v. Yacu Runa Naviera S.A., 107 F.Supp.2d 770, 774 (S.D.Tex.2000). See Conley v. Gibson, 355 U.S. 41, 78 S.Ct. 99, 101-102, 2 L.Ed.2d 80 (1957); Tuchman v. DSC Communications Corp., 14 F.3d 1061, 1067 (5th Cir.1994).

In order for a plaintiff to prevail against a motion to dismiss, "the complaint must contain either direct allegations on every material point necessary to sustain a recovery ... or contain allegations from which an inference fairly may be drawn that evidence on these material points will be introduced at trial." 5 Charles Alan Wright & Arthur R. Miller, FEDERAL PRACTICE AND PROCEDURE: CIVIL 2d § 1216 at 156-159 (footnote omitted). "[A] statement of facts that merely creates a suspicion that the pleader might have a right of action" is insufficient. Id. at 163. Dismissal is proper if the complaint lacks an allegation regarding a required element necessary to obtain relief. Campbell v. City of San Antonio, 43 F.3d 973, 975 (5th Cir.1995). Conclusory allegations or legal conclusions masquerading as factual conclusions will not suffice to prevent a motion to dismiss. Fernandez-Montes v. Allied Pilots Ass'n, 987 F.2d 278, 284 (5th Cir.1993).

II. Background

Congress, in order to "improve portability and continuity of health insurance coverage in the group and individual markets,"^[1] enacted HIPAA on August 21, 1996. Pub.L. No. 104-191, 110 Stat.1936 (1996). Subtitle F of Title II of HIPAA is entitled "Administrative Simplification," and states that the purpose of the subtitle is to improve health care by "encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information." 110 Stat.2021. In light of this envisioned computerization and increased electronic transmission of health information, and recognizing the concomitant need to guarantee certain protections to patients' privacy, Congress included section 264 within Subtitle F, Title II of HIPAA. Section 264(a) instructs HHS to provide Congress with "recommendations on standards with respect to the privacy of individually identifiable health information" within twelve months of HIPAA's enactment date. Subsection (b) of Section 264 directs HHS to make recommendations concerning "at least" the following subjects:

(1) The rights that an individual who is a subject of individually identifiable health information should have.

(2) The procedures that should be established for the exercise of such rights.

(3) The uses and disclosures of such information that should be authorized or required.

101 Stat.2033.

Section 264(c) states that if Congress should fail to enact legislation governing "standards with respect to the privacy of individually identifiable health information" within 36 months of the enactment of HIPAA, HHS shall promulgate "final regulations" containing such privacy standards not later than 42 months after the enactment of HIPAA. Such HHS regulations shall "not supercede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation." 110 Stat.2033-34.

By August 21, 1999, Congress had not enacted privacy standards pursuant to HIPAA. Accordingly, on November 3, 1999, HHS issued a notice of proposed rulemaking. After receiving approximately 52,000 public comments, and following the publication of several proposed rules and amendments, on February 13, 2001, HHS promulgated final regulations (the "Privacy Rule"). Although the effective date of the Privacy Rule was April 14, 2001, covered entities were given two years, or until April 14, 2003, to come into compliance with the Privacy Rule. Smaller health plans and entities were given three years, or until April 14, 2004, to comply. Following publication of the Privacy Rule, and in response to further public comments, HHS published on its website additional guidance concerning the Rule's practical impact.^[2]

Plaintiffs in this action challenge the constitutionality and statutory validity of the Privacy Rule. The Association of American Physicians & Surgeons, Inc. ("AAPS") is a professional, non-profit, national organization with numerous physician and patient members. Ron Paul is a physician and member of the United States Congress from the state of Texas. Dawn Richardson and Rebecca Rex are "patients" in Austin, Texas, who are also officers of Parents Requesting Open Vaccine Education ("P.R.O.V.E."), a Texas-based, non-profit organization. Darrell McCormick is a "patient" in Gainesville, Florida, who is the former billing manager for approximately 500 physicians at the Shands Healthcare System at the University of Florida in Gainesville, Florida.

