OPIS Mgmt. Res. LLC, et al v. Sec., FL Agency for Health Care Admin., No. 12-12593 (11th Cir. 2013)
Annotate this Case
Justia Opinion Summary
Want to stay in the know about new opinions from the Eleventh Circuit U.S. Court of Appeals?
Sign up for free summaries delivered directly to your inbox. Learn More ›
You already receive new opinion summaries from Eleventh Circuit U.S. Court of Appeals. Did you know we offer summary newsletters for even more practice areas and jurisdictions? Explore them here.
This case stemmed from requests to the Nursing Facilities from spouses and attorneys-in-fact for medical records of deceased nursing home residents. At issue was whether section 400.145 of the Florida Statutes was preempted by the Federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. 1320d to d-9, and its implementing regulations. The court held that section 400.145 and HIPAA could not be reconciled and the court agreed with the district court that the Florida statute stood as an obstacle to the accomplishment and execution of the full purposes and objectives of HIPAA in keeping an individual's protected health information strictly confidential. Accordingly, the court affirmed the district court's judgment that the Florida statute was preempted and its grant of summary judgment in favor of the Nursing Facilities, explaining that the Florida statue afforded nursing home residents less protection than was required by the federal law.
Download PDF
Case: 12-12593 Date Filed: 04/09/2013 Page: 1 of 13 [PUBLISH] IN THE UNITED STATES COURT OF APPEALS FOR THE ELEVENTH CIRCUIT ________________________ No. 12-12593 ________________________ D. C. Docket No. 4:11-cv-00400-RS-CAS OPIS MANAGEMENT RESOURCES LLC, RULEME CENTER LLC, GULF COAST HEALTHCARE LLC, SA-PG-JACKSONVILLE LLC, SA-PG-SUN CITY CENTER LLC, et al., Plaintiffs-Appellees, versus SECRETARY FLORIDA AGENCY FOR HEALTH CARE ADMINISTRATION, Defendant-Appellant. ________________________ Appeal from the United States District Court for the Northern District of Florida _________________________ (April 9, 2013) Before DUBINA, Chief Judge, BLACK and ALARCà N, * Circuit Judges. * Honorable Arthur L. Alarcón, United States Circuit Judge for the Ninth Circuit, sitting by designation. Case: 12-12593 Date Filed: 04/09/2013 Page: 2 of 13 BLACK, Circuit Judge: The issue before us is whether § 400.145 of the Florida Statutes which provides for the release of medical records of deceased residents of nursing homes to certain specified individuals is preempted by the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d to d-9, and its implementing regulations. As it stands, § 400.145 and HIPAA cannot be reconciled, and we agree with the district court that the Florida statute stands as an obstacle to the accomplishment and execution of the full purposes and objectives of HIPAA in keeping an individual s protected health information strictly confidential. Accordingly, we affirm. I. BACKGROUND The underlying facts are not in dispute. Plaintiffs-Appellees OPIS Management Resources, LLC; Ruleme Center, LLC; Gulf Coast Healthcare, LLC; SA-PG-Jacksonville, LLC; SA-PG-Sun City Center, LLC; Cypress Health Group, LLC; and Consulate Health Care, LLC (collectively the Nursing Facilities or the Facilities) are operators and managers of skilled nursing facilities in Florida. In the course of their operations, the Nursing Facilities received requests from spouses and attorneys-in-fact for the medical records of deceased nursing home residents. The Facilities refused to disclose the records because the parties requesting them were not personal representatives under the relevant provisions of HIPAA, 2 Case: 12-12593 Date Filed: 04/09/2013 Page: 3 of 13 which regulates the release of protected health information by covered entities. 1 See 45 C.F.R. § 164.502.2 Consequently, the requesting parties filed complaints with the U.S. Department of Health and Human Services Office for Civil Rights, which concluded the Nursing Facilities actions were consistent with HIPAA. Defendant-Appellant Florida Agency for Health Care Administration (the State Agency), however, issued citations to the Nursing Facilities for violating Florida law by refusing to release the records. Specifically, the Facilities were cited for violating § 400.145 of the Florida Statutes, which requires licensed nursing homes to release a former resident s medical records to the spouse, guardian, surrogate, or attorney-in-fact of any such resident. See Fla. Stat. § 400.145(1). In written correspondence to individuals who had requested and been denied deceased residents medical records, the State Agency explained that it interprets § 400.145 in a manner allowing a spouse to qualify as a personal representative such that a deceased spouse s medical records may be disclosed under HIPAA. Given the dueling interpretations of the relevant statutes, the Nursing Facilities filed a complaint in the district court seeking a declaratory judgment that 1 The parties do not dispute that the Nursing Facilities are covered entities. 