State Law HIPAA Claims Not Preempted by Federal HIPAA

In April 2013, I wrote an article for Physicians Practice entitled, "With HIPAA, State Requirements as Important as Federal Ones." The article highlighted that although the U.S. Supreme Court declined to review a November 2012 decision by the West Virginia Supreme Court of Appeals, it indicated that the decision reached in the case that was before it is allowed to stand. This case, R.K. v. St. Mary's Med. Ctr., Inc., No. 11-0924 (W. Va. Nov. 15, 2012) involved the "wrongful disclosure of confidential information relayed by plaintiff while he was a patient, which was never previously disclosed, including to his estranged wife." The protected health information (PHI) was improperly accessed and disclosed to the estranged wife and her divorce attorney. The West Virginia Supreme Court held that there were no contradictions in the state law and federal HIPAA claims. Meaning that the state law tort claims were not preempted by federal law.

Now, a Federal Court of Appeals has reached the same conclusion. In Murphy v. Dulay, No. 13-14637 (11th Cir. Oct. 10, 2014), the "appeal involv[ed] a federal preemption challenge to a Florida statute requiring presuit actions by an individual plaintiff before he may bring a medical negligence claim in Florida state court." The 11th Circuit reversed the district court's judgment after finding that the written authorization form, which enables the release of PHI, is not preempted by federal HIPAA.

Basically, Florida Statute §766.1065 works in tandem with the federal provision 45 C.F.R. §§ 164.508, 164.512. This is not surprising because there are only very limited circumstances where HIPAA obligations have exceptions. "The HIPAA Privacy Rule sets forth the criteria for voluntary disclosures that do not require a patient's authorization or consent. These exceptions allow providers to use protected health information (PHI) for important public policy reasons and permit disclosures: (1) required by law; (2) for public health activities; (3) about victims of abuse, neglect, or domestic violence; (4) for health oversight activities; (5) for judicial and administrative proceedings; (6) for law enforcement; (7) about decedents to coroners, medical examiners, and funeral directors; (8) for cadaveric organ, eye, or tissue donation; (9) for research purposes pursuant to a waiver of authorization, for reviews preparatory to research, and for research on a decedent's information; (10) to avert a serious threat to health or safety; (11) for military and veterans' affairs, national security, and intelligence; and (12) for workers' compensation."

Although the situation was different between the West Virginia state case and the Florida federal case, the outcome was the same. State causes of action are not preempted by Federal HIPAA and HITECH. Both of these cases are notable because the Supreme Court denied certiorari in April 2013 and the Florida statute at issue became effective on July 1, 2013. Hence both these decisions have gained precedent after the Final Omnibus Rule was published in the Federal Register on January 25, 2013 (78 Fed. Reg. 5565).