III. Plaintiffs' Claims

Plaintiffs claim that the Privacy Rule, as established by HHS pursuant to Subtitle F, Title II of HIPAA, violates the Fourth Amendment's prohibition against unreasonable government searches and seizures. While plaintiffs acknowledge that the Privacy Rule expressly reiterates the importance of maintaining patients' expectation of privacy in their medical records, they complain that the Rule simultaneously gives the government "virtually unrestricted access" to these medical records without a warrant. Plaintiffs allege that the Privacy Rule also requires physicians to aid governmental searches of patient medical records in violation of the Fourth Amendment and facilitates the construction of a centralized government database of personal health information without patient consent.

Plaintiffs also challenge the Privacy Rule under the First and Tenth Amendments to the Constitution, alleging that the Rule has a chilling effect on patient-physician communications and that the regulations go beyond Congress's commerce power authority by intruding into local, private activities involving physicians and patients that lack any nexus to interstate commerce.

Plaintiffs also allege that HHS overreached its statutory mandate under HIPAA by extending the provisions of the Privacy Rule to cover more than electronic transmissions of health information. Plaintiffs claim that although HIPAA only authorized HHS to promulgate standards for electronic transfers of information, the Privacy Rule purports to regulate paper and all other forms of health information storage media. Plaintiffs also allege that because HHS failed to publish the Privacy Rule within the 42-month period required by Congress, HHS forfeited its statutory delegation of power after February 21, 2000 — 42 months after HIPAA's enactment. Plaintiffs also claim that the Privacy Rule violates the Regulatory Flexibility Act ("RFA"), 5 U.S.C. §§ 601 et seq., and the Paperwork Reduction Act ("PRA"), 44 U.S.C. §§ 3501 et seq., by failing to estimate properly the "enormous regulatory burden" that the Rule imposes on small medical practices and by failing to consider more cost-effective alternatives.^[3]

Plaintiffs seek a declaratory judgment that the Privacy Rule is unconstitutional to the extent that it violates the First, Fourth, and Tenth Amendments to the Constitution. Plaintiffs also seek a declaratory judgment that the Rule violates the RFA, the PRA, and the limited scope of HIPAA.

IV. Defendants' Motion to Dismiss

Defendants argue that plaintiffs' claims should be dismissed for lack of subject matter jurisdiction or for failure to state a claim on which relief may be granted. Defendants argue that the court has no jurisdiction over plaintiffs' First and Fourth Amendment claims because plaintiffs lack standing to assert these claims and because these claims are not ripe for judicial review. Defendants argue that the court should dismiss plaintiffs' Tenth Amendment claims because the regulation of health care is well within Congress's Commerce Clause power and because only states, and not private individuals, may properly bring suit under the Tenth Amendment.

Defendants argue that plaintiffs' statutory claims should be dismissed under Rule 12(b)(6) because Congress did not limit HHS's rulemaking authority under HIPAA to electronic transactions. Defendants argue that plaintiffs' procedural claims fail because HHS complied with the RFA by thoroughly and reasonably evaluating the impact of the Privacy Rule on small businesses. Finally, defendants argue that plaintiffs have no claim under the PRA because the sole remedy provided by that statute is the ability to raise noncompliance with the PRA as a defense to an enforcement action. Because no enforcement action has been commenced, defendants argue that plaintiffs' PRA claims are premature.

A. Fourth Amendment Claims

The Fourth Amendment to the United States Constitution states that "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated." Plaintiffs allege that the Privacy Rule violates this prohibition against unreasonable searches and seizures by allowing the government to access private patient medical records without a warrant. Plaintiffs also allege that the Privacy Rule requires physicians to turn over to the government medical records in which patients and physicians have a reasonable expectation of privacy. Plaintiffs argue that the Privacy Rule authorizes "mandatory" unwarranted disclosures to government entities.

1. Ripeness

Article III of the Constitution confines federal courts to the decision of "cases" and "controversies." A case or controversy must be ripe for decision, meaning that it must not be premature or speculative. United Transportation Union v. Foster, 205 F.3d 851, 857 (5th Cir.2000). Ripeness is a constitutional prerequisite to the exercise of federal jurisdiction. Abbott Laboratories v. Gardner, 387 U.S. 136, 87 S.Ct. 1507, 1515, 18 L.Ed.2d 681 (1967).