2 We note that various amendments to the Code of Federal Regulations relating to HIPAA became effective March 26, 2013, while this appeal was pending. The amendments, however, are largely immaterial to the issue before us, except for the addition of 45 C.F.R. § 164.510(b), which we discuss in further detail below. 3 Case: 12-12593 Date Filed: 04/09/2013 Page: 4 of 13 § 400.145 is preempted by HIPAA. 3 The parties then filed cross-motions for summary judgment. In ruling on the motions, the district court found that § 400.145 was preempted because it impeded the accomplishment and execution of HIPAA s purposes and objectives. The court granted the Nursing Facilities motion for summary judgment, explaining that the Florida statute affords nursing home residents less protection than is required by the federal law. This appeal followed. II. STANDARD OF REVIEW We review the district court s grant of summary judgment de novo, viewing the evidence and drawing all reasonable inferences in the light most favorable to the nonmoving party. Fresenius Med. Care Holdings, Inc. v. Tucker, 704 F.3d 935, 939 (11th Cir. 2013). III. DISCUSSION The State Agency contends the district court erred in granting summary judgment to the Nursing Facilities because § 400.145 does not impede the goals and purposes of HIPAA. Instead, laws such as § 400.145 play a vital role in the federal statute s requirements, which look to state law to define the category of 3 In Claim Two, the Nursing Facilities also sought injunctive relief. The Facilities, however, successfully moved to dismiss the claim following the district court s grant of partial summary judgment, and that claim is not before us on appeal. 4 Case: 12-12593 Date Filed: 04/09/2013 Page: 5 of 13 personal representatives to whom a deceased individual s protected health information may be disclosed. We begin our analysis with the bedrock principle that the Constitution designates the laws of the United States as the supreme law of the land, requiring that all conflicting state provisions be without effect. Maryland v. Louisiana, 451 U.S. 725, 746, 101 S. Ct. 2114, 2128 29 (1981); see also U.S. Const. art. VI, cl. 2. Accordingly, where state and federal law directly conflict, state law must give way. PLIVA, Inc. v. Mensing, 131 S. Ct. 2567, 2577 (2011). In addition, [t]here is no doubt that Congress may withdraw specified powers from the States by enacting a statute containing an express preemption provision. Arizona v. United States, 132 S. Ct. 2492, 2500 01 (2012). As the Supreme Court has explained, [w]hen a federal law contains an express preemption clause, we focus on the plain wording of the clause, as the plain language of the text is the best evidence of Congress preemptive intent. Chamber of Commerce of U.S. v. Whiting, 131 S. Ct. 1968, 1977 (2011) (internal quotation omitted). Nevertheless, when the text of a pre-emption clause is susceptible of more than one plausible reading, courts ordinarily accept the reading that disfavors pre-emption. Altria Grp., Inc. v. Good, 555 U.S. 70, 77, 129 S. Ct. 538, 543 (2008) (internal quotation omitted). 5 Case: 12-12593 Date Filed: 04/09/2013 Page: 6 of 13 In drafting HIPAA, Congress included an express preemption provision. 42 U.S.C. § 1320d-7. HIPAA s preemption clause provides that the statute shall supersede any contrary provision of State law, and lists certain exceptions that are not at issue here. Id. § 1320d-7(a). A state law is contrary to HIPAA if: (1) A covered entity or business associate would find it impossible to comply with both the State and Federal requirements; or (2) The provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of . . . section 264 of Public Law 104-191. . . . 45 C.F.R. § 160.202. HIPAA, however, does not preempt state laws that provide more stringent privacy protections. See id. § 160.203(b). One of Congress s objectives in enacting HIPAA was to address concerns about the confidentiality of patients individually identifiable health information. See Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, § 264, 110 Stat. 1936; see also S.C. Med. Ass n v. Thompson, 327 F.3d 346, 348, 354 (4th Cir. 2003) ( Recognizing the importance of protecting the privacy of health information in the midst of the rapid evolution of health information systems, Congress passed HIPAA in August 1996. ). To that end, Congress provided for the Secretary of Health and Human Services to promulgate privacy regulations addressing individuals rights to individually identifiable health information, procedures for exercising such rights, and the uses and disclosures of such information. Pub. L. No. 104-191, § 264(b) & (c)(1); S.C. Med. Ass n, 327 6 Case: 12-12593 Date Filed: 04/09/2013 Page: 7 of 13 F.3d at 349. In compliance with the statute, the Department of Health and Human Services issued final regulations known as the Privacy Rule. S.C. Med. Ass n, 327 F.3d at 349; see also Citizens for Health v. Leavitt, 428 F.3d 167, 172 74 (3d Cir. 2005) (detailing the history of the Privacy Rule s promulgation and explaining its requirements). The Privacy Rule establishes that [a] covered entity or business associate may not use or disclose protected health information, except in certain circumstances not at issue here, or with valid authorization. 