Health Information Compliance Alert

Decision point: Courts look to preemption provisions in the HIPAA regs.

Patients in Florida can’t “have their cake and eat it too” when it comes to HIPAA privacy protections and medical malpractice lawsuits. So says the U.S. Court of Appeals for the Eleventh Circuit. 

Background: Plaintiff-appellee Glen Murphy received medical treatment from defendant-appellant Dr. Adolfo Dulay. When Murphy was unsatisfied with Dr. Dulay’s care, he thought about suing the doctor for medical negligence. 

How Med Mal Lawsuit Rules Challenge HIPAA Privacy

A Florida medical malpractice pre-lawsuit authorization law requires the plaintiff patient to authorize the release of their protected health information (PHI) before suing a medical provider for negligence, explained attorneys Thomas Range and Elizabeth Hodge in an Oct. 17 analysis for the law firm Akerman LLP. 

The Florida law requires that the presuit notice of intent to initiate a medical malpractice action must also include the authorization for both sides to access the plaintiff’s PHI as it relates to the case. 

“This authorization will allow a defendant, or his or her attorney, to interview a plaintiff’s treating providers regarding the plaintiff’s alleged injury without the presence of the plaintiff or the plaintiff’s attorney,” Range and Hodge explained. If the presuit notice doesn’t include the authorization, the presuit notice is void.

But Murphy alleged that the state law conflicted with HIPAA’s privacy requirements and that the provision was coercive, according to an Oct. 17 blog posting by partner attorney Linn Foster Freedman of the law firm Nixon Peabody LLP. The lower court sided with Murphy, agreeing that requiring plaintiffs to sign the authorization before being able to proceed with a malpractice case doesn’t give the plaintiff meaningful choices about who can access his PHI.

When Dr. Dulay appealed the decision, the Eleventh Circuit overturned the decision, finding that the Florida law is consistent with HIPAA disclosure requirements, Freedman reported. 

Impact: Medical malpractice defendants will now have the same access as plaintiffs to treating providers, “but it remains to be seen whether treating providers will agree to ex parte interviews with defense lawyers,” Range and Hodge said.

Look to Preemption for the Answer

“HIPAA specifically states that state law that is more stringent in protecting an individual’s [PHI] preempts HIPAA, and covered entities and business associates are required to follow the more stringent law,” Freedman explained. 

The appellate court found that the Florida law was clearly less stringent than HIPAA. The written authorization form required by Florida statute “is fully compliant with the HIPAA statute and its regulations, and the state and federal law are not in conflict,” the court wrote. 

Takeaway: Courts have upheld similar laws in Tennessee and Texas, Freedman noted. And as long as a state law doesn’t conflict with, and is less stringent than, the federal HIPAA statute, courts will continue to uphold these types of laws in medical malpractice cases.