A suit for declaratory relief, while allowing a party to anticipate a suit and seek a judicial resolution, must nevertheless meet this jurisdictional limitation. A declaratory action must be ripe in order to be justifiable, and is ripe only where an "actual controversy" exists. 28 U.S.C. § 2201(a) ("In a case of actual controversy within its jurisdiction ..."). An actual controversy exists where "a substantial controversy of sufficient immediacy and reality exists between parties having adverse legal interests." Orix Credit Alliance, Inc. v. Wolfe, 212 F.3d 891, 896 (5th Cir.2000).

The Fifth Circuit has enunciated the standard for evaluating ripeness: "A court should dismiss a case for lack of `ripeness' when the case is abstract or hypothetical. The key considerations are `the fitness of the issues for judicial decision and the hardship to the parties of withholding court consideration.'" New Orleans Pub. Serv., Inc. v. Council of New Orleans, 833 F.2d 583, 586 (5th Cir.1987) (citations omitted). Among the factors to be considered are: (1) whether the issues are purely legal; (2) whether the issues are based on final agency action; (3) whether the controversy has a direct and immediate impact on the plaintiff; and (4) whether the litigation will expedite, rather than delay or impede, effective enforcement by the agency. Dresser Industries, Inc. v. United States, 596 F.2d 1231, 1235 (5th Cir.1979).

2. Standing

Standing to sue or defend is another aspect of Article III's case-or-controversy requirement for federal jurisdiction. Northeastern Fla. Chapter, Associated Gen. Contractors of America v. Jacksonville, 508 U.S. 656, 113 S.Ct. 2297, 2301-2302, 124 L.Ed.2d 586 (1993) (standing to sue); Diamond v. Charles, 476 U.S. 54, 106 S.Ct. 1697, 1700, 90 L.Ed.2d 48 (1986) (standing to defend on appeal). To qualify as a party with standing to litigate, a person must show "an invasion of a legally protected interest" that is "concrete and particularized" and "actual or imminent." Lujan v. Defenders of Wildlife, 504 U.S. 555, 112 S.Ct. 2130, 2136, 119 L.Ed.2d 351 (1992) (quoting Whitmore v. Arkansas, 495 U.S. 149, 110 S.Ct. 1717, 1722-1723, 109 L.Ed.2d 135 (1990)); Association of Cmty. Orgs. for Reform v. Fowler, 178 F.3d 350, 358 (5th Cir.1999) (injury alleged by a plaintiff for standing purposes must be "`concrete and particularized and actual or imminent, not conjectural or hypothetical' to pass constitutional muster"). An interest shared generally with the public at large in the proper application of the Constitution and laws will not suffice. See Lujan, 112 S.Ct. at 2143-2154. Standing to sue demands that the litigant possess "a direct stake in the outcome." Diamond, 106 S.Ct. at 1703 (quoting Sierra Club v. Morton, 405 U.S. 727, 92 S.Ct. 1361, 1369, 31 L.Ed.2d 636 (1972) (internal quotation marks omitted)). The doctrine of standing

embraces several judicially self-imposed limits on the exercise of federal jurisdiction, such as the general prohibition on a litigant's raising another person's legal rights, the rule barring adjudication of generalized grievances more appropriately addressed in the representative branches, and the requirement that a plaintiff's complaint fall within the zone of interests protected by the law invoked.

Id. (citing Valley Forge Christian College v. Americans United for Separation of Church and State, Inc., 454 U.S. 464, 102 S.Ct. 752, 760, 70 L.Ed.2d 700 (1982)). Standing, at its "irreducible constitutional minimum," requires a plaintiff "to demonstrate: they have suffered an `injury in fact'; the injury is `fairly traceable' to the defendant's actions; and the injury will `likely ... be redressed by a favorable decision.'" Public Citizen, Inc. v. Bomer, 274 F.3d 212, 217 (5th Cir.2001) (quoting Lujan, 112 S.Ct. at 2136).

3. Plaintiffs Have Not Established Ripeness or Standing

Defendants argue that plaintiffs' Fourth Amendment claims are speculative and hypothetical because plaintiffs have not yet suffered any concrete injury from enforcement of the Privacy Rule. Defendants also argue that chances are extremely remote that plaintiffs will ever be affected by the Rule. The court agrees. Plaintiffs have not alleged that the government has accessed their medical records pursuant to the Privacy Rule, nor have they alleged that they were actually harmed as a result of any access of their records.