45 C.F.R. §§ 164.502(a), 164.508(a)(1). Among the disclosures permitted by the Privacy Rule are disclosures to the individual whose information is being protected, as well as disclosures to the individual s personal representative. Id. § 164.502(a)(1)(i), (g)(1) ( [A] covered entity must . . . treat a personal representative as the individual for purposes of this subchapter. ). As of March 26, 2013, [a] covered entity must comply with the requirements of [the Privacy Rule] with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual. Id. § 164.502(f). 4 Regarding deceased individuals, the Privacy Rule further specifies that: If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual s estate, a covered entity must treat such person as a 4 Prior to March 26, 2013, § 164.502(f) did not contain any time limitation with respect to the disclosure of a deceased individual s protected health information. 7 Case: 12-12593 Date Filed: 04/09/2013 Page: 8 of 13 personal representative under this subchapter, with respect to protected health information relevant to such personal representation. Id. § 164.502(g)(4). 5 Also as of March 26, 2013, if an individual is deceased, a covered entity may disclose to a family member, or [other relatives, close personal friends of the individual, or any other persons identified by the individual] who were involved in the individual s care or payment for health care prior to the individual s death, protected health information of the individual that is relevant to such person s involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity. Id. § 164.510(b)(5). Since 1987 nearly a decade before Congress enacted HIPAA Florida law has required licensed nursing homes to disclose deceased residents medical records to certain individuals who request them. See Fla. Stat. § 400.145; see also 1987 Fla. Sess. Law Serv. 87-302. Specifically, § 400.145 provides that: Unless expressly prohibited by a legally competent resident, any nursing home licensed pursuant to this part shall furnish to the spouse, guardian, surrogate, proxy, or attorney in fact . . . of a current resident, . . . or of a former resident, . . . a copy of that resident s records which are in the possession of the facility. Such records shall include medical and psychiatric records and any records concerning the care and treatment of the resident performed by the facility, except progress notes and consultation report sections of a psychiatric nature. Copies of such records shall not be considered part of a deceased resident s estate and may be made available prior to the administration of an estate, upon request, to the spouse, guardian, surrogate, proxy, or attorney in fact . . . . Fla. Stat. § 400.145(1). 5 We read applicable law to mean state law. 8 Case: 12-12593 Date Filed: 04/09/2013 Page: 9 of 13 The State Agency s argument against preemption hinges on the Privacy Rule s mandate that any person who has authority to act on behalf of a deceased individual under state law be treated as a personal representative. See 45 C.F.R. § 164.502(g)(4). This is important because an individual s personal representative enjoys the same broad access to protected information and freedom from the Privacy Rule s strictures as the individual. See 45 C.F.R. § 164.502(g)(1). According to the State Agency, § 400.145 enumerates groups of people, including spouses, who may access a deceased resident s medical records on behalf of the resident, meaning that they should be treated as personal representatives. Thus, rather than conflicting with HIPAA and the Privacy Rule, § 400.145 supplements and works in tandem with the federal law. The fatal flaw in the State Agency s argument is that the plain language of § 400.145 does not empower or require an individual to act on behalf of a deceased resident. The unadorned text of the state statute authorizes sweeping disclosures, making a deceased resident s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident s stead. See 45 C.F.R. § 164.502(g)(4) (providing that a person authorized to act on behalf of a deceased individual must be treated as a personal representative with respect to protected health information 9 Case: 12-12593 Date Filed: 04/09/2013 Page: 10 of 13 relevant to such personal representation (emphasis added)). We therefore agree with the district court that § 400.145 frustrates the federal objective of limiting disclosures of protected health information, and that the statute is thus preempted by the more stringent privacy protections of HIPAA and the Privacy Rule. The State Agency s contention that 45 C.F.R. § 164.510(b)(5) saves § 400.145 suffers from the same problem. While § 164.510(b)(5) authorizes covered entities to release a deceased individual s protected health information to family members or other individuals, the regulation does not open a broad new avenue of access to protected health information, as the State Agency contends. Instead, § 164.510(b)(5) permits covered entities to release a deceased individual s protected health information in narrowly delineated circumstances. First, the regulation applies only to two groups of people: (1) those involved in the deceased individual s health care, and (2) those who paid for the deceased individual s health