Physicians will still have to lay bare their patient records in legal proceedings in spite of stringent state and federal laws protecting patient information, one court ruled. The ruling in U.S. ex rel Mary Jane Stewart et al. vs. The Louisiana Clinic et al. (99-1767) could make life more difficult for physicians in billing disputes and False Claims Act cases. The U.S. District Court for Eastern Louisiana ruled that the Louisiana Clinic must hand over patient records in spite of a state law imposing liability on the clinic if it revealed patient information to anyone without authorization. At issue were records of patients who weren't a party to the plaintiff's FCA suit. The clinic sought to keep the government, which had declined to intervene in the case, from receiving the records. And the clinic argued that it should remove all identifying information from these records before handing them over. But the court ruled that state privilege law didn't apply in the federal lawsuit. And the federal government's status as a party in interest and its element of control in the case entitled it to receive all documents produced under discovery. But the court ruled that the Louisiana law didn't address "the form, substance, or the need for express legal permission from an individual," as HIPAA requires. Instead, the state law merely offered a way to negate the need for an individual consent because, although the patient may attend the contradictory hearing, it's up to the court to decide whether to order the disclosure of information in such hearings. The court endorsed the plaintiff's idea of a twofold disclosure in which attorneys would receive full documents containing identifying patient information, but documents released to the public would have all patient information replaced with code numbers. The defendants were concerned about the privacy implications of the huge stack of documents the plaintiffs requested, according to attorney Gilbert Ganucheau with New Orleans-based Kathleen L. DeBruhl & Associates, who represented the Louisiana Clinic. "We were concerned that if state law was more restrictive then it should apply instead of HIPAA or the federal rules," he relates. In the end, though, "the judge said, 'follow what HIPAA tells you to do and don't worry about state law,'" Ganucheau laments.
Louisiana law requires that all patients must give their consent in a "contradictory hearing" with their provider present before the provider can share their records with anyone. HIPAA supercedes state laws except where the state laws provide more "stringent" privacy protection to patient records.