A number of unlikely events must occur in order for plaintiffs to sustain an injury. The Secretary of HHS would have to elect to exercise his oversight responsibilities pursuant to 45 C.F.R. § 160.310(c) to request access to protected health information. The Secretary would then have to proceed directly against the specific covered entity that possessed the protected health information of the plaintiffs. Even in such a scenario, plaintiffs' particular health information might not be accessed or disclosed. It is therefore highly speculative and unlikely that plaintiffs would ever be injured by the Privacy Rule.

Plaintiffs also allege that the Privacy Rule violates the Fourth Amendment by requiring physicians to turn over to the government medical records in which patients and physicians have a reasonable expectation of privacy. Plaintiffs argue that the Privacy Rule authorizes "mandatory" unwarranted disclosures to government entities. Because these "unwarranted disclosures" have not yet occurred and plaintiffs have suffered no actual injury, the court concludes that plaintiffs lack standing to pursue this claim, and the claim is not ripe for review.^[4]

Defendants also argue that this action is premature because actual compliance with the Privacy Rule is not mandated until April 14, 2003 (or April 14, 2004, in the case of small health care entities). Until that time HHS may promulgate new rules related to the Privacy Rule that would render plaintiffs' complaints moot. Given the possibility of intervening agency action, for the court now to adjudicate plaintiffs' claims in their present pre-enforcement stage would pose a risk that the court would render an impermissible advisory opinion. See Life Partners, Inc. v. Life Ins. Co. of N. America, 203 F.3d 324, 325 (5th Cir.1999) ("Federal courts do not render advisory opinions."); United Public Workers of America (C.I.O.) v. Mitchell, 330 U.S. 75, 67 S.Ct. 556, 564, 91 L.Ed. 754 (1947) (same).

Plaintiffs have not persuasively shown that enforcement of the Privacy Rule has had or will imminently have a "direct and immediate impact" on plaintiffs. See Dresser Industries, 596 F.2d at 1235. Nor have plaintiffs shown that the Privacy Rule constitutes an invasion of a "concrete and particularized" legally protected interest. Lujan, 112 S.Ct. at 2136. Moreover, plaintiffs will suffer no hardship if the court does not consider their claims. Because there has been no government attempt to access plaintiffs' medical records, plaintiffs have not experienced any unwarranted invasion of their privacy.

The court concludes that plaintiffs' pre-enforcement Fourth Amendment claims are premature and not ripe for judicial review. See Foster, 205 F.3d at 858-59 (refusing to grant pre-enforcement review of newly enacted Louisiana railroad safety statutes when plaintiffs' alleged injury was conjectural and speculative); Shields v. Norton, 289 F.3d 832, 836-37 (5th Cir.2002) (no specific, concrete threat sufficient to establish ripe controversy since threat hinged upon contingencies not easily anticipated). The court also concludes that plaintiffs have failed to allege any "injury in fact" related to HHS's promulgation of the Privacy Rule, and that plaintiffs therefore lack standing to challenge the alleged constitutionality of the Privacy Rule under the Fourth Amendment.^[5]See, e.g., Henderson v. Stalder, 287 F.3d 374, 380 (5th Cir.2002).

B. First Amendment Claims

Plaintiffs also allege that as a result of increased government access to patient-physician records, the Privacy Rule has a "chilling effect" on patients' communications with their physicians. Nowhere in their complaint, however, do plaintiffs allege that their own communications with their physicians have been chilled in a meaningful way as a result of the Privacy Rule. Plaintiffs have not been directly affected or harmed by the Privacy Rule; instead, they allege that the mere existence of the Rule makes them "reluctant" to speak freely with their physicians. Allegations of a subjective "chill" are not an adequate substitute for a claim of specific present harm or a threat of specific future harm. Meese v. Keene, 481 U.S. 465, 107 S.Ct. 1862, 1866-67, 95 L.Ed.2d 415 (1987); Poe v. City of Humble, Texas, 554 F.Supp. 233, 237 (S.D.Tex.1983) (mere allegation of subjective chill, without more, fails to establish Article III standing). See also Baker v. Carr, 369 U.S. 186, 82 S.Ct. 691, 703, 7 L.Ed.2d 663 (1962) (if plaintiffs themselves are not chilled, but seek only to represent those "millions" whom they believe are so chilled, they clearly lack that "personal stake in the outcome of the controversy" essential to standing).

