On April 9, 2013, the Eleventh Circuit held that HIPAA preempts a Florida statute that requires nursing homes to release medical records of deceased residents to their spouses, attorneys-in-fact and other enumerated parties who request them. In Opis Management Resources LLC v. Secretary Florida Agency for Health Care Administration, the Florida agency that oversees nursing homes cited Opis Management, an operator of nursing homes, for refusing to release medical records to deceased residents’ spouses and attorneys-in-fact. Opis Management challenged the citations arguing that the requesting parties were not “personal representatives” under HIPAA.
The HIPAA Privacy Rule requires disclosures of PHI in only two situations: (1) to the individual, and (2) to the Secretary of HHS. Covered entities must also treat a deceased individual’s “personal representative,” who has authority to act on behalf of the deceased individual or his/her estate, as the individual for purposes of disclosures under the HIPAA Privacy Rule. While HIPAA does not preempt “more stringent” state laws, it sets a floor for privacy protections and supersedes any contrary provision of state law.
The Eleventh Circuit held that HIPAA preempts the Florida statute because it “impedes the accomplishment and execution of the full purposes and objectives of HIPAA and the Privacy Rule,” particularly keeping an individual’s PHI confidential. According to Judge Black, the Florida statute authorizes “sweeping disclosures” that made a deceased resident’s PHI available to certain individuals upon request without any need for authorization and “without regard to the authority of the individual making the request to act in the deceased’s stead.” Interestingly, because the Florida agency failed to timely raise the argument, the court did not consider whether compliance with both laws was possible because HIPAA permits covered entities to disclose PHI as “required by law.”
Opis Management Resources highlights one of the many challenges that covered entities face in trying to achieve compliance under HIPAA and state privacy law. Although the holding suggests that analogous Florida statutes mandating disclosures may too be preempted, the ruling is limited to licensed Florida nursing homes. Clearly, the scope of HIPAA preemption remains unsettled and the issue will likely continue to be determined on a case-by-case basis.