Eleventh Circuit Holds HIPAA Privacy Rule Does Not Preempt Florida Medical Negligence Claim Requirement

In Murphy v. Dulay, No 13-14637 (Oct. 10, 2014), the 11th Circuit found that HIPAA’s Privacy Rule does not preempt a Florida statute that makes medical authorization forms a presuit requirement for medical negligence claims.

Plaintiff Glen Murphy received medical care from defendant Dr. Adolfo C. Dulay.  Murphy was dissatisfied with the treatment he received from Dulay, and sought to sue him for medical negligence.  Fla. Stat. § 766.1065 requires prospective plaintiffs to file an authorization form prior to filing medical negligence claims.  This form authorizes the disclosure of health information that is potentially relevant to the claim.  The authorization must also allow ex parte interviews of those providers, and must warn that the information is subject to additional disclosure by the recipient and may not be protected by HIPAA.

Murphy did not want his privacy to be invaded by the ex parte interviews required in the authorization form, so he sought relief in the Northern District of Florida.  Murphy sought an injunction against forced compliance with the statute, as well as a declaratory judgment that HIPAA preempted the presuit authorization requirement. The District Court granted Murphy both the injunctive relief and declaratory judgment.

On appeal, Murphy argued that HIPAA expressly preempts Fla. Stat. § 766.1065. Though HIPAA generally prohibits covered entities from disclosing protected health information, it permits disclosure made when, among other ways, a person signs a valid written authorization.

The court found no merit in any of Murphy’s four arguments why the Florida form does not satisfy HIPAA requirements.  First, HIPAA requires authorizations to be revocable.  Subsections 2 and 3 of Fla. Stat. § 766.1065 do contemplate and require the ability to revoke authorization. Revocation under Florida law has the consequence of voiding the required presuit notice, but HIPAA does not require the revocation to be consequence-free. Second, Murphy argued that the § 766.1065 requirement of disclosing unauthorized health care providers serves no legitimate purpose under HIPAA.  The court finds that this disclosure serves the purpose of resolving ambiguity, and, more importantly, HIPAA does not require any legitimate purpose for the disclosure. Third, Murphy argued that the Florida form does not meet HIPAA’s specificity requirements.  The Court found the Florida form does require descriptions of disclosures and the specific purposes of the authorization. Fourth, Murphy argued that § 766.1065 requires compound authorization prohibited by HIPAA.  The court characterized the presuit notice as a condition precedent to filing a medical negligence suit, rather than a “legal permission” of compound authorization. The court also found that the mandatory nature of the authorization is allowed under HIPAA.

So, the written authorization in § 766.1065 satisfies HIPAA’s requirements for express authorization of disclosure and it is possible to comply with both state and federal law.  The court also found that the Florida statute is not an obstacle to HIPAA’s objectives, because § 766.1065 satisfies HIPAA’s purpose of reducing health care costs by aiming to settle claims or otherwise dispose of claims prior to litigation.

The court thus found Florida’s required authorization form is not preempted by HIPAA.  The court vacated the injunction and declaratory judgment, and remanded the case to the district court to enter judgment for the defendant.

Twitter Digg Delicious Stumbleupon Technorati Facebook Email