In later papers plaintiffs appear to contend that enactment of the Privacy Rule has resulted in actual "chilling" of their communications with their health care providers. Plaintiff Richardson, for example, complains that she was personally injured by the Privacy Rule when she was confronted by an attorney from the Texas state health department who questioned her decision not to vaccinate her children against the chicken pox.^[6] Defendants respond, and the court agrees, that the Privacy Rule has no bearing on Texas or other state laws governing the vaccination of children or other health matters. Even if the Privacy Rule were invalidated, state laws would remain in effect, and the disclosures about which plaintiffs complain would continue. Because plaintiffs have not shown that the Privacy Rule itself has directly caused their alleged injuries, they have failed to establish any actual chill ensuing from the Privacy Rule.

Plaintiffs have failed to demonstrate any concrete, particularized, actual, or imminent "injury in fact" arising from enforcement of the Privacy Rule. See Warth v. Seldin, 422 U.S. 490, 95 S.Ct. 2197, 2210, 45 L.Ed.2d 343 (1975); Los Angeles v. Lyons, 461 U.S. 95, 103 S.Ct. 1660, 1665, 75 L.Ed.2d 675 (1983). Moreover, it is unlikely that the plaintiffs' alleged injuries can be "redressed by a favorable decision" in this case. See Lujan, 112 S.Ct. at 2136. Accordingly, plaintiffs lack standing to assert their First Amendment claims.

C. Tenth Amendment Claims

The Tenth Amendment provides that "[t]he powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people." Defendants, citing Tennessee Electric Power Co. v. TVA, 306 U.S. 118, 59 S.Ct. 366, 372-73, 83 L.Ed. 543 (1939), argue that the plaintiffs as private citizens have no standing to raise a claim under the Tenth Amendment because the Tenth Amendment was designed to protect the interests of states. Defendants also argue that even if plaintiffs had standing to sue under the Tenth Amendment, the administration of health care is clearly an economic activity, and the enactment of HIPAA was well within Congress's Commerce Clause powers.

Although some lower courts have concluded that individuals may have standing to assert Tenth Amendment claims, Tennessee Electric remains binding precedent. Moreover, the Fifth Circuit has affirmed a well-reasoned district court ruling that individual plaintiffs lack standing to sue under the Tenth Amendment. See Gaubert v. Denton, No. Civ. A. 98-2947, 1999 WL 350103 at *5 (E.D.La. May 28, 1999) (Tennessee Electric has never been overruled and remains binding authority), aff'd, 210 F.3d 368 (5th Cir.2000). Accordingly, the court concludes that plaintiffs have no standing as private individuals to pursue their claims under the Tenth Amendment.

Even if plaintiffs did have standing to sue under the Tenth Amendment, the court concludes that plaintiffs' Tenth Amendment claims have no merit. HIPAA regulates interstate economic activity.^[7] Health care plans operate across state lines. Health care providers transmitting health information in electronic form in connection with health claims, referral authorizations, and health care payments, also engage in interstate commerce. The court concludes that HIPAA falls within Congress's Commerce Clause authority. See, e.g., United States v. Gregg, 226 F.3d 253, 262 (3d Cir.2000) (Freedom of Access to Clinic Entrances Act, barring abortion protestors from blocking entrances to reproductive health care facilities was proper exercise of Congress's power to regulate intrastate conduct that, in the aggregate, has a substantial effect on interstate commerce); Freilich v. The Board of Directors of Upper Chesapeake Health, Inc., 142 F.Supp.2d 679, 694 (D.Md.2001) (Health Care Quality Improvement Act, which granted limited immunity to those who take part in hospital peer review activities if certain due process standards are met, was valid as an exercise of Congress's power to regulate interstate commerce under the Commerce Clause).

D. Statutory Claims

Defendants also argue that the court should dismiss plaintiffs' statutory claims. Since it appears from their briefs that defendants do not challenge the court's subject matter jurisdiction to hear these claims, the court will analyze defendants' statutory arguments under the Fed. R.Civ.P. 12(b)(6) standards for failure to state a claim.

1. Scope of Privacy Rule under HIPAA

Plaintiffs allege that the Privacy Rule goes beyond the scope of HIPAA by regulating the communication of individually identifiable health information in non-electronic as well as electronic form. Defendants argue that HHS's regulation of health information contained in all media is consistent with the language and purpose of HIPAA and is well within the scope of HHS's statutory authority.

