Federal Appeals Court Sides With HIPAA Over Florida Law in "Catch 22" Case Over the Release of Deceased Patient Records by Nursing Homes

As we first reported in December 2011, it's a common scenario: A Florida nursing home resident dies, and his or her spouse, surrogate, proxy, or attorney requests the resident's medical records.
However, if the nursing home releases the records, it might be violating federal law. If it doesn't, it violates Florida law. A federal trial court then noted this "Catch-22" and declared the Florida law invalid. The decision was appealed and now the U.S. Court of Appeals has affirmed the decision in a decision rendered April 9, 2013. The impact of this decision on nursing homes and other providers is outlined below.

***Conflicting Laws
Florida Statutes Section 400.145 provides that nursing homes "shall furnish to the spouse, guardian, surrogate, proxy, or attorney in fact . . . of a former resident . . . a copy of that resident's records which are in the possession of the facility." Also, "Copies of such records . . . may be made available prior to the administration of an estate, upon request, to the spouse, guardian, surrogate, proxy, or attorney in fact."

However, the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA") provides that nursing homes may only release medical records to a patient or his/her personal representative. 45 C.F.R. 164.502(a)(1), (g)(1). When a patient is deceased, "personal representative" means an "executor, administrator, or other person [who] has authority to act on behalf of a deceased individual or of the individual's estate." 45 C.F.R. 164.502(g)(4).

Thus, a person authorized under Section 400.145 can be–but is not always–the same as the personal representative under HIPAA. As a result, Florida law requires nursing homes to release medical records even though doing so might violate federal law.

***The Federal Court's Decision:
Opis Management Resources, Inc., together with four other nursing home providers were cited by the Florida Agency for Health Care Administration ("AHCA") for failing to provide records to spouses or "attorneys in fact" of deceased residents because they were not authorized to receive the records pursuant to HIPAA. Their position was also upheld by the U.S. Department of Health and Human Services Office for Civil Rights when the requestors complained about the nursing homes' actions. They then sought declaratory relief from federal court based on the conflict between state and federal law.

On December 2, 2011, the United States District Court for the Northern District of Florida concluded that Section 400.145 is contrary to HIPAA and, therefore, invalid. Opis Management Resources, LLC v. Dudek, No. 11-400 (N.D. Fla. Dec. 2, 2011). The Court described the following scenarios:

A decedent's spouse, for example, could seek [protected health information] for any number of reasons . . . . A spouse could be trying to establish paternity, or her rights to life insurance. These goals do not conform to HIPAA' s purpose to protect privacy and act in the interest of the patient.

Id (internal citations omitted). States are generally free to pass their own privacy laws, but "provisions of state law which are contrary to HIPAA are preempted unless that state law is 'more stringent.'" Opis Management, No. 11-400 slip op. at 3 (citing 45 C.F.R. § 160.203). Because the Court found section 400.145 provides less protection than HIPAA, not more, it concluded that the state law is preempted.

***The Appellate Court's Decision:
AHCA appealed the trial decision and argued against preemption on the basis that HIPAA provides that any person who has authority to act on behalf of a deceased individual under state law can be treated as a personal representative. According to AHCA, the state statute identifies groups of people who may have access to a deceased resident's medical records "on behalf of" the resident, meaning they should be treated as personal representatives. Since personal representatives under HIPAA enjoy the same access to confidential information as the deceased individual, AHCA argued the two laws complement each other rather than conflict.

The court rejected this argument and noted that the Florida law authorizes sweeping disclosures, "making a deceased resident's protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident's stead." Under HIPAA, a personal representative may only access the decedent's confidential information that is relevant to the personal representation. The court agreed with the trial court's view that Florida's less stringent protection of confidential information frustrated HIPAA' s purpose and was, therefore, invalid. Interestingly, because AHCA did not raise the issue in the lower court of whether the state law was allowed by HIPAA Rule 164.512(a)(1) which allows for the release of PHI "as required by law," the appellate court did not address whether this would have saved the constitutionality of the state law.

***What This Means for Nursing Homes:
Because of the Court's ruling, section 400.145 is invalid and AHCA cannot currently sanction nursing homes for failing to abide by it. Therefore, nursing homes in Florida should only release a deceased resident's medical records to a personal representative of the estate, executor, administrator, or other person authorized to act on behalf of the deceased patient or the deceased patient's estate. If no such person exists, the nursing home should wait for a court to appoint an appropriate person.

Full Article and Source:
Federal Appeals Court Sides With HIPAA Over Florida Law in "Catch 22" Case Over the Release of Deceased Patient Records by Nursing Homes