care. Second, covered entities may release only protected health information that is relevant to such person s involvement, i.e., information that is relevant to the care of the deceased individual or to the payment of the deceased individual s health care. Section 400.145, by comparison, contains no such limitations or restrictions. The State Agency s reliance on Alvista Healthcare Center, Inc. v. Miller, 686 S.E.2d 96 (Ga. 2009), is also unavailing. In Alvista, the widow of a deceased 10 Case: 12-12593 Date Filed: 04/09/2013 Page: 11 of 13 nursing home resident requested copies of her late husband s medical records to investigate a potential action for wrongful death. Id. at 97. After the requests were denied, the widow sued the operator of the nursing home. Id. The Georgia Supreme Court held that a provision of state law, O.C.G.A. § 31-33-2, authorized a surviving spouse to act on behalf of the decedent or his estate in obtaining medical records and, therefore, that the surviving spouse [was] entitled to access the decedent s protected health information in accordance with 45 C.F.R. § 164.502(g)(4). Id. Central to the Georgia Supreme Court s resolution of the case was the fact that, in 2006, the Georgia legislature specifically amended § 31-33-2 to comply with HIPAA. See id. at 98. The legislature addressed HIPAA and the Privacy Rule by requiring any request for medical records by an individual specified in the statute be accompanied by an authorization that comported with HIPAA and its implementing regulations. Id. In addition, the Georgia statute was amended to provide a hierarchy of individuals who could submit an authorization and thus act on behalf of a decedent or his estate, with the first priority given to an administrator or executor, and a surviving spouse receiving authority only in the absence of an administrator or executor. Id. Thus, it was clear that the statute treated a surviving spouse as a personal representative in lieu of the executor or administrator with respect to requests for medical records. Id. The Georgia 11 Case: 12-12593 Date Filed: 04/09/2013 Page: 12 of 13 Supreme Court emphasized that the limited personal representation created by § 33-31-2 did not extend to any context other than obtaining a decedent s medical records, and that the statute was carefully tailored to provide the authority contemplated by the Privacy Rule. Id. Unlike the situation in Alvista, the Florida legislature has not amended or modified § 400.145 to address the impact of HIPAA and its implementing regulations. Section 400.145 does not require a HIPAA-compliant authorization to accompany a request for a deceased individual s medical records, nor can the statute plausibly be read as creating a limited personal representation in the person of a surviving spouse in light of the blanket disclosures that it requires. Given the opportunity, we are confident the Florida legislature could bring § 400.145 into compliance with federal law in any number of ways. Amending the statute, however, is a task for the state legislature, not a panel of federal judges. Finally, we emphasize that we have no occasion to address the State Agency s argument that it is possible to comply with both HIPAA and § 400.145 because 45 C.F.R. § 164.512(a)(1) permits a covered entity to use and disclose protected health information as required by law. 6 The State Agency did not advance this argument before the district court, and we decline to consider it for 6 Section 164.512(a)(1) provides that [a] covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. 12 Case: 12-12593 Date Filed: 04/09/2013 Page: 13 of 13 the first time on appeal. See, e.g., Access Now, Inc. v. Sw. Airlines, Co., 385 F.3d 1324, 1331 (11th Cir. 2004) ( This Court has repeatedly held that an issue not raised in the district court and raised for the first time in an appeal will not be considered by this [C]ourt. (quotations omitted)).7 Thus, nothing that we have said should be inferred as expressing an opinion regarding the required by law provision. IV. CONCLUSION For the foregoing reasons, we agree with the district court that § 400.145 of the Florida Statutes impedes the accomplishment and execution of the full purposes and objectives of HIPAA and the Privacy Rule in keeping an individual s protected health information confidential. Accordingly, the district court s grant of summary judgment is AFFIRMED. 7 Although the State Agency cited § 164.512 in its motion for summary judgment, it did so in support of its argument that § 400.145 is more stringent than the Privacy Rule. The State Agency did not raise the argument it presents on appeal, i.e., that § 164.512 provides a separate, independent means of harmonizing federal and state law. Accordingly, the specific argument advanced on appeal was not sufficiently raised before the district court and we will not address it. See Bryant v. Jones, 575 F.3d 1281, 1308 (11th Cir. 2009) ( It is well established in this circuit that, absent extraordinary circumstances, legal theories and arguments not raised squarely before the district court cannot be broached for the first time on appeal. ). 13
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