HIPAA requires the Secretary of HHS to promulgate regulations that contain standards with respect to the privacy of health information transmitted in connection with certain transactions. HIPAA expressly defines "health information" to include any information, "whether oral or recorded in any form or media." 110 Stat.2022 (Aug. 21, 1996) (emphasis added). The plain language of the statute thus indicates that the regulation of individually identifiable health information in non-electronic as well as electronic form is not precluded. In light of this clear statutory language, the court concludes that plaintiffs can prove no set of facts that would entitle them to relief on these HIPAA claims. Accordingly, plaintiffs' claims should be dismissed with prejudice pursuant to Rule 12(b)(6). See In re Burzynski, 989 F.2d 733, 745 (5th Cir.1993) (failure to allege facts stating any cause of action results in dismissal of plaintiffs' claims with prejudice).

Moreover, the Supreme Court has held that the validity of a regulation promulgated by an agency pursuant to Congressional mandate will be sustained so long as it is "reasonably related to the purposes of the enabling legislation." Thorpe v. Housing Authority of City of Durham, 393 U.S. 268, 89 S.Ct. 518, 525, 21 L.Ed.2d 474 (1969). See also American Trucking Assns. v. United States, 344 U.S. 298, 73 S.Ct. 307, 97 L.Ed. 337 (1953). Unless clearly erroneous or unreasonable, the interpretation of a statute by a regulatory agency that is charged with administering it is given considerable deference by federal courts. Florida v. Mathews, 526 F.2d 319, 323 n. 10 (5th Cir.1976). Regulating non-electronic as well as electronic transmissions of health information effectuates HIPAA's intent to promote the computerization of medical information and to protect the confidentiality of this health information. Limiting the Privacy Rule to electronic information could create disincentives to comply with the Rule and to computerize medical records. Therefore, even if HIPAA did not expressly allow HHS to regulate the transmission of non-electronic as well as electronic health information, the provisions of the Privacy Rule promulgated by HHS are reasonably related to the purposes of HIPAA, the enabling legislation, and should be sustained. See Thorpe, 89 S.Ct. at 525, 89 S.Ct. 518.

2. Delay in Promulgation of Privacy Rule

Plaintiffs also complain that the Privacy Rule was not promulgated within the time period set forth in Section 264 of HIPAA, and that HHS therefore lost its statutory delegation of authority to promulgate any privacy regulations. Defendants argue, however, and the court agrees, that HHS's delay in promulgating the final Privacy Rule did not deprive the agency of the power to act. See Regions Hospital v. Shalala, 522 U.S. 448, 118 S.Ct. 909, 916, 139 L.Ed.2d 895 (1998) (Secretary's failure to meet the deadline does not mean that official lacked power to act beyond it); Brock v. Pierce County, 476 U.S. 253, 106 S.Ct. 1834, 1839, 90 L.Ed.2d 248 (1986) (even though the Secretary of Labor did not meet a "shall" statutory deadline, the Court "would be most reluctant to conclude that every failure of an agency to observe a procedural requirement voids subsequent agency action"). Agency delays, particularly in the face of huge administrative burdens, are common, and in this case such delays do not result in the invalidation of HHS's authority to promulgate the Privacy Rule.

3. Regulatory Flexibility Act

Plaintiffs allege that the Privacy Rule violates the Regulatory Flexibility Act because HHS failed to take into account the administrative burden that compliance with the Rule would place upon small businesses and health care entities. Under the RFA, final agency rules must contain a "final regulatory flexibility analysis" ("FRFA"), 5 U.S.C. § 604(a), which must include

a description of the steps the agency has taken to minimize the significant economic impact on small entities consistent with the stated objectives of applicable statutes, including a statement of the factual, policy, and legal reasons for selecting the alternative adopted in the final rule and why each one of the other significant alternatives to the rule considered by the agency which affect the impact on small entities was rejected.

5 U.S.C. § 604(a)(5). In 1996 Congress provided for judicial review of agency compliance with the RFA. See 5 U.S.C. § 611(a)(1). The RFA requires that an agency make a "reasonable, good-faith effort" to carry out the mandate of the RFA. Associated Fisheries, Inc. v. Daley, 127 F.3d 104, 114 (1st Cir.1997); Alenco Communications, Inc. v. FCC, 201 F.3d 608, 625 (5th Cir.2000).

Plaintiffs acknowledge that HHS complied with its statutory obligation under the RFA to publish a FRFA regarding the final Privacy Rule. This FRFA appears to address all of the substantive issues required by the RFA, including the purposes of the Privacy Rule,^[8] the public comments received and the responses by the Secretary of HHS,^[9] and a description of the steps taken by HHS to minimize the economic impact on small entities.^[10]

The RFA is a procedural rather than substantive agency mandate, and plaintiffs have failed to articulate any specific procedural flaws in HHS's promulgation of the Privacy Rule. See Associated Fisheries, 127 F.3d at 114 (stating that "section 604 does not command an agency to take specific substantive measures, but, rather, only to give explicit consideration to less onerous options"). HHS published a FRFA according to the requirements of the RFA, and plaintiffs have alleged no specific facts indicating that HHS failed to make a good-faith effort otherwise to satisfy the requirements of the RFA. Plaintiffs have therefore failed to state a claim under the RFA.

4. Paperwork Reduction Act

Plaintiffs complain that the Privacy Rule overlooks the high administrative costs to be borne by small health entities, in violation of the Paperwork Reduction Act. One of the purposes of the PRA is to "minimize the paperwork burden for individuals, small businesses, educational and nonprofit institutions, ... and other persons resulting from the collection of information by or for the Federal Government." 44 U.S.C. § 3501(1). By its express terms the PRA provides a defense to any enforcement action. The statute states that "no person shall be subject to any penalty for failing to ... provide information to any agency if the information collection request ... does not display a current control number assigned by the Director [of the Office of Management and Budget]." 44 U.S.C. § 3512. The statute also provides that the protection provided by this section "may be raised in the form of a complete defense, bar, or otherwise at any time during the agency administrative process or judicial action applicable thereto." Id.

The PRA does not create a private right of action. See Saco River Cellular, Inc. v. FCC, 133 F.3d 25 (D.C.Cir.1998) (§ 3512 is only a defense to enforcement actions); Tozzi v. EPA, 148 F.Supp.2d 35, 43 (D.D.C.2001) (no private right of action under the PRA); Teledyne v. United States, 50 Fed.Cl. 155, 190 (Fed.Cl.2001) (same). Since neither HHS nor any other governmental body has commenced any administrative or judicial action against them, plaintiffs cannot seek a declaratory judgment invalidating the Privacy Rule on the grounds that it violates the provisions of the PRA.^[11] Since plaintiffs' PRA claim is barred by the very terms of the statute, plaintiffs have failed to state any claim under the PRA.

V. Conclusions and Order

Because plaintiffs have suffered no actual or imminent injury due to enforcement of the Privacy Rule, plaintiffs' Fourth Amendment and First Amendment claims are not ripe for judicial review, and plaintiffs lack standing to pursue these claims. Because only states may properly assert claims under the Tenth Amendment, plaintiffs have no standing to pursue these claims. Accordingly, plaintiffs' constitutional claims are dismissed for want of subject matter jurisdiction.

Because the plain language of HIPAA contemplates regulation of more than electronically-transmitted health information, and because HHS's delay in publishing the Privacy Rule did not deprive HHS of its statutory authority to promulgate the Privacy Rule, plaintiffs' HIPAA claims will be dismissed for failure to state a claim. Because plaintiffs have failed to allege facts indicating that HHS neglected to make a good-faith effort to comply with the requirements of the RFA, these claims will also be dismissed. Because plaintiffs have no standing outside of defense of an agency enforcement action to assert a private cause of action under the PRA, plaintiffs' PRA claims also fail.

Defendants' Motion to Dismiss (Docket Entry No. 10) is GRANTED.

NOTES

[1] H.R.Rep. No. 104-496, at 1, 66-67, reprinted in 1996 U.S.C.C.A.N. 1865, 1865-66.

[2] See "Standards for Privacy of Individually Identifiable Health Information," Exhibit D attached to Memorandum of Points and Authorities in Support of Defendants' Motion to Dismiss, Docket Entry No. 11.

[3] See Plaintiffs' Complaint for Declaratory Relief, Docket Entry No. 1, at ¶ 6.

[4] Moreover, defendants correctly point out that only one provision of the Privacy Rule, 45 C.F.R. § 160.310(c), requires that covered entities provide the government access to protected health information under certain conditions for purposes of enforcing the Privacy Rule. Most of the regulations about which plaintiffs complain do not mandate disclosures to the government, but merely permit entities, without violating the Privacy Rule, to comply with state and federal laws that already require disclosure of protected health information. See 65 Fed.Reg. 82531 (Dec. 28, 2000). For example, 45 C.F.R. § 512(c), cited by plaintiffs, permits a covered entity to disclose protected health information evidencing domestic abuse, neglect, or violence to governmental bodies authorized to receive such reports. Because a covered entity is neither required nor prohibited by the Rule from making such a report, the Privacy Rule does not alter existing law or create any new access for law enforcement. The Privacy Rule merely makes it possible for entities to comply with existing laws without violating the Privacy Rule in the process. See Fed.Reg. 82589, 82566 (Dec. 28, 2000).

[5] Plaintiffs also allege that the Privacy Rule extends beyond the scope of the initial regulations proposed by HHS before the publication of the final Rule. Plaintiffs complain, for example, that the final Rule eliminates requirements for covered entities to act on patient requests for information access as soon as possible, and instead permits covered entities to take up to 60 or 90 days to act on access requests. Plaintiffs argue that this new provision "trammels" on state laws (e.g., in Florida and in California) that guarantee patients timely access to medical records. The court concludes that this claim fails to allege an unreasonable search or seizure in violation of the Fourth Amendment. The fact that the ultimate Privacy Rule may have altered previously proposed regulations does not constitute a search or seizure of plaintiffs' persons or effects.

Moreover, as defendants point out, the Privacy Rule generally guarantees patient access to medical records and imposes a deadline of 30 days by which access must be provided, unless the information is not maintained or accessible on site. See 45 C.F.R. § 164.524(b)(2). State laws requiring access within a shorter time frame are still valid, since the Privacy Rule does not preempt state laws that are not contrary to the Rule. Under this scheme, compliance with both state laws and the Privacy Rule is possible. See § 264(c)(2) of HIPAA, Pub.L. No. 104-191, 110 Stat.2033-34 (HHS regulations do "not supercede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation").

[6] See Declaration of Dawn Richardson, Exhibit H attached to Memorandum of Points and Authorities in Opposition to Defendants' Motion to Dismiss, Docket Entry No. 20, at unnumbered p. 1.

[7] The Supreme Court has identified three broad categories of activity that Congress may regulate under its commerce power. Congress may: (1) "regulate the use of the channels of interstate commerce," United States v. Lopez, 514 U.S. 549, 115 S.Ct. 1624, 1629, 131 L.Ed.2d 626 (1995) (citations omitted); (2) "regulate and protect the instrumentalities of interstate commerce, or persons or things in interstate commerce even though the threat may come only from intrastate activity," id.; and (3) "regulate those activities having a substantial relation to interstate commerce ... i.e., those activities that substantially affect interstate commerce." Id. at 1629-30. When determining whether regulated activities substantially affect interstate commerce, courts must defer to a congressional finding and "need only look for a rational basis" for this finding. Id. (citing Hodel v. Virginia Surface Mining & Reclamation Ass'n, Inc., 452 U.S. 264, 101 S.Ct. 2352, 2360, 69 L.Ed.2d 1 (1981)).

[8] 65 Fed.Reg. 82779.

[9] Id.; 65 Fed.Reg. 82756-58.

[10] 65 Fed.Reg. 82782-93.

[11] Plaintiffs cite Dole v. United Steelworkers of America, 494 U.S. 26, 110 S.Ct. 929, 108 L.Ed.2d 23 (1990), and Action Alliance of Senior Citizens of Greater Philadelphia v. Sullivan, 930 F.2d 77 (D.C.Cir.1991), for the proposition that a private cause of action exists under the PRA. These two cases, however, involved challenges to the Office of Management and Budget's ("OMB") authority to disapprove provisions mandating information disclosure under the PRA pursuant to 44 U.S.C. § 3508 (which states, in relevant part, that if the Director of the OMB "determines that the collection of information by an agency is unnecessary for any reason, the agency may not engage in the